{ "Event": { "published": true, "date": "2021-06-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-11", "timestamp": 1623456181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1bf92327-d655-4ceb-a890-15f92693d879", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50a8a84-ca9a-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623405137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405137, "uuid": "26e11a45-34d3-4a81-878a-f6298b49b79e", "comment": "Malware payload (CryptBot)", "value": "8d66181e9bdc4c8d7ce2d9600c8999e5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405137, "uuid": "a9210ee7-2010-4b9f-b56a-dbce7c464039", "comment": "Malware payload (CryptBot)", "value": "02a2043a1f05478b9f132142e25c3ea2ae6ff002f8e60ca43c4d835e49471699", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405137, "uuid": "342ee1df-ed5e-4b54-8e3e-410a138f8d8e", "comment": "Malware payload (CryptBot)", "value": "e9d72898357cd94912434eb04bc410fc800f849b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405137, "uuid": "1e74280b-ac26-4eee-9449-ace63ad4608c", "comment": "Malware payload (CryptBot)", "value": "cbc2ceba13df4021f55d712ef7181e24cedba496fc108145ae395ab8a23750a242e48e929cf1b4969e132f11700c47f9", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405137, "uuid": "64ee51fe-aba0-415f-8c2c-0c7b6fa13a69", "value": "3405D010B7A0C035F6F316F599B99279A92E7EE26B2450CF12D52BED47346E0AC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405137, "uuid": "ceca2318-e64d-419b-b530-e33dee6caeec", "value": "6e1c394035fae6de8f60b7510da6a873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405137, "uuid": "d4d1af38-e5b3-4027-83ee-67eff0525f60", "value": "24576:S9BBvcOOOfCNhJtKNXQT4jYqV26GaJVChSXib:SBvCh4sqV26gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405137, "uuid": "52ccc07a-7aa7-462b-8a65-0422ba410104", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405137, "uuid": "908ed4aa-a880-420a-834d-6e2382cc78af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405137, "uuid": "775f95fd-073c-4e02-b4a6-b06cdd1376e8", "value": "8d66181e9bdc4c8d7ce2d9600c8999e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55ec2d8-caf3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623443363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443363, "uuid": "b1150992-a20f-45f1-8ef6-dea141ce477a", "comment": "Malware payload", "value": "67f1e54dd81e9c126975c8356d524a97", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443363, "uuid": "4ce7ba12-3380-42b9-bc5c-7ba8435a9817", "comment": "Malware payload", "value": "032d16df59c9a45e044e348443a18d830b9f895329587559f1316536733ae277", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443363, "uuid": "a2af3bb7-808d-4372-99ab-fba8b8934eed", "comment": "Malware payload", "value": "c3402eab0b72b805070d7b3e403da2db2a6c6344", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443363, "uuid": "a827405d-8d15-4980-b650-1ac4c9118704", "comment": "Malware payload", "value": "b1d7b13502a9eb3e00ccd4be0ffd40f3f989e5b5de10f2c378227818302ce8b5a54316de6f80f0570f2f83881f400189", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443363, "uuid": "005a3d5c-c32b-4d32-ace3-067ebb46b1ed", "value": "E3F3128EB16150FCCF11603156529DF11E16703ABA82FD8F1ED12F8666221E733AD79B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443363, "uuid": "81b75b60-0ddb-4466-88e2-8539d5bb96a2", "value": "3072:BU9VlUBWA6CFvA7bRCxAVIK2xVymd1xXP+Ph9vajtC1gBbZIbG:BU3liWA6FsY2xVyWxf+QegBbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623443363, "uuid": "d01bb13d-2034-42a2-beab-524ee948357d", "value": 158761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623443363, "uuid": "298ff9bd-b9c9-4b9b-8db9-5702b2207c02", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443363, "uuid": "67d4d7cc-9c4c-4a3a-8e93-f295512f7475", "value": "research-1234799369.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6deafd3-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1623423582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423582, "uuid": "b416d09f-eab1-4844-985d-7e5106907254", "comment": "Malware payload (Dridex)", "value": "0b0971cef6caee1478db0b4fbd7b8d97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423582, "uuid": "ae97cc8d-f716-4943-8403-671c992065b1", "comment": "Malware payload (Dridex)", "value": "03dee85a5b2bd3421d93188a9acd8ebef097c0d8d2f36e49180ca3cb0823726b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423582, "uuid": "1a9cf85a-960a-47d8-b8c9-d1680215db75", "comment": "Malware payload (Dridex)", "value": "2320b0bd708baf3a2035b452b009457bcce7906c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423582, "uuid": "123cea36-dd0e-49f5-ae94-27d66baa7c79", "comment": "Malware payload (Dridex)", "value": "da3c06ac44e0bce7e1ff76dd908ca7f4469fbd6e2151af5c4b8588ed64255195ddb4a95fcbeca9bf227ba948e650c65d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423582, "uuid": "07e32b69-04ee-4ab5-b3d7-f0180f5d07e6", "value": "DF04E153C6DE045DE397C034AADAB06BE396BF711E2CC848F5E9C15A82B2D434B72E51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423582, "uuid": "37f4f26f-8274-470c-acc6-d1c0a6abc167", "value": "5594ced7851e7059f91664ceabe2c1e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423582, "uuid": "67f8912b-e5d5-4161-a4cf-7290ea1c5c97", "value": "3072:KjaI6YY/DDdmhdj+O2WYXwU3qstRty89ksDKqOim1Gz4:KjazYY/HO1kPdy8ksDF1mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423582, "uuid": "fd90eede-fe07-4098-a027-aa92679d91d1", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423582, "uuid": "762499b8-29a2-456a-a05f-1b21cbfef256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423582, "uuid": "85638039-e2f9-4f60-a7a1-04205187504a", "value": "0b0971cef6caee1478db0b4fbd7b8d97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984ce20f-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423557, "uuid": "5efc0828-7da7-4397-a656-7825770c3272", "comment": "Malware payload", "value": "35f1c5a1f891e055900bc8a37c56e6d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423557, "uuid": "4427d803-9955-4779-b7a0-88bdebf4d345", "comment": "Malware payload", "value": "03f54224d342f4f5062aa9d8612fdd7e0eab99665d5c8d35f5ab63b7842b7be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423557, "uuid": "a6ccd3b3-26e8-4472-acb0-ebee261b21ab", "comment": "Malware payload", "value": "e7f721864782e9a80c737cba2a860fbe3f8e4f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423557, "uuid": "d9a7b30f-71f1-45ce-be81-a9a95901fd3d", "comment": "Malware payload", "value": "484a931f0cae855afbb26ed03b8a1db241167e63b98f2c103130a546da004b9e2d354c56bf527c5b7983a1aa9525fd83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423557, "uuid": "2d6d63d2-40e1-47f0-969c-bdee76500521", "value": "7292E1DB89618B8EF2C87B3CD8FF90B253485358C4C25D1E5B71AD97652E9090AE0F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423557, "uuid": "21be5045-9f2b-4a0e-90b6-3e9424f2f8d4", "value": "384:PN4dW7ktV3PAu77UuwjsluodQLlpC+yTQbL9UkOc:14YMVdnHEodQW+z9xOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423557, "uuid": "0bfd38e2-9ab2-4027-a5b4-40c6c26ed6ea", "value": 20680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423557, "uuid": "ddede138-cdff-4355-8d63-9345aac4f49e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423557, "uuid": "7e67cf20-2756-44e0-bd0d-2a791d1d4eb4", "value": "35f1c5a1f891e055900bc8a37c56e6d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188eb409-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623394137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "8e4d3486-33a5-4f1e-8fd0-b21af1a94db6", "comment": "Malware payload (CryptBot)", "value": "5438e5a929acf4db79e7a2ede1a65492", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "78b28e1b-abd1-4c63-bd6b-cb08a1a4e612", "comment": "Malware payload (CryptBot)", "value": "043908bc37b7a2e5266e63ebd1bea830815e5c4c8c75f07e498806ace0cb61a4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "20367c2a-6f69-4e53-899f-0d2ba8291b95", "comment": "Malware payload (CryptBot)", "value": "0b67d0ab9de823f1017324f1aa03fc5d4428810b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "3b734b03-f540-4ab1-930c-5f5bfd5cb04f", "comment": "Malware payload (CryptBot)", "value": "ba9813ca9d6e2c5a8607341903b3fd9e494a23b9b5b8bb60cdf31f71f31c0362a5f3c1a690bf2d5e121936a57ecbf8ae", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "e18e289d-c9aa-4ae4-9510-c7844389ac8e", "value": "E4F4E000B7A1C039F2F316B149B95269992EBEB16B2491CF53D41BFE9B746E0AC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "d51de56a-3fa6-4c9b-a0f3-f6678e4eea2b", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "19ddec2d-7b65-4b1f-a0f7-cd74238af85b", "value": "12288:6Alyt5+BcAYrA4pH7DdJJm6cx+tH9WAfrnAl6rjUDh4WW69ZM4lV916nNm77AgNx:6AAtxMEH7hs83nT3jUDGY9s077JN6du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394137, "uuid": "cb6dc8fb-8436-4d1d-823b-87cbc4e1dd3f", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394137, "uuid": "69af6c18-e019-457e-96cc-915c83278fb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "2cc0a857-67cb-430f-9993-a7d53ec61b7e", "value": "5438e5a929acf4db79e7a2ede1a65492.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3532397-ca9b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623405671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405671, "uuid": "2da55222-9321-4331-82c3-1b242dc42a38", "comment": "Malware payload", "value": "3e6e9f2eee4b13526741b9defdb03091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405671, "uuid": "2ce094bd-4d1f-4760-b75a-34ef7ff50761", "comment": "Malware payload", "value": "0557e333f1847ac02b825363cb78ea97cf53f3a0cae253830572c89c8dec01ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405671, "uuid": "72c59133-5f73-43df-a32f-048532385147", "comment": "Malware payload", "value": "0af2b11105f03a9ac63caf33784b91a2e17cea30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405671, "uuid": "e79f322c-c9c2-4972-8fd3-affb006b1864", "comment": "Malware payload", "value": "810acca7bdfd1c817230e3265dec7f3e012ecc90ed5144b976df4d12e743a7b4599b4cd6b02e0b04ebace822157ebcb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405671, "uuid": "712f0914-682c-423c-bd01-e0fa2ab47c8e", "value": "9975E01373DEC3A4C7729233BA5AB755AE7B7C2506A1F59B2FC4093CE920122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405671, "uuid": "22dc9718-935e-41aa-ab22-3dc784984ab9", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405671, "uuid": "c1ffc2fc-1dbe-45b4-819a-4e645c56f082", "value": "24576:34lavt0LkLL9IMixoEgeaJOWYMmL9fXHy9YfrZD5S5z7Wverq9MmCS:Skwkn9IMHeaJOWYM8NaKNQW0aPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405671, "uuid": "5ab2235e-6290-4a01-b779-2d2fd442da62", "value": 1576448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405671, "uuid": "cab6a6c1-fa3d-4650-a33f-1d87a78f2458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405671, "uuid": "ced992e0-c820-44e4-9914-7a6c732a2156", "value": "pay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8dd61c-caa0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623407651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407651, "uuid": "aa04eb7c-2393-4f5c-afb2-fb89ae4f13c3", "comment": "Malware payload (AgentTesla)", "value": "840880750b20f76b946071cdb03acb04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407651, "uuid": "98a0ff1d-2e57-4d21-bf71-ac69a8e4672b", "comment": "Malware payload (AgentTesla)", "value": "05791cd943319c72fc571ddd042d9c15545816977141d95d1ede6e4f7576c213", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407651, "uuid": "4f690d74-94ee-40fb-9512-91f76e2f1880", "comment": "Malware payload (AgentTesla)", "value": "f34240bbc4cd3f2b50aeab05967404d5eff1518c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407651, "uuid": "091e7259-9987-4d4a-a948-cf4fef1fb4a4", "comment": "Malware payload (AgentTesla)", "value": "82acea581ab9f0ba861e568d99a0f9b6ba8f245655c3419de9877eb8d55bc383540942c53b063384bff0f3dd9aeb9f5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407651, "uuid": "6634e173-53cb-4a1e-878d-47ca2f78a5e9", "value": "D0B4D0003BF94B05E4776BF969B8B09A5BBABA236521D24C4DC671CF0932F409E51F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407651, "uuid": "e5071397-e844-4bcb-9ba7-086e189a0152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407651, "uuid": "0016c4b8-55f4-4283-af47-2289482e5ec6", "value": "6144:3BU/xITe0C1y7cGUfEnYKvQbsuZCCOb5jxfVFFFH9+DAFHUYExIR/1KaJA1:36/X9ocCj+OVjxvFb+DhYqIR1fJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623407651, "uuid": "90938c6a-f926-43ed-8a3e-cae76c4d85d2", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623407651, "uuid": "c137e000-17a2-413c-b91e-12ff3e62486f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407651, "uuid": "fdf0c4fa-4a50-4f79-ba87-39a8085c8f36", "value": "\u041f\u043e\u0442\u0432\u0440\u0434\u0430 \u0441\u043f\u043e\u0440\u0430\u0437\u0443\u043c\u0430 \u0437\u0430 \u043f\u043e\u0442\u043f\u0438\u0441\u0438\u0432\u0430\u045a\u0435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639f74e7-ca7d-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1623392545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392545, "uuid": "03df4d83-1b48-4aff-80a7-dcadf0d0501c", "comment": "Malware payload (CoinMiner)", "value": "75feb6ec8f3d9384a9deb3c93fa82f27", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392545, "uuid": "6c765c61-d04b-420a-a148-50f9c10e562c", "comment": "Malware payload (CoinMiner)", "value": "075346be97ddeb27face2c0ebb99da807fb0c03379d3c39c9e3632501f6b19b0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392545, "uuid": "429bb991-68ac-4862-b32e-3e3c5d4efa93", "comment": "Malware payload (CoinMiner)", "value": "ba3e132f4969aa558b8af94d5af0021c4fae9da2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392545, "uuid": "c17d3dd0-5441-4a70-ba53-c121b831e45c", "comment": "Malware payload (CoinMiner)", "value": "2bcefa3c63bb2f0e62793d7a8b052ad0ad0baf0bd3336ef5fcbdbe56d494d8b35116aa2d1284b320e0dfb94024e4a495", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392545, "uuid": "3fbbe79d-e89e-40e3-a263-f8553b770333", "value": "46C58D122D259AA1D35C44F7DACB4818B878ED35C2AD16EFB5C3B91CEB3211394DB2E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392545, "uuid": "8a8d86a0-ef77-42a4-ac7b-4de7d2770ebb", "value": "bda3e9046a93c2f6d4cd649ff5a152c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392545, "uuid": "a0adbbbb-335c-4e47-9637-a3e5771707df", "value": "49152:BxythqT0dpFEjZFgwa0aTuyDAkD4qfFqlYCd6/0ihTFjKiq2:CXqToFKAhHcCqJ47hTBKiq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392545, "uuid": "592a55d6-5694-4bb0-8e24-380e9f2f8325", "value": 2557639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392545, "uuid": "ec833b66-9cdc-4012-b27f-d325f2f99c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392545, "uuid": "21b9dfd4-dfd7-44c3-b921-0af17a884770", "value": "75feb6ec8f3d9384a9deb3c93fa82f27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339dcc45-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427254, "uuid": "59060ae9-30c7-43cb-9300-f545180cf9b2", "comment": "Malware payload", "value": "628a2e19030e215b3e7cbad4b1ead96b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427254, "uuid": "5f11f1ab-ee2a-47d5-a2ec-d9e3088e2850", "comment": "Malware payload", "value": "0781b74e772903bb1e0c776c00d4980afa06a955844630eaaea9b5ec12c9c585", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427254, "uuid": "466c2b86-f9f8-4429-a2a8-2e5d75cb464a", "comment": "Malware payload", "value": "43559b025f8d58d259d6be22dd7914e575658649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427254, "uuid": "cc2c7350-773d-4ac3-91fc-20b8326d33ee", "comment": "Malware payload", "value": "030067b7ff88bfd961132d5a29cc3f1e29d37ae6548e3f6a781c03a8c2e2508ff7a6a6b90692d6b6e0569f25bcc2fadb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427254, "uuid": "f2a6c12f-9509-44d1-b9ae-97c945c3ab0d", "value": "0F330122ED04E032DE7C4D739FEA3693641758F49D3761A8AB0B05E98792F85877D203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427254, "uuid": "ce47179c-438b-43e4-8a54-a2069b2458fe", "value": "768:0yaZ4sErFpsO0IYncWlnCOPz+ejt3pt7WYbnmQcphq3U7vEV7K4pdDXoT2:0yaZLfdzVdPzjjt3pfbnjcDvApVoT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427254, "uuid": "4d9fe87b-0862-4287-ae7a-5ce8a71d6017", "value": 50172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427254, "uuid": "8b5ccdc1-3dfe-4f0d-bf05-76da45516db0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427254, "uuid": "f129223b-4d16-4475-ab13-db7d7f67c048", "value": "628a2e19030e215b3e7cbad4b1ead96b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d946be-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397106, "uuid": "be6fc33f-4e94-4d49-b3ff-a32ef0069597", "comment": "Malware payload (Gafgyt)", "value": "d893bb53f28ca035b1c2e57d34500298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397106, "uuid": "2055ccdc-9c93-4670-8479-0a7eb7681e44", "comment": "Malware payload (Gafgyt)", "value": "08ad8b82e31820168bbf7f0132968910c4c4b20778cab58f9e65d38d20bed904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397106, "uuid": "fcda6614-bf33-4945-b460-04b691e760dd", "comment": "Malware payload (Gafgyt)", "value": "9e4d0c5722f8ab552238f3d64c7e0de23687bf11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397106, "uuid": "8fafe95c-dc03-4a9d-a1a1-86fc6e5fcedd", "comment": "Malware payload (Gafgyt)", "value": "015f63da351a632935ba499cf6cfe504edd921b87f3dc49f0258455dd396c650bcda63452a0bbe67c6255b25a26e1b05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397106, "uuid": "de819f86-c106-4213-92bc-43978b04c53c", "value": "D8D3D71B7B608EB3D81FDD37069A460120CDE55A12E97B6BB6B4C95CE74B84F08E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397106, "uuid": "95fba35d-5efb-420a-9c5e-c63a2372c176", "value": "3072:rGkpgdTnUWZ045hD5oWF3xemqY1fuBmvm:rGhTUD45hDOWF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397106, "uuid": "03146776-bc4b-4ebc-8878-12ea878eccea", "value": 138108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397106, "uuid": "82ff511c-dec2-4d29-8250-65a5c33dc4d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397106, "uuid": "975b75f0-90f2-4976-8081-838eca0c512a", "value": "d893bb53f28ca035b1c2e57d34500298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac6f1bd-ca86-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623396396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396396, "uuid": "002d4413-49ee-49a6-98b5-af61fc1e1ffc", "comment": "Malware payload (DanaBot)", "value": "c7fd225c74c98215f0105ed20c8adee8", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396396, "uuid": "e5fd1b14-799c-4e3e-9840-f692fd0c5fd9", "comment": "Malware payload (DanaBot)", "value": "08bb07f4182f8cc6c6460af9f9e268e0fb6323a2227388c42d06d801201f767d", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396396, "uuid": "34e9c9ff-a5ba-4261-b76f-de189c190e1c", "comment": "Malware payload (DanaBot)", "value": "8c9a8ee7173125db25a35a04451d186db98d5cb9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396396, "uuid": "9d6fced5-12ed-4d19-b890-3771c80ad4d6", "comment": "Malware payload (DanaBot)", "value": "88f2ab4d1398da3f1cbacafeaea4dfe3234c094318a9390334b3e572eb9ca6ebdd74abf195fa54cd965949a1484acb13", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396396, "uuid": "0acb4f24-295f-4ebc-835e-26838bdf14d1", "value": "765633206691C038F2F717B4CAB59239941EFE616B6890CF52E71BEB5634BE0AD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396396, "uuid": "ae26803c-fd69-43d3-961b-8d62e865a9b7", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396396, "uuid": "60f423b8-dc8a-4375-8961-ceba1dea6300", "value": "196608:bjqC90Sufmd25QXmkQ6T+DVpYaDcPCdTRxer:bjqC90Sj2kQjcPCNer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623396396, "uuid": "1d92ce8c-e765-42d7-a336-f386f90c055d", "value": 6347776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623396396, "uuid": "f59a6bcc-17d6-4ba3-9d9b-6502c5901b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396396, "uuid": "94d595e5-8a5c-40d1-a73d-7562ebaa7876", "value": "c7fd225c74c98215f0105ed20c8adee8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f351bba3-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394504, "uuid": "67647b26-d063-4e61-ab76-9c4f6c362807", "comment": "Malware payload (Gafgyt)", "value": "dd9046efe231d71d004babf18b0f6949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394504, "uuid": "90fb41ae-190f-4deb-8dbd-99c47e79d206", "comment": "Malware payload (Gafgyt)", "value": "0943d3dbe1fdeffe1db68fd1b5bcf417b83d87d9e98e37a3c4a1ae352dca2428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394504, "uuid": "83bd55f4-83ce-4101-8c73-7dd612be84d6", "comment": "Malware payload (Gafgyt)", "value": "d1882b0309b3bc9da0f4209e17cf1c288b7d6ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394504, "uuid": "c5908a1b-9eb2-4c78-8cd9-fa119597c740", "comment": "Malware payload (Gafgyt)", "value": "59822cc5ec2700d2167be9003a2dbe5896d02159e1e68bc0895cccfd4340e77215c7848b1d25b8605176331c63d046ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394504, "uuid": "3305e750-b767-406d-9216-da1c645b46c3", "value": "3A930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394504, "uuid": "e6ef3498-d5c5-4950-9fc8-c96501040f55", "value": "1536:LBkF9VQPAGZHYyEfgcqpq1innPTxHOxsePczYrmREqQ4b/X7XSee:OQFHYBv1WTdePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394504, "uuid": "933c5544-154e-4923-8581-5f62d02bebf5", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394504, "uuid": "2514d459-85de-4876-bf27-639008139619", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394504, "uuid": "77857b39-aa3d-4e0c-8b1b-d90c7604957a", "value": "dd9046efe231d71d004babf18b0f6949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783fe345-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623394298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394298, "uuid": "c8e0dba4-7f30-44e7-abeb-8b582a5d8a32", "comment": "Malware payload (Formbook)", "value": "116e736ba00fca4b8499c4df00796454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394298, "uuid": "194386a6-7f80-43a4-b3e1-44121d53fd27", "comment": "Malware payload (Formbook)", "value": "096ca35528ef4f702e93f5f17d7954f26fb48acd4526794ce1ee99d27cf1a4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394298, "uuid": "e5d36fd9-33ba-43a2-8b48-5184ac5930f5", "comment": "Malware payload (Formbook)", "value": "a8d3d62db4bd49e24c2bda3d0d81c3be25a81dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394298, "uuid": "dbd14235-ba1e-4e69-8b20-33cbb26cdc57", "comment": "Malware payload (Formbook)", "value": "6702aa8566267c7f1bd4a15f00e3a3c9f8c4abaed78c9f5bac72acc2d3a0a2314ea4d675f8b24d11e2cee70070a849d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394298, "uuid": "ef64ef4e-c7cf-429a-b97c-d208de2e3226", "value": "C824124F61C1D523E9B29FB01D67CB7EDBB49A900982919F5F60CFEFAA0209352152C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394298, "uuid": "a4e91367-a687-4add-b29d-0578afbe5d97", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394298, "uuid": "b7507a17-8b0f-460d-8f06-835d358f1825", "value": "3072:DQIURTXJ+MwMy2ZeD0EUquupJDoeGgFq+HAgDtI7LXZ2sQYvvlIieO82WbyXVvE4:Ds9wMReDph9AOI7LXosQQBBFsuyQUvnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394298, "uuid": "9fd427df-1ca4-4ecd-9a54-a7ad2dbcdb85", "value": 225177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394298, "uuid": "292cdd9d-ec5b-497c-8ee0-9e12a5b7b6f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394298, "uuid": "86b653b4-3773-41a3-807d-aa21b1949dae", "value": "116e736ba00fca4b8499c4df00796454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c0059a-ca7a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623391156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391156, "uuid": "375825e5-26ab-4475-b33f-7d2c1095a2d7", "comment": "Malware payload (AgentTesla)", "value": "14f4f4356a708f1e9e18c6c71ef3153e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391156, "uuid": "2fff2594-392c-46ba-9d83-704c776b5418", "comment": "Malware payload (AgentTesla)", "value": "0a27c51c891f44c26d8db8848822880a8209830faf2d8c00e8729151ae76be4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391156, "uuid": "3926258f-f049-450a-9a97-5e5cb9ce986a", "comment": "Malware payload (AgentTesla)", "value": "a04edf6cb2d97539a509d17411a5884f75d5e5cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391156, "uuid": "1ed7b24e-8ef4-403e-bdda-8cad1660f16f", "comment": "Malware payload (AgentTesla)", "value": "d858cb55603ed587a78bc765a39a4796e0d799d2aa3b7c24018045e75237ff3dc587d5518e8e7a17e6758fcd66ebeb82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391156, "uuid": "f9dd47a3-f0bd-47d7-932d-1cebb4b4d53a", "value": "68157AF1A5E143C3C39EDDF183CAB3848B6F5AA235728212A55C22FC67DD18925CE54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391156, "uuid": "57617e6f-83a1-4373-abe6-2a33573a5cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391156, "uuid": "80219a4c-c061-420b-a6df-697fe57add03", "value": "12288:wM441/0V9+4tKB7rmCmOcF4my0uJC0b/YvNaOpkXT1KoUflLJ0pZM4e/ZUdtb:D2V9+BfmCcy0CKNaZ1KoUfl2NeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391156, "uuid": "8475762f-0669-411c-b241-4c957ebb61c8", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391156, "uuid": "bf0786a4-e8a9-4976-8ae4-8f06e538ae19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391156, "uuid": "dc38fd93-313b-4dbf-8442-8625ace03fe7", "value": "HALKBANK_EKSTRE_20210611_080203_744623,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4425e2cf-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427282, "uuid": "c6422d1c-0cad-4bba-9673-f233453acc10", "comment": "Malware payload (Mirai)", "value": "6414b4d96f44e139c651b13d7b31fbb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427282, "uuid": "acb83a37-56c4-49e9-a5a8-86ed650e8292", "comment": "Malware payload (Mirai)", "value": "0a588b860c23b4a4d583ac6bf71cf5399e7e4f3eecd23aae675ce2ebe183a6e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427282, "uuid": "f113d442-abd7-4eb8-a4aa-6a5eaee0fec0", "comment": "Malware payload (Mirai)", "value": "4a0830e34efd19823f1e932946ef33fadf388935", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427282, "uuid": "7608e718-ed14-4a2e-8fd3-bde6675a359e", "comment": "Malware payload (Mirai)", "value": "f5b29aa516b7cbb472bcf3efc2781971f1657f84ba3229c27077a772b4c89ce637227bfaafd5c791d2753406c61256fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427282, "uuid": "0f20f8f7-a45f-49d8-bbce-73115386a809", "value": "7E13E161B59FCDA0EA402C39A59D02C79A932F98B0B66432401977D86DD98171BECBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427282, "uuid": "b673b62f-e11a-4055-90c7-6e08726e5b6f", "value": "768:oyrt6KHE7dQfW2jeBDyPCg9q3UELTXvMXb4ZEFFi1D9twgRD:pp6KHE7dt23CpLzkXEZEFFYfRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427282, "uuid": "f5352e9b-4320-454c-8f99-d25c125633e6", "value": 44060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427282, "uuid": "4a9d8aba-c0d7-40c4-acac-2d216d2a9647", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427282, "uuid": "dc069534-f810-43bd-93e6-8eca9ffb864a", "value": "6414b4d96f44e139c651b13d7b31fbb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cac2d4-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623426986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426986, "uuid": "0cec4411-b3ba-4ce3-96b6-667740f804c1", "comment": "Malware payload (RedLineStealer)", "value": "def5998c747840bbf1bc4600017648b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426986, "uuid": "1c5c5b3c-060a-4774-89a4-ab5c25016e86", "comment": "Malware payload (RedLineStealer)", "value": "0a665eb90149e584cfa776254593e98a90cb4ea54d4943ad8db9a783e795a6dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426986, "uuid": "6be3969f-fb44-434a-a039-b481a760ec06", "comment": "Malware payload (RedLineStealer)", "value": "eeaaf9a8af161ec3b64e46b39cced11735e52b90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426986, "uuid": "01e8ffc9-a43d-49b7-ab2a-6e8522ee21a3", "comment": "Malware payload (RedLineStealer)", "value": "db8c2c17fb71eb5ecefc212d7638b9a350d415fbadab83bb92aa065bcbde7cc7158796d7b3a44cadd8242296bab46366", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426986, "uuid": "db5d4630-5ad7-4867-acf6-29519a330b33", "value": "D0248D2AB2964A01C7145532C5E3212047BF9AD2636BFF0F378A12D58E437DEF905B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426986, "uuid": "c1d6eb1b-4974-4160-a6be-82fde70aac42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426986, "uuid": "35d26940-9542-4a0d-a8fc-6c2c3f5be26b", "value": "3072:b5GoXv4iUc7qzkaIcbpo8wP3Ds/z42tcPgXvkQkjt4mbMcfNSJOfLr:b5HXgiU2qAio1Q/zrZXv4jQn+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426986, "uuid": "c8b06190-d5b6-4b32-9a68-e0982dbabd0c", "value": 219520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426986, "uuid": "5a5e8c88-1b13-4058-aead-23d9d2f30924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426986, "uuid": "6c14647f-7e42-403e-a93a-477f592a848a", "value": "def5998c747840bbf1bc4600017648b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af9c405-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394141, "uuid": "7f114187-f333-481d-aa90-ccd8c3f8fddc", "comment": "Malware payload (Gafgyt)", "value": "c050a5b1999e7e66a0342662d1963d2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394141, "uuid": "1b042f8b-5c2b-4bf2-81f8-739ea3f150d3", "comment": "Malware payload (Gafgyt)", "value": "0aee6f138b53cfd267af0ac111f93abc0e40f757532ff098563712032915b2fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394141, "uuid": "3d172821-7151-4f0b-8576-67e8387ada89", "comment": "Malware payload (Gafgyt)", "value": "6d56cc8d2bfc486202be008ebeed523bae324f69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394141, "uuid": "a3050d77-ea9b-44c7-a994-a23e58752718", "comment": "Malware payload (Gafgyt)", "value": "c191c1daf9a1bd6bcb3cfc1feb5167a85502173b16506037d9509a948c48f71dc98c14ac3d1f882beb98bf77d41a24c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394141, "uuid": "207c6939-18f6-4a97-9df7-9c58dd1659ef", "value": "E1930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394141, "uuid": "790e3a3e-8cfd-44ef-96ef-b41ab4142799", "value": "1536:4mZVaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gX62f7vTmQ9VqXjewf2Le:vYp09W6KTG/IB6Yy36KNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394141, "uuid": "026b6b04-5e24-4620-a3e5-47b1eb585949", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394141, "uuid": "eb9b8213-61c4-40dc-a65f-51e78369034a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394141, "uuid": "6e986ec3-79f2-43bb-895a-3830cc7db762", "value": "c050a5b1999e7e66a0342662d1963d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b67783-ca80-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623393924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393924, "uuid": "f6a2c800-26f9-41bc-994f-5875c94d5b7d", "comment": "Malware payload (Gafgyt)", "value": "d337dbb611f14cad704041d2778fc16d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393924, "uuid": "d10b877a-0f1f-401b-a63c-a22873a929d9", "comment": "Malware payload (Gafgyt)", "value": "0d525d66586c66a5514b75a038e383b18363d3fe9213a68cdff1fcbd42d250ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393924, "uuid": "0e814139-b519-48d4-8598-82279a805d51", "comment": "Malware payload (Gafgyt)", "value": "f29bcd2b383a0a5a7e01893ab687c22962a02b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393924, "uuid": "2614b568-eb49-451d-80d9-3028ce0ce061", "comment": "Malware payload (Gafgyt)", "value": "92e417934784d484b227bb95028d9555b31c55517fea0b4c98766c88febc2e08c3edc45c182057f297f6bfb47825adfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393924, "uuid": "ddb77039-688e-4747-baa5-4fff24b24a2c", "value": "E8931A41F9408B27C2D227BBE78F439D37366A54A7D7330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393924, "uuid": "26531122-7f52-422a-8180-7ff6d32a1826", "value": "1536:EIkg9VQPAWlMTEb82Mm3xDKMsF0rOLcv5NPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQBMTDWWFG5NPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393924, "uuid": "c9239344-bff0-4023-b24a-39b5b55e78de", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393924, "uuid": "76eda271-3c1d-4f95-89eb-666bdc99e6d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393924, "uuid": "82dbfeb7-e2f6-4f32-8bc4-86f4d57e1c3c", "value": "d337dbb611f14cad704041d2778fc16d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0a8de4-ca79-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623390972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390972, "uuid": "65933e4e-d01c-4904-bf05-47006e72c3de", "comment": "Malware payload (AsyncRAT)", "value": "5097ae181f4530ddfecaeab1d6ee9742", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390972, "uuid": "45221d13-6dec-4c6b-a8b7-9661ef38770b", "comment": "Malware payload (AsyncRAT)", "value": "0e1ba794a28936e6037545d7b1082f9c3a45ad0ce048bc1f771d2b4eb705cbd9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390972, "uuid": "69f3977a-816e-4784-ad39-54fdeb7d450e", "comment": "Malware payload (AsyncRAT)", "value": "7af92336657fd14dae65387961b32c3bb7c66d0d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390972, "uuid": "48942452-b378-4117-b296-091361b5d9bf", "comment": "Malware payload (AsyncRAT)", "value": "4f42e1e74ba0171c7f9493b225777f53dec33fa60eaa089058391fa178c2d7505405637104b632f4c6d9e2feea6d09fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390972, "uuid": "1f092d9f-5b73-482f-8ebc-5d16b2bbe9f0", "value": "FDD023569A00CC055306426E400D1C4D854A5129E3AC89987B35CB2D5E1E050CEFF5CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390972, "uuid": "85663729-586c-4e94-b431-5239e0e0d088", "value": "3:QsnWwXEPI2GYoLQVFY3HIsov4dSHsBIQHwMP1G2NNyL/OAT+I3R0VRYKTOKbM:QigPI2V4QA3Isov4dh+eG2fYGk0/3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390972, "uuid": "855d2dd2-dc2b-4eaf-9045-70bd8c9bbcce", "value": 211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390972, "uuid": "095e6a9e-0986-4dcc-8706-7cb6f3049dc3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390972, "uuid": "18b5f7dc-6582-4097-9a3a-e2c6cb3ee289", "value": "eStatement-ID21439068472435.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd04327-ca5c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623378607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378607, "uuid": "83906e06-624d-47dc-91c6-3ecae10fcf3d", "comment": "Malware payload (CryptBot)", "value": "4e99138abad19c9cba519e39083831c5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378607, "uuid": "e9ef56f0-8b0c-428a-be40-b84ed6399a08", "comment": "Malware payload (CryptBot)", "value": "0e568f8920a068d8300b2ef9096c8394cfa77b6002be1692ad3a6fead7e3eb1f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378607, "uuid": "ff291ec6-3c9d-4c6c-8f8f-4613197f1973", "comment": "Malware payload (CryptBot)", "value": "2970b1d625f2e4ea946b70f9b6d6e26021f9bfbb", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378607, "uuid": "07ed30a2-9fb4-41db-9f7b-a7189fab64c7", "comment": "Malware payload (CryptBot)", "value": "115cdb87567958c48ef9a3ccb2a657045f4ae0c91e7ccc232bc7954a05d910138bc49effda13636a2912c3f7f83200ee", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378607, "uuid": "92ee5036-ba5c-4103-a87f-d532b349cb0a", "value": "BE848E10BBA1C039F2F322F48EB592B9552A7EE16B2490CF52D52BED57756E0AC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378607, "uuid": "36db6deb-8110-4efd-9d08-252330f52e08", "value": "59b984cbbff57adffa13e215b34ee50b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378607, "uuid": "0220176e-bd24-43ef-9e5a-d38532070877", "value": "6144:V52UF0fONhqdOEREwEZcOseglbiRJ4YfwxRRvexW+opFtjUuS3:X2UF0ONhsxEZlsegoRJ4mcR+F8tjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623378607, "uuid": "3ba39a33-feb2-4aa6-ba72-fa441273e0dc", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623378607, "uuid": "d8a1b2dd-994d-4f87-8e92-a60337a12725", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378607, "uuid": "3259fec3-8db8-4bf8-a085-f0eb6fb95d33", "value": "0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f94e431-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623397209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397209, "uuid": "f010077c-97cc-4ae2-b829-2d98839b3ec8", "comment": "Malware payload (Loki)", "value": "9c3bb1a32e314af1dd8b17cea7a89946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397209, "uuid": "660442f8-a09e-49d2-b2b3-66c230fa78e0", "comment": "Malware payload (Loki)", "value": "0edd52e3a9ccf4fb316dacf8c22508439e2c90bf32a3d569d1247a9100027cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397209, "uuid": "bcfbc25d-44c4-4d3c-8725-1a7137638357", "comment": "Malware payload (Loki)", "value": "18ff20364809845ff83de94bfa465b8abaa136a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397209, "uuid": "04076ffc-193f-46df-aa84-bf1f7bd42deb", "comment": "Malware payload (Loki)", "value": "2ca03f0b0e6a230b8b3fd0f58da9d546535e64504947339c7c810ed41e7414d17da88fafcc3c826f60b389d50e8b36db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397209, "uuid": "f3d4482c-0884-44dc-8c7e-e658b38fed95", "value": "3B0568F565A007C3D79EDDF283CAB3848B6F86A231758212A94C22FC36DD29D25CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397209, "uuid": "a293b4b4-6671-41ea-b296-eaeeba70f59b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397209, "uuid": "973fb963-bf52-4015-a554-579dad346868", "value": "12288:QjClrPtBk1eN3TPyr9pwfV95T9iw78Ox1jlqZ8P+k7VnqcCZM4e/ZUdtb:AaZS1eYryV95T0YpEZ8PjRGNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397209, "uuid": "44a24e99-ec89-45b1-8e7b-6a63101180a1", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397209, "uuid": "e2ceaa35-50e4-4b17-bce0-0f1cb1597bf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397209, "uuid": "84de838d-58ee-41c8-b133-6b559d342abf", "value": "Detalles del pago.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3648e815-cafa-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1623446156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623446156, "uuid": "0f83a6a8-7d93-4345-be75-b05a4b811617", "comment": "Malware payload (Pony)", "value": "1b0803611d7f441a5a4eeda64fb05ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623446156, "uuid": "fc8afa23-29fe-4d46-8c48-35ea1fc602a8", "comment": "Malware payload (Pony)", "value": "10718fa900718988ee7184286ac5b75520fc90c5da245ca0bd8c13b3bcaa1120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623446156, "uuid": "bc5a0cdc-7bd8-471d-929d-cd77c9ae3dc9", "comment": "Malware payload (Pony)", "value": "2f891213d454023418020892aca8a378e3f9ef9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623446156, "uuid": "0b9a9a8f-404d-45a2-8d33-d883de7ba309", "comment": "Malware payload (Pony)", "value": "91ba13fb85e7ed5f30844093fb683544a1216a9aeda421b07c35d255c9a24e8219cb27e0c0ab5c150175eac989557615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623446156, "uuid": "14994d0f-4505-45e8-a351-0452034312fa", "value": "3314020266E09423D6978E714BDAF236EEF6B6D51638026F33108FF82961790661F397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623446156, "uuid": "5fa69a02-1ce3-45dd-a5ab-ed5643801ca1", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623446156, "uuid": "2bbed73c-c108-4207-b9ec-0d4e4bc73bf4", "value": "3072:/voooSX4qZ1YzI0qDN6aAaqlWEWDk6w/5dlmRQM63CgtyTxpOdDLBgDaji+ePkbA:xZX4qwUDNFRqlWEWPw/5dc/6vyFp+DF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623446156, "uuid": "d1fbd1a9-ce1b-42a4-85e7-443ac330409d", "value": 194107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623446156, "uuid": "e6008578-4ec6-40a3-8a0d-12dcd6fb6f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623446156, "uuid": "d2e117a3-617f-4f30-9de0-265587a40b88", "value": "10718FA900718988EE7184286AC5B75520FC90C5DA245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d410d30-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623394118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394118, "uuid": "de396bb1-8f30-4ffc-b56b-122524710862", "comment": "Malware payload (SnakeKeylogger)", "value": "585a1b1be54139961608fbc77c1fb3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394118, "uuid": "11fc2c9e-3000-400f-9b22-a8bba22ba56b", "comment": "Malware payload (SnakeKeylogger)", "value": "109030f50fc7606a5c8aa761d79511c393e5c730607e5bfdce9a761e9b4b9c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394118, "uuid": "b33ade54-e54d-4b35-8acc-98f0e4cc13bd", "comment": "Malware payload (SnakeKeylogger)", "value": "4bc5a94dad643dab04d94d5566d1c3a767778764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394118, "uuid": "3a0ff64d-5df5-4b14-ad31-9b71aa22c9b8", "comment": "Malware payload (SnakeKeylogger)", "value": "f5259969d7492ae93f51214c7b9c9441d16542bfdf889e84d85209184eb9f71e6818701e6048573e8ef49074367ae5fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394118, "uuid": "c95db6ac-a73b-4f4e-965f-01768259f0b9", "value": "A4F4028B3D00F9A1C4A4977A9596E314033F2D903EB1B72DBCA975D336B36427B851AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394118, "uuid": "55443710-3418-426f-b0f0-9730fd6b9cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394118, "uuid": "9fc94edb-389f-40d4-953b-0271d98d47ca", "value": "12288:vKraMIZThndumgol56TFd9Dvuk4tGG24tWKG1Gu7iTQezjBwwABlU1:vKraHTJdF7WBd97B4YL4tc1Gu7KzuwAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394118, "uuid": "72a1c628-2f68-47ba-9a9c-3b99f6ce57db", "value": 763888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394118, "uuid": "78eec8f1-f925-4d18-858c-9fdd7bc3915b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394118, "uuid": "74ec3b93-d80e-4a74-8d87-2e4d78fa702f", "value": "585a1b1be54139961608fbc77c1fb3b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb622650-ca7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623393659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393659, "uuid": "ff361379-52a8-4329-9eaa-7044d08f6f67", "comment": "Malware payload", "value": "738daab8f14410ad4d68d4b65c89f31e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393659, "uuid": "f3d10c97-a982-49f8-b48e-22553c5e201f", "comment": "Malware payload", "value": "10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393659, "uuid": "b127b927-62a3-446d-9316-1a5de42f0a9a", "comment": "Malware payload", "value": "6ddd3f2b5f38228d8ee87e5afef0b1e567944375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393659, "uuid": "dd2e064e-3fba-4e1c-9415-871b8ae2284c", "comment": "Malware payload", "value": "b5b82bf3d5864397bceba18d02e9f07c26985d2b534fe06d03e23dff02e254937f1c121aec587ccfa0a9185e1967e2c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393659, "uuid": "30cc88b6-2bd1-45a1-b181-8c3b71970962", "value": "3796331AB34DA277D0F30DB8E69A4EA4522BAF29208114DD6025B7F4453278F73C7A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393659, "uuid": "8b225aa3-b009-492d-ba88-ae20b668a2c3", "value": "196608:zQr6SHMTHsGTAUN769pC9xWgsPxurX1Sj/w0B0b:XiMTEUl63sqorFQ/wc0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393659, "uuid": "6dfa9005-1b8a-433c-a605-e5d4333b545d", "value": 9109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393659, "uuid": "0906c5db-a66f-4850-9f12-930c82f3c599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393659, "uuid": "8b87459d-6f1f-4bfc-a468-18111389e43a", "value": "738daab8f14410ad4d68d4b65c89f31e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee90ff2-ca7d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623392725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392725, "uuid": "709cfca3-7a67-43f3-8a98-0fcbcef04889", "comment": "Malware payload (Loki)", "value": "4cc76f5ceb28b0d6e99db75e7f306477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392725, "uuid": "cd1e114d-d552-4760-a7ce-5631f1761e41", "comment": "Malware payload (Loki)", "value": "10d93444870b65fb3b924bddc50f6e37496a86de9692e7d7d088832713adee9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392725, "uuid": "91dde2b0-23eb-4e11-8f95-4a9952118ebe", "comment": "Malware payload (Loki)", "value": "6de598785da0b45dbd6524a454882b77ce8a1c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392725, "uuid": "f930952f-cfa7-4238-9423-54ceea167817", "comment": "Malware payload (Loki)", "value": "7acfb8fdcbf0abf4a9047b16a3fa5682b7a3c743d8f0c808dca4b07f9889668d00544f10b27b9f9cd8c4b248552f2ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392725, "uuid": "eb51cb9d-dbad-4ea8-82e5-14629ab587ca", "value": "8D0558F5A5E107C3D39EEDF187CAB3808B6F5AA231728215E44C22FC26DD28965CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392725, "uuid": "cb7f44da-fafb-41b5-9065-54192b9846f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392725, "uuid": "db044715-786b-489c-9108-64b164236772", "value": "12288:Ps3dsBLHk8SlGPzJiSKGvSUMZpds3WoNxrZzTrOwSVe9sEpmWJN2ZM4e/ZUdtb:PCIE8SUGGz4iHDrZvruVmsd+2NeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392725, "uuid": "dd082b7b-aca1-47eb-a32a-af26d6884f55", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392725, "uuid": "18dcd062-4aad-4fc2-9d96-bed9ff0c4004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392725, "uuid": "a2ddf34b-cc60-4ca2-b21d-accdab7fbdf0", "value": "Detalles del pago.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96ec00f-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423613, "uuid": "a5ad987e-72d6-4a51-b234-523f3a4d41f9", "comment": "Malware payload", "value": "0f9f449301c298487032ee86f878d34e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423613, "uuid": "da4a38c3-4fcf-4aa1-be0b-211a8b2f4e24", "comment": "Malware payload", "value": "11554d31b5d6f6df998e7b3e1e92ba6295f60195b0a377531f370bf2db87dc62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423613, "uuid": "d2f17d5d-25d1-449e-9092-ce02c3eb3f7b", "comment": "Malware payload", "value": "51ad1cfdb725649aac804564ffb17aefc7f88223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423613, "uuid": "8db336d5-5963-4711-8bea-1692cf41da6f", "comment": "Malware payload", "value": "b1002040d2c97d83ded7859a7ae05c52d821091ba264a7ca78e5d3567414da06dd927ab1978967126fcc42698ed1c970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423613, "uuid": "26b90a37-6d2d-4cf2-80be-6dcc2170b03e", "value": "45934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991925A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423613, "uuid": "a12e0623-3171-4a74-8492-95c582528330", "value": "1536:J3k+bhVMXuRGQx7CcHxtOByW65hrajKDxBSn5QyMjvVqQEqn/lJXCPe:xhMQ3Hh5hryKlBSnMjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423613, "uuid": "f39523cb-02e4-4914-99bb-ae0db16ac98e", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423613, "uuid": "e29dd6f7-5ac1-4f06-9248-fdd05608afc8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423613, "uuid": "794a649f-5cc3-49c3-a7e6-db2fbc0f3dfa", "value": "0f9f449301c298487032ee86f878d34e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f6fbdb-ca79-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623390665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390665, "uuid": "5be3d177-2787-4667-b450-15b7bbfbc20b", "comment": "Malware payload (SnakeKeylogger)", "value": "567d3152ce52b2492ade03fb1879cd8b", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390665, "uuid": "7c9ebdf6-62a3-4fd6-b90a-2d7892a797e8", "comment": "Malware payload (SnakeKeylogger)", "value": "11b6828bafc1ad822f64a2fd6d36df2825f91b62a9f8e55b5ef396ae8f36fb2f", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390665, "uuid": "f89d5f72-ffac-4bb7-a3fc-2a81b3ae68db", "comment": "Malware payload (SnakeKeylogger)", "value": "cd20c779794771a84830ea15e94c46c3a44684fc", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390665, "uuid": "8de680df-bdd8-4b81-aee0-7c7c33e0ce6d", "comment": "Malware payload (SnakeKeylogger)", "value": "bb4442bffb2277e4371ef7835371386d08ba19091e2ea190641523a3ba54323b785c5a5f78f629bda52d737901c08bc2", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390665, "uuid": "2f08af4a-dcc5-46e6-94f5-3e42d70c0be8", "value": "19E423E61A7939B0F94045CFC40BD367A2BBB664897E5ED17889A3A015B20C7F54EC3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390665, "uuid": "4715b6ec-66be-4424-af47-9ef8b9a5e766", "value": "12288:wYHdQQ3Jup2ZVxC/98X5Q9vcuMrVKKPwvWJmyEn9OeyWMBcHM2OffVyUe0C:wYH/wpqCV8QquMYJvcmL9gFBDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390665, "uuid": "bfb92c1c-e879-4abc-b17c-a8d7984c601b", "value": 709567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390665, "uuid": "4cc97381-ec8b-409d-867b-4c1dffca3575", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390665, "uuid": "d22b3e2e-60de-4165-885e-d9e39ea41881", "value": "00010200390_0192021.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff11490-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427006, "uuid": "e385ff4c-746d-4649-8d5e-a558441af899", "comment": "Malware payload", "value": "99356fb42fd5b3665f7c39fc57e51a46", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427006, "uuid": "9b873587-48f7-4e24-8a9f-14ecc9ffff90", "comment": "Malware payload", "value": "13aaa00d4b5f135902aab1e0eb2b0a289173a28b54b4a205e0fcc5ba9f7b8b2f", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427006, "uuid": "0319ed58-b81e-4346-b442-1610abf8ebeb", "comment": "Malware payload", "value": "c5b2c3b1b0b505ee2de5ccde1ec42ee50421a6b8", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427006, "uuid": "2d806e33-3f9d-45ed-8a53-104418f62698", "comment": "Malware payload", "value": "82bd2b7292e5244ff25455c8552b8ec4c0acf1aff6afc940c1e0bc5ee571932698a30abec8be42c7ed026b00caca88ef", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427006, "uuid": "688e5250-0b4d-499e-a1df-7d060f903aba", "value": "8031149162D05DB9CDE451BFAE564310B3749F84F0C73293E21877157D1DDBC6C2604A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427006, "uuid": "7fae3ffb-07a3-400c-b712-adea99641bd7", "value": "24:LKGpa7Urz/jlfbXK1G9Vev3gRGD9iMS/NBuKAkKoXhQlxrR+zLLh4:LKGpa7UrLZgR3yNBuKooXhQlxrsLLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427006, "uuid": "57da2c27-7d01-4851-85cf-4151b393a22c", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427006, "uuid": "c081d0c4-b4d2-4051-a984-ec066fff40ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427006, "uuid": "6dbf2678-865d-4d3f-9d74-f9f81e444379", "value": "99356fb42fd5b3665f7c39fc57e51a46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7689f454-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426937, "uuid": "c9a31fb1-b145-4224-909f-921734eea707", "comment": "Malware payload (Mirai)", "value": "26495aa311e8819d637d97b4ce94cb8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426937, "uuid": "262c5939-87ae-46de-b5ed-71c8837dc951", "comment": "Malware payload (Mirai)", "value": "140e887abb12fe9f9ea05509254e692c61926e72ce5900427a017f8dda05407e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426937, "uuid": "b476c958-8633-41db-857d-3062b244041c", "comment": "Malware payload (Mirai)", "value": "ab9c202f1be6f379bdfc8a2dbdc7de85892a588e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426937, "uuid": "4a14bf8b-f34e-49ed-9f7e-bd97ab2890a9", "comment": "Malware payload (Mirai)", "value": "d397b602f05db137ae9a0deaba4916923179761db0a4708d65314cfc5bec0b6aee48c04754849feb1bf4dae085f53056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426937, "uuid": "3f46ace1-3cff-4251-8dc7-2968830c0de6", "value": "9DA2E0A5BE3246B9CDE2F970D445CCA0A6D0FDB219929656CE0694033A2720787EDC9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426937, "uuid": "66372e1a-2e7c-4a29-ab98-53cc57d7b7f9", "value": "384:MqkS+lhSPvMN1yzdYAGwp687bDRhRRl3h0EBnovRXJWEK0yrnV3WiBGtYOudPvNL:izzGzRGgDRh5uunom8IV3Wi9/P8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426937, "uuid": "287cb039-1510-462d-ab7d-d018d81f4a05", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426937, "uuid": "6c2aac0d-d9d4-43f1-ab29-4a0c67b8e811", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426937, "uuid": "6131ecc2-ac85-4c9d-b57d-f4fe9e52db50", "value": "26495aa311e8819d637d97b4ce94cb8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7783f7bd-ca5e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623379264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379264, "uuid": "20a94659-ec3c-4c17-9540-6701ee12d772", "comment": "Malware payload (RedLineStealer)", "value": "96a080077a6319802dd94b15455b47b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379264, "uuid": "54f99fb3-4ce0-4525-9aba-0dd94017257f", "comment": "Malware payload (RedLineStealer)", "value": "1720e03faab70e324d64b586f3ddbdb1a48169dd54d3e477c4a73a7e6d27ce97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379264, "uuid": "5488b977-2daa-42ff-9025-cda0afd596c8", "comment": "Malware payload (RedLineStealer)", "value": "309cc538e4c5f8adabb427d575208187c3b99c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379264, "uuid": "a6fef976-b7d9-4722-b074-483d3c9cff01", "comment": "Malware payload (RedLineStealer)", "value": "c3e1a1d5585723087d710b8462a29842b213a59a5a1f9189b5152ce0a9a94f1fc8fee043d75743eb87d28f94e5af4456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379264, "uuid": "dcd6dd34-4972-4a06-8fde-28163dfe5733", "value": "0CB494143BEE9963C18E073553B38660BFF4D60BBBEAA303585312AA5D453D79C1D88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379264, "uuid": "b48d1614-1b8c-4281-8bca-11a9ed16325a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379264, "uuid": "8edad18a-c621-4bf8-a1cc-9ae648826343", "value": "6144:QHClfacQ4h7KTnSn7tS0NlvEsvvPW0gmXk/BzVggC1u9R/rQEagaRO1Rn4aFidh:Zale8svWDzVg1E//rQEagaLaFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623379264, "uuid": "36303d20-e25f-4f4c-b98a-204fe036ba60", "value": 523408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623379264, "uuid": "5b812100-d24a-4c63-ab48-3f2d3cef9c7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379264, "uuid": "10bd1356-15d9-4a68-928d-a5b3e2f7816c", "value": "1720e03faab70e324d64b586f3ddbdb1a48169dd54d3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e3aeb1-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623394128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394128, "uuid": "f83e0fc7-5148-4c9c-b0bf-66fd09952715", "comment": "Malware payload (Formbook)", "value": "3c88c6ef1a906bc81fc6b5b7fc478e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394128, "uuid": "ac875958-60db-47b2-a378-d1176fd2cd59", "comment": "Malware payload (Formbook)", "value": "1754283e0b6bbbbeb69f165e54e3795d3e34ca14aa7bd8bd3b7dcdd97f7dfca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394128, "uuid": "8adabe18-5102-45e4-8c55-91b0d211b052", "comment": "Malware payload (Formbook)", "value": "1007ea59d9c209f367a1873ae6da2eac5fad81ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394128, "uuid": "f3e088dc-a6f0-4553-a1be-4034f90a0847", "comment": "Malware payload (Formbook)", "value": "2f9a181884c5fb77b1bc497688fa02662aa06418ef06bbaf0c670dbe5b19ef27460bee7841e45d24e960140a3331cbad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394128, "uuid": "f88f0587-7801-4c83-b039-0bb2edf10cae", "value": "E8B422505671EE14EA999FB77B4E1987DA347E03F4802BC83144F50E0AFB79036B646E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394128, "uuid": "dbbfe441-7aa5-4e5c-ac0b-13f88718a4c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394128, "uuid": "f2f1855b-7574-4d6b-aac1-8380d02636c0", "value": "12288:A4tWKG1Gu7iTQezjBwaxITEI3ENCYyuqoTGYA6TJqiU1:A4tc1Gu7KzurgI3FBOAmqb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394128, "uuid": "1b9266de-5c59-4e49-994a-2e5869219fcf", "value": 533488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394128, "uuid": "cfcd3be0-2a42-4a34-9bdf-491f5416fb11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394128, "uuid": "89b119c9-0d6f-472b-b021-9258bf615a3f", "value": "3c88c6ef1a906bc81fc6b5b7fc478e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a584634-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623397361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397361, "uuid": "58b53199-2340-49c2-92ce-9aa8754eb06d", "comment": "Malware payload (RedLineStealer)", "value": "ea64fb745ef58010d1b9d7ac80f221d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397361, "uuid": "62979efb-2e97-4a74-9104-d3729e52548c", "comment": "Malware payload (RedLineStealer)", "value": "191a6c8951aa3bc73634891e7551a229e15fd90ff0deacef8a2f3a8594d53f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397361, "uuid": "4673ee46-d1ae-4a95-8869-69e1c0032793", "comment": "Malware payload (RedLineStealer)", "value": "7be7c6a48ae96c8d7ef692d03c7405dea60f52a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397361, "uuid": "9d967604-08bb-4b0a-8bdd-822a4f864cfb", "comment": "Malware payload (RedLineStealer)", "value": "4fc78663894952fbf964176767e29e0ae48a87b2959e4d4706f75181709dac682f6f09020f121499395a03d07bd8d41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397361, "uuid": "0d16b0b6-ce01-48be-8a69-047c5b07e8f6", "value": "1F044A4473E89AB3D28A5B39E49A1B407734D20BBB47E337446625BA2D433D35CEC897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397361, "uuid": "2379542e-ea5c-4956-8b5a-427e3a122a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397361, "uuid": "1e361050-4535-4a16-a81c-fc090eae0414", "value": "3072:F/KqI49cV1QZ+y+d8hKZVwhpxaVBxAx9u430BG+pV:FCiJ+d8hKb6a/S9EB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397361, "uuid": "be68e8f3-1b5f-4390-b1c6-ed89775fa80c", "value": 182632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397361, "uuid": "0000ed40-9ee6-4ac1-9bbe-acf8b36e9e9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397361, "uuid": "6bb14d48-2812-4abf-9dfc-082aed667331", "value": "ea64fb745ef58010d1b9d7ac80f221d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50be6e3-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623394400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394400, "uuid": "7ebcb87f-dd4e-4f8b-82d1-344b14edd308", "comment": "Malware payload (Formbook)", "value": "8c35ac8d43f7e59105902fa16114144e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394400, "uuid": "3d4009e6-32d9-42de-a61c-2d27f4077860", "comment": "Malware payload (Formbook)", "value": "1a08fc838c4ebab6b986b6010e2074a05c29916cd38096e7f7d26a6455917508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394400, "uuid": "0ff3a8bf-5ce2-491a-a90a-2a98e4cd8afd", "comment": "Malware payload (Formbook)", "value": "c1a0e5de1121e55c22649182c923b41efd4e2848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394400, "uuid": "1bd70ae6-ef75-4f4c-88be-f0b8f58bb848", "comment": "Malware payload (Formbook)", "value": "bac0c4eafcf1ebc860a103361149baa65e67242d315884bdf72b0d48b7e5df2551fb782933a8a4fcfebd6f5a70cade1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394400, "uuid": "21a5eaeb-afb2-4de1-86eb-733d67d85685", "value": "CB2412A632E056F3ED6381B25D779E5DF63BD3112BA16B2BCB100F5B78A11C3250364A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394400, "uuid": "95222e60-ce45-41a0-a01d-c0dfb6d9dfd3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394400, "uuid": "7ee07391-63d4-41dd-93c4-4d84cfac088f", "value": "6144:Ds9p+npLadPGnTF8SnI8ey8uLSJB6+i940vqC7J:yptdenTiSnI8ethi9aaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394400, "uuid": "555ce3e0-9703-43fb-892e-dc7f07d8eb6d", "value": 224710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394400, "uuid": "94dde8f4-813f-481c-a0dc-677a54eb6a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394400, "uuid": "b25d4cc5-aa85-4f6f-9770-1ce56cda4c21", "value": "8c35ac8d43f7e59105902fa16114144e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c24aeb7-ca9c-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623405713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405713, "uuid": "0f77ecce-000a-4a35-9b9d-a07f6c1ab5c7", "comment": "Malware payload (BitRAT)", "value": "94ba4db23d317e413074d25b85d38bee", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405713, "uuid": "e2891a72-9815-4b06-9472-0fac6c1e3497", "comment": "Malware payload (BitRAT)", "value": "1a1a7812131f7c1bb63f441d7e0ad05e8918035b8975ddc3486daeab4f1b9d21", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405713, "uuid": "569061cc-8906-453e-b769-083987240c53", "comment": "Malware payload (BitRAT)", "value": "a0f6b71fbfd355d425ae52959e64a51f66e4a030", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405713, "uuid": "87b0e8ef-d637-4939-830e-2128da75703a", "comment": "Malware payload (BitRAT)", "value": "413e534f3886485fec9dbf75e61658c0181080ac8097be9b4c1b07f2fc68e4250cbf6c2149e0f904aad8c61ff3c8e73b", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405713, "uuid": "07e2a54f-2efe-4ed8-8aeb-8d3a2e928ce7", "value": "5BD5011022408B50D03D87358C239AA04FF1BE1EEFE5CA4E7D9B759F28727B2566E15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405713, "uuid": "cfd447d6-90c8-49d1-8320-6ca1acf74228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405713, "uuid": "9a8ca353-cdaa-4460-95a2-e139830f2b94", "value": "49152:/wBUwsEgwsMe5UeK4OzXIbEwztEl1u3k8P7XioFyI4k/s5HztmKsIF1cBldOAY:IsEgws0eK4OzXLwza3+3FyI4kUt81m11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405713, "uuid": "d08664db-beb7-475e-97d8-5db2028d13f9", "value": 2823168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405713, "uuid": "cd879336-6c1a-4716-b7e7-ea71370fa115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405713, "uuid": "57008e72-f70c-4fa2-98c1-74f6bf25acb9", "value": "M113461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac87a884-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427027, "uuid": "353a399f-f000-43e3-8996-33aa27fe9b58", "comment": "Malware payload", "value": "81f358f88277186c5caf62132c73467f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427027, "uuid": "e5f49ee7-bacd-410b-bfb5-fd382e61a77c", "comment": "Malware payload", "value": "1a62db02343edda916cbbf463d8e07ec2ad4509fd0f15a5f6946d0ec6c332dd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427027, "uuid": "16b91edf-a9c0-42b2-a07c-b95a091bb129", "comment": "Malware payload", "value": "d1ecef3581984cf5ca9f12404542a4b4c7dca663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427027, "uuid": "d1779b78-6588-46dd-8e4c-38d19f01f550", "comment": "Malware payload", "value": "d6a9048787cf8276c9d4bb4a4f856b80f110a7f5e18d38ee5b5d5c69a3f1ebb7481d45acafa23ba6e682caca059adb98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427027, "uuid": "227b23cc-f38f-4e29-ae2f-ae675f28714e", "value": "742102A2A1D4F832D72200F662866F4713258DE5285AFF0B8D510812ED2D1C0D522234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427027, "uuid": "9b4d20d6-0617-47f2-bac7-b1b9e446f30e", "value": "24:Fl4MoJFHxgxk2ZO4l2ZWV9IXdwvMb5WHGu92/4JruQY2rXyNfuR:f4xL5wOewWV9Qwkb50h2/4lHYQXyNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427027, "uuid": "d5aec8de-504f-492e-aa14-3219f390149d", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427027, "uuid": "6cfcc82f-b7a0-4b78-904f-560c13bdad9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427027, "uuid": "d1837f12-4109-47eb-a234-cfd22dd2f945", "value": "81f358f88277186c5caf62132c73467f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36238747-caf5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623444008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444008, "uuid": "763ad434-312a-499e-8d57-9ca4028f481f", "comment": "Malware payload (AgentTesla)", "value": "bbc9e35de9e2839c817ab6776fc6463d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444008, "uuid": "5778fe2e-8075-4639-a108-9c1313297111", "comment": "Malware payload (AgentTesla)", "value": "1b424eac2b05b856247bfd73d7da0782a0366b48ad797e7f55f1f98b6b0980f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444008, "uuid": "b866f0b3-fcbe-409f-a80d-a7aa0e4e8383", "comment": "Malware payload (AgentTesla)", "value": "bc65f4322261fbf23aa9e58d03e18346a5043bf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444008, "uuid": "7d3db852-fd0b-45d6-8cd9-0f7c2f232f0f", "comment": "Malware payload (AgentTesla)", "value": "64f2d920ed4a790f639cf1fbe9004dd007a9222837f0312447c472cba2d3e1d215170def34f3a8e3e2016c45a7775e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444008, "uuid": "e5bbe13e-0713-480a-889c-9f4ad7349cc8", "value": "9235289C766031DFC467DD738AA45CA4EA60347B831BC217A01715ED9A0DA87CF29AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444008, "uuid": "a5654fdc-4d90-43ed-ae59-389fee492579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444008, "uuid": "58324e90-8180-4f9c-8ee6-8ed4a0c87fcc", "value": "24576:vIYC0jw6k2HQNJwZaJv3eUyzJ6dH/MpLw:W02NJxJfehAfMpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623444008, "uuid": "d1374006-af14-4664-b677-317fb6a90f37", "value": 1143808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623444008, "uuid": "cb81b413-9d04-482a-9252-51ebc3fca4bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444008, "uuid": "5860a64d-1a28-4096-9abb-5db2ee2976fa", "value": "SOA pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fdda08-ca9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623407095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407095, "uuid": "709759a3-1a6d-4b9c-becb-4442e8be827e", "comment": "Malware payload", "value": "22b35a6c22b81e956f65dd457624ed07", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407095, "uuid": "94896d98-77f8-4e2f-a3bd-f639a36f51ef", "comment": "Malware payload", "value": "1bd16603ffdef89d59c23c7cc5315e1839be200650d67883aee0ffed05966a8f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407095, "uuid": "d70f646c-e649-43ac-90a5-f4d235e17d0d", "comment": "Malware payload", "value": "03cd7eadb0f039405a8b7c68fb9831dcf11da066", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407095, "uuid": "5f77e13f-9ff5-4a6a-9fae-4268be69eb77", "comment": "Malware payload", "value": "0efa2cfcfbcb75b015304096e53e8ff169b73454bf8a834cfc2b5d3bfc5bf57bda5260294c5566a4119548d031c48eb4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407095, "uuid": "4dd43194-55e4-4f66-981b-abd4f2407ce9", "value": "E0D097A4A133C87C4CC6CC6EE0AF9231F6AB00A50380BBC4C3E5C931DC0120EC2B8A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407095, "uuid": "0633d660-289e-4b35-8d92-577af2cbda9f", "value": "6:QOeTjGk2jInyRustx7SUzD5Cio6LSbWacX2PjdS:Q3CjInwuSYGcio6LSP8WxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623407095, "uuid": "e7ce4845-80a3-47d1-9fc9-3f7d33c7605a", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623407095, "uuid": "b27e0431-0085-4d8e-a9d8-828cb755668e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407095, "uuid": "ac60a111-3801-4b6f-8cb7-e5a60fd2313e", "value": "22b35a6c22b81e956f65dd457624ed07.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24de2923-cab5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623416492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416492, "uuid": "9334b2a8-d444-4ccb-a974-3e8eede29394", "comment": "Malware payload (AgentTesla)", "value": "151ec82864cc859f03be0cb572f30357", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416492, "uuid": "33f120ff-fb7a-4a48-bbab-c7b2645b016b", "comment": "Malware payload (AgentTesla)", "value": "1d5221667b8424ccbc7ecc85a7067dc264ac31ff97dfee76a080b7280b60d1e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416492, "uuid": "0a99d70d-5a6a-4d54-af27-d19c59da6ebf", "comment": "Malware payload (AgentTesla)", "value": "b93f14d8b0eb8e0c12da8e8d4afcd9048a8228a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416492, "uuid": "57e934b7-0774-4c1d-a2dd-11c5fd251ccb", "comment": "Malware payload (AgentTesla)", "value": "91ae35fe718ea13df56592e47c65534f4e26543e3ef5fcde743c088cab4d39b89242a3982a8b5af0df5597b36d6fb3df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416492, "uuid": "1f2d351e-acea-408b-b4a0-e21c4b7b2092", "value": "9F75BE1022049B11D13947758C23D6B04FB0AD4EEAE6C64E7DEB7C9F39717B11A2E26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416492, "uuid": "8bd92a7f-a61b-4aa8-b20d-5025d5a2d5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416492, "uuid": "5be9e7f1-3b46-44f4-977f-ce3c340ec384", "value": "24576:+fuNeBUdtwsEgwsAe/z8YEoqSg5LlJfHKdofUA125kuV3MM1zMIDsxTt8gYcL:yuwBUwsEgwsAe5U/BldqdosA125BIYcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623416492, "uuid": "144bb1e8-8551-46eb-be59-48c38ed07e4d", "value": 1549824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623416492, "uuid": "6eeb5637-24d1-41be-b7da-71644eeadb16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416492, "uuid": "a8fe2b08-a130-447f-a87c-67a7266969cb", "value": "NEW URGENT ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9173484b-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423546, "uuid": "085f2e97-c88b-4281-ad66-85c1250d9330", "comment": "Malware payload", "value": "e9f00cdcf757f90059c7518f64df26c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423546, "uuid": "5fc57415-c898-4d28-801c-e28df30ae15c", "comment": "Malware payload", "value": "1d7a1de17c3d67b07dbaea9fb157c2c4fde1c9cdcf5f6883eb523e2037036725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423546, "uuid": "543cae26-9d1a-4b0b-acd6-c8eab530f36b", "comment": "Malware payload", "value": "890e5e702bb9a4fc0eb4b80902db9a7bbb41af6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423546, "uuid": "d7f14faa-438f-4ad6-87c1-19931ff92643", "comment": "Malware payload", "value": "03fb30708ecbb8d05813f11f5dcad05997e1000c6a8d554b40e65336f9504ac01ce6f05fe538b50e3b9b75538d6b43ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423546, "uuid": "27cb94d4-efd1-4f94-9568-b1d3283e7428", "value": "9C72C053EE68EA49D104333D864FE868FF11FFD64985DA47E3C18D17BA9402A2B065AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423546, "uuid": "10431443-1e93-4b2c-8f35-1cd606172099", "value": "384:ix3OJrGBhodl/xu7U/huwrSfXQU2Js5IAkBbvYTz4gV5Xit9wCxIzoZAa:iIc72u7g4wGXQ21aGz4gVSFmzsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423546, "uuid": "1ef37e78-44e7-44d3-94ec-0941ee261a2f", "value": 17324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423546, "uuid": "a02885ee-3d0a-427c-9efc-5092c802749c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423546, "uuid": "42c69ad0-99af-4d79-b844-86be483d27da", "value": "e9f00cdcf757f90059c7518f64df26c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc75604-cab4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623416344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416344, "uuid": "e1d5f1e7-85d6-4a8a-a3fc-8057cec001f7", "comment": "Malware payload (AgentTesla)", "value": "1603b2e2474ac57ba3ee0ae98357b50c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416344, "uuid": "95883db0-a1dc-4701-946e-6f649ad80096", "comment": "Malware payload (AgentTesla)", "value": "1e718cc81b172505bab7576339bb954e9911c79c95c67430355afc493d075a2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416344, "uuid": "7f8a45f0-f008-4dd9-9af2-87d39d48638c", "comment": "Malware payload (AgentTesla)", "value": "a50dbd334f5d9a67c51b399dfc9c8b44b5514e59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416344, "uuid": "7d6d8232-1da6-4919-a855-b58b386ce11e", "comment": "Malware payload (AgentTesla)", "value": "ea888a2cb3eb2cf8945afc24917eeb51b6cfb8e3f7e4e86b349ea48c2e3dbd9ce2f2956ba06562476afebc5d91fa5ed8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416344, "uuid": "b1f14345-895f-4d40-8af1-52b58b48e2b9", "value": "A11569F1A5A107C3D39EDDF193CAB3848B6F46A235728212A94C22FC76DD29D14CE587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416344, "uuid": "f6ede5f5-6df6-465e-97c1-efb2ae4b7b36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416344, "uuid": "60fbb5ad-e892-4143-bc47-687633d7d422", "value": "24576:0UlxWPIid63/m5+tSH0exuIwBB+NeBUdt:luPtf5600EuI4+wBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623416344, "uuid": "ab5e1ea2-863e-4d17-a387-9608a8729497", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623416344, "uuid": "762fd1a3-6558-4bb5-9d08-b367b447bb52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416344, "uuid": "b62306b6-6469-4cb0-a375-d0c72125b445", "value": "OMANTECH PRODUCTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d1e8e5-ca94-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623402583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402583, "uuid": "48dea193-f606-47fc-94a7-0b337f20ba6d", "comment": "Malware payload (SnakeKeylogger)", "value": "ba23e691dc4aec9d7b2681879fa69010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402583, "uuid": "0e0629a2-e259-4c0f-8bcd-eec8d5647d46", "comment": "Malware payload (SnakeKeylogger)", "value": "1e887de55218e7c4b732111000db7e51d98018d01f89fadae675a4f12e964970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402583, "uuid": "b12fa09a-2928-4e9b-88ea-b3fdd57621dd", "comment": "Malware payload (SnakeKeylogger)", "value": "2b38de65e073131fc6869df9265f11b1e98bacdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402583, "uuid": "f2821d51-4bcd-468a-801a-778db3dec801", "comment": "Malware payload (SnakeKeylogger)", "value": "bddf0cf4d2c4d840f2980e5b48592177c188b7528e851cfa09f5c99643ede63c922c6ae93b7d01f73f34480991d13d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402583, "uuid": "745523bb-0f74-48fc-96c1-d934fe9c17ae", "value": "90B4CF1A70D0E615EAF5703CCFE6D2381331ACC89947862E2AE57F5B34ED2DB52016E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402583, "uuid": "a5e6a34c-c387-4ba9-a7ac-5f7b7542d04f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402583, "uuid": "632ea561-04bb-4e92-85a9-a3d5191fcfc8", "value": "12288:16jih7jqCKRGm8ec388qtZTKC/aJUxiAmN11K2:10o88B3PqtJ/aJPAmxK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402583, "uuid": "acec4f8a-bccb-4b12-b795-4b6532f7760b", "value": 494259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402583, "uuid": "641abafb-bd42-477d-88c4-6b786964c26e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402583, "uuid": "164337d7-66a5-4208-9ef8-2a6f05e0ebf2", "value": "Shipment Invoice & Consignment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8c7780-ca89-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623397583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397583, "uuid": "247643bd-019f-4439-9c83-1def3bc3f965", "comment": "Malware payload (RedLineStealer)", "value": "e6b7b89f79f7ab9eab16b2120a6b7a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397583, "uuid": "243e2889-0308-4bc4-9263-bc31b4089e1a", "comment": "Malware payload (RedLineStealer)", "value": "1f1051d96cb5c92ca2a1677d2b33bd22d1aeb1ebcf0421643a60ae92a0c364ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397583, "uuid": "9c5430cf-4d96-4cbb-a54d-a58485e344d4", "comment": "Malware payload (RedLineStealer)", "value": "e1ed709c8f2d6e826de52013f3fd779e987c5734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397583, "uuid": "6384f776-3fd1-45cd-b1a3-ff1e05f1d539", "comment": "Malware payload (RedLineStealer)", "value": "9d0f7da7433a950718eeb7cfcf4b3d7d0fce6764993c1cd5157ca6b113329254ee755b5193d2c27e594b947e6648c0b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397583, "uuid": "e11b2003-5c3a-4dcd-a66e-8c7c163bb1f0", "value": "1D655B05B7FD9282F31509B47036972B3EF43D12A4A8F38CBA053BC9167AE6276C155E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397583, "uuid": "4632446f-6bf5-4d0f-aa61-a1161e38a57b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397583, "uuid": "218dc1ad-6a5b-4874-b8a0-d7b51cf73cd5", "value": "12288:yD9g8LN2qtygghNbUMqqc5XlXo/VlLj4l7UHtJymnKzHD2I4wbuQJKrbjZokEYR9:y5DAUHqy0L0tUNJyoOxbYaYRIDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397583, "uuid": "f48d949b-019f-409b-8ddc-c6bc003cc5c5", "value": 1493336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397583, "uuid": "961676e3-23f8-4668-8866-5be2ffca9b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397583, "uuid": "4cfcdf7e-4c20-41e3-9496-91fd20c8bee1", "value": "e6b7b89f79f7ab9eab16b2120a6b7a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1affbf-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427000, "uuid": "90c3fdfa-4e95-4b53-b50f-ae9b33042f0e", "comment": "Malware payload", "value": "42fd8730067a874e806048a783143605", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427000, "uuid": "2bc2d4f4-6c5c-4861-b170-11fd3d17ace9", "comment": "Malware payload", "value": "1f1830bca480c2a21b3c0e1240f6702e1825adc68012b94719a96ef0e57642a0", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427000, "uuid": "ab0811e8-f868-4c66-9e4a-3c065c931b3f", "comment": "Malware payload", "value": "f6eeea6175ea78707bae9bdfb0d74ff8047e07c6", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427000, "uuid": "6de21ed2-572f-4a82-a225-8ee90dbfa690", "comment": "Malware payload", "value": "aa0c2db47be53eec5b4f6aa0d500e802ef68d538c492f606ba0deeca3abe2a8d04d88e09948385102bf50a349c5c3af4", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427000, "uuid": "b8b65f7f-e069-4010-a493-7cf5d3f9d62e", "value": "1D21CB56A7D26D67CC940633DCEB6310E321BF84858EF413F71112020C2F3291F22145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427000, "uuid": "2c9eb9e1-f704-4b62-a101-7b2704329bea", "value": "24:AAtVsWqY3D5KjEoKGOrUlFSs0VzLCkId028ZOIHtAkKoXhTNfOX:NtVBN3DMWrkFSsCzLRGINooXhTNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427000, "uuid": "f6858917-ea29-4557-9371-2bdcbbb6a41e", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427000, "uuid": "e7b3acb2-7e28-4e68-831b-60efeb56371e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427000, "uuid": "a0e9d8f2-83c5-4866-9619-c34daf892027", "value": "42fd8730067a874e806048a783143605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0d4fd5-ca82-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623394921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394921, "uuid": "b2bbc2b7-0f17-4c6a-b466-d5214322e34a", "comment": "Malware payload (AsyncRAT)", "value": "cc092de2f608c95b9fee17363667c6d1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394921, "uuid": "5071e00c-54e3-4a32-9447-ff831b19bc36", "comment": "Malware payload (AsyncRAT)", "value": "1f47abdf4718c1da3906f9d51ed5126ec3b7e77922f974268c097a01baf3d4bb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394921, "uuid": "6a3e4785-197b-49cc-bb70-7758a31a970d", "comment": "Malware payload (AsyncRAT)", "value": "817d57918858bb4ed2cb275b16c7bdb13d0d3cac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394921, "uuid": "8ca3a595-85cf-40da-a687-b2d6c1205364", "comment": "Malware payload (AsyncRAT)", "value": "9948149cdc95c5fbadab9fb413b25bc92454e22a3e874f7d32a510b1146c59d2161126f30ae357fbee18ffb42164d843", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394921, "uuid": "459fa35f-d816-4f83-99ce-5fe4d9f929dd", "value": "0C25E026BE529940E29911B6CADAC1380375AE013EB7C34A67D83FAF75703223E5D7C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394921, "uuid": "c70fd857-ef64-4c93-acd7-93ab07117030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394921, "uuid": "57887009-1f6f-4c91-9bb5-eaf3154d459b", "value": "12288:FqFloxtsmx0EZU6VdbzJJO5SzZM4e/ZUdtbe:Fqnonsw0INPfLO5SzNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394921, "uuid": "28b1ffda-e1d2-43dd-b118-87ca72ae6f08", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394921, "uuid": "6268df7a-22d0-4fca-9273-807effa5b0c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394921, "uuid": "6971b743-af61-499e-a13a-003a4928256f", "value": "ORDER-21611docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8002bdea-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1623426952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426952, "uuid": "c6a3944f-b30d-47d2-92b4-95a135479cd1", "comment": "Malware payload (CoinMiner.XMRig)", "value": "e8a064a89592dd0838137155a048a5a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426952, "uuid": "72d27325-7981-4c08-bd7c-138bd354b0b6", "comment": "Malware payload (CoinMiner.XMRig)", "value": "20613f93bfeefeeffaf00b4c71d7af583e26b88de43e8ec902d655e8700fadb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426952, "uuid": "72d348fc-2284-4329-8e4c-5297777d3b9d", "comment": "Malware payload (CoinMiner.XMRig)", "value": "18b35075a297f06d9955cc5aa807b5cd875d7e7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426952, "uuid": "23ec2435-f37c-4042-9060-32ccbaf739dc", "comment": "Malware payload (CoinMiner.XMRig)", "value": "90c3f87b0afb00497a97352fc955ead6673323f0284be5e727510d1a2f5db7df84dc4255e5f675ca7177021299e48799", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426952, "uuid": "2eaaa5c6-34de-46bf-bdd5-4a0141a44261", "value": "C82633ACFF08E18BE07E42F5885FC310151A3D40ADA5933911EC773D9736917EA2B69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426952, "uuid": "52e19b34-b3c1-486a-86d6-af8535bcc6a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426952, "uuid": "cb1c8478-2878-4d49-bced-998fb4983812", "value": "98304:NNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:NNNa4HxDe/GDhFb0lB4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426952, "uuid": "49a6319d-3611-4e30-b9ec-abb03e2a05bc", "value": 4560384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426952, "uuid": "c86ec3cb-b7ad-4159-9c45-51951071925a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426952, "uuid": "f6ca0af2-0755-443b-8e35-a1588c02274c", "value": "e8a064a89592dd0838137155a048a5a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe33dda-cad0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623428133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428133, "uuid": "b21396cc-ff00-4c41-81f0-3e60449f4330", "comment": "Malware payload (Mirai)", "value": "934801f8c50ae13bc31998af3dbc1627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428133, "uuid": "c93c2e7c-de61-4e31-8c96-828fd7b17e19", "comment": "Malware payload (Mirai)", "value": "20fc042f1870d5478a5ae294bcfbd27c4886dd6741fda9317128ccfbc1430a58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428133, "uuid": "ca8f2eaf-4ed6-4029-88b8-6e11bb30b9a7", "comment": "Malware payload (Mirai)", "value": "4384ce34dc0563936aec4bcdf5c205facaed0fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428133, "uuid": "ab1a6726-d7fb-4fb9-a895-a2a55c3e8a99", "comment": "Malware payload (Mirai)", "value": "cacd6f42b34050a8b51f3c6fd382a69e85e372d53461bc4461003a359472e1086fe498c4ec390e0662afb88703c62d55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428133, "uuid": "306dde58-7b00-479b-91c3-8b52c3c539c5", "value": "45C34BD3F861CFFFF808E6F680570505F131E2A01AEA0A23F6226897BA651D93557EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428133, "uuid": "a6920c75-319d-4c37-82a9-e46b2fdebbb5", "value": "3072:VzttS1glvnqcXCfbzUe+dZpxdyrxxvR4jLMjR:V21g9qqqce+pyrLR48jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623428133, "uuid": "b6c23f8a-5f00-441c-8f10-280c9d3d4bd6", "value": 122200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623428133, "uuid": "7521b158-1129-488a-a62c-2a7578fe2627", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428133, "uuid": "42122704-0db4-4b42-9f1d-e6665cfb31ad", "value": "934801f8c50ae13bc31998af3dbc1627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e10f6b5-ca93-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623402038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402038, "uuid": "7c316540-fa2d-475c-8d12-13e54ab9c342", "comment": "Malware payload (Quakbot)", "value": "aa5d2b9d49df443804536a8e301df76f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402038, "uuid": "5101dfb5-e9f0-46ee-8233-d16cae1061b6", "comment": "Malware payload (Quakbot)", "value": "210f41683ba37ece9e65767a6069e6c75c74706691621c1e2863639f8c1d7a22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402038, "uuid": "812d48c4-0b88-4d9e-95bc-9340409ddfdc", "comment": "Malware payload (Quakbot)", "value": "ce1b4e08334163135e5b2eba8b3b98f4f104bce8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402038, "uuid": "e6ddbe5b-e614-4247-b6d7-88947fd1aa7f", "comment": "Malware payload (Quakbot)", "value": "30233560296e0b45516579870946093949a0bc13e77603ed61e6f0053176fbbc307073b1b6391e9ea74d72e762876a32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402038, "uuid": "476c10a4-491c-4d6a-93e4-3b0aebf8bc48", "value": "0B74137EE7815AF8C339893EC680A2D48255F1D140A7B32D07CD3618A7532DFEA5D2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402038, "uuid": "1b27b2db-6eb4-4568-8685-ff7449f8e4f5", "value": "6144:Y1cbRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNV:YSbRMmEv2Bc/nvm8IKABfsYOmauFLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402038, "uuid": "6c1a610b-2cba-4d7f-84c8-75cddfb6f26b", "value": 346807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402038, "uuid": "a0afa1ee-cfce-4be5-9f1b-4ba037dbf078", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402038, "uuid": "5f61aec8-f368-4539-88dd-c397ee50ec3d", "value": "Cancellation_Letter_118544021_06112021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa99f31-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423508, "uuid": "d325ded0-4a49-4ef0-80c0-05a0daed5a6d", "comment": "Malware payload (Mirai)", "value": "59c75dea762474bb342818d926c57845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423508, "uuid": "2f513c47-eb79-46ba-b6c4-3c07d356ae08", "comment": "Malware payload (Mirai)", "value": "22157e63d1319d16f25e01eeb4cf529959907ae6dc39288c101635d7d57832ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423508, "uuid": "b4129dc2-c26e-4632-b6e2-924f77703077", "comment": "Malware payload (Mirai)", "value": "39437ed80f0048ebc5aa9f25138b2e38a60781c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423508, "uuid": "5c34f994-7a5e-48ea-93f5-f82067668a27", "comment": "Malware payload (Mirai)", "value": "9174dea67b8ab23794857164ae1abbd61ac4e0bf5208a48ed04eb337f25ef56cfd7228b0d1afa96bf52fa4ac5272845b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423508, "uuid": "23e72bda-c93d-45a2-9807-96c264506b75", "value": "47B36B35AE791D27C0E5A07B21F78221F1F2270D26B4851E7CB20E8EEF2865075676B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423508, "uuid": "1c941cc2-6294-4eb3-8233-491560c293dc", "value": "1536:ZlP8aBxCSXXPlivp+wJaN1GDFiE4w+MhjmBdC8wO75jtiILaFUqD:/81MQ3VTgt9VbqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423508, "uuid": "a5669971-0470-4ad9-b50a-7da7c21ec3dd", "value": 110472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423508, "uuid": "48bcf45e-f465-4538-a678-67fc93f565c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423508, "uuid": "27d8b5ed-697a-47f6-83c1-963cdad1d6ac", "value": "59c75dea762474bb342818d926c57845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb13094-caa4-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1623409418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409418, "uuid": "98d2a035-49e5-408b-9c43-076cdd7999ef", "comment": "Malware payload (CobaltStrike)", "value": "761d36c460ba5f48935baab51f4f6491", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409418, "uuid": "b4184c8f-7bf1-41dd-ba67-dd032948dbc4", "comment": "Malware payload (CobaltStrike)", "value": "24197e271f0a1ae404e7e136a4d79d4e90537c18b4c598bef0801e32ca63b8c0", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409418, "uuid": "2f3c48b1-141e-4655-9f07-6ecda445be96", "comment": "Malware payload (CobaltStrike)", "value": "4ced40256273c454f1ec5280fd9bd4ad22d90d5d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409418, "uuid": "04ba03e8-db23-45d8-8b9f-98f7f44b0801", "comment": "Malware payload (CobaltStrike)", "value": "aa7e6997962b8407b5fb675cc9436fa89a1212e82d62ee7aee07808806dd73a5e4f5ee37bae542335401ffbca8bae32e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409418, "uuid": "394c76a9-4e39-4403-a793-d249b61224f3", "value": "06C38D1079C1C033E47229311568EAB15E3DF9301E616EDFA3D4267A9F317C1962AEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409418, "uuid": "fe3cdb57-3ff9-42d4-9468-e398d67a8ce3", "value": "e004f1ae4d822a60e91e7918b2f8b442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409418, "uuid": "f80b762c-8bdf-4f6c-87db-2124e24d4119", "value": "3072:0ZVzAbQhPbgWtWJO9Uv7dH4p7XPq/Fktx/V2iHBqNt/UnHWTCyjpn:QE0bAH4pzS6/V2gqPjpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409418, "uuid": "0b54bda9-435a-40f0-a51e-b6672488acdc", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409418, "uuid": "f69305a6-6fe9-4166-a40c-8ee353c2efa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409418, "uuid": "3098bb46-3e75-454a-a6ce-6841b9acd993", "value": "24197e271f0a1ae404e7e136a4d79d4e90537c18b4c598bef0801e32ca63b8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4630541b-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623394214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394214, "uuid": "ba95b58c-ef8c-417d-8c77-90d4f18977dd", "comment": "Malware payload (ArkeiStealer)", "value": "0f08c08b57da9ab9ce30f46aad3ad2d2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394214, "uuid": "217a0228-86b5-47d7-8c29-0cfa96a4aa31", "comment": "Malware payload (ArkeiStealer)", "value": "24f80156cafda11296f26911d8829b096c1acbd023d7a7be2c5180eda8cab8f7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394214, "uuid": "2ecac015-dbee-4747-a626-acbf9a88595c", "comment": "Malware payload (ArkeiStealer)", "value": "bb3b759849d0c508e993a1f0d559031ab19a1c24", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394214, "uuid": "18e90fc8-0a83-47f6-b5b1-cad2e72b8d65", "comment": "Malware payload (ArkeiStealer)", "value": "b02d65da1b0a5d642fe14ac56d370a7a515d56e6bf03f531dfb4a18ecd611b0f49586b15cac629ae35e0c616eb250f84", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394214, "uuid": "16c48fa9-f59c-4657-a4d3-87530e05ef71", "value": "7E15E110B2A1D035F5B326F05AF98279953EBAB35B6491CF13E52BED66346E0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394214, "uuid": "c9684d83-5e36-4a60-9f5a-b10e285caaef", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394214, "uuid": "4a85eee2-1259-47c1-b5cf-83155b2e8f01", "value": "24576:MAXfQErWN0R4Q455geUoTXYWk5W9ylQlZp:MxDgN5W9Jzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394214, "uuid": "69a86cd2-4de2-4e8e-9c56-6df481b7cf7a", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394214, "uuid": "dd09e977-98b0-4ad6-9638-fa1b42c4a296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394214, "uuid": "ab46597d-2f67-4940-8f36-51f05fe47a1c", "value": "0f08c08b57da9ab9ce30f46aad3ad2d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfb43f2-ca95-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623402949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402949, "uuid": "16003c1f-f239-4b36-877e-6c2df81c7b91", "comment": "Malware payload (AsyncRAT)", "value": "3c9b91e1106e535475a62042a30532df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402949, "uuid": "900ec94d-bf06-4e2b-8e75-07eb00f23963", "comment": "Malware payload (AsyncRAT)", "value": "2690da896adf761bcc8072a2adf33f634a604c35f92b135a7807f69782e4d348", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402949, "uuid": "86a1539e-44ad-4471-a836-67b4cd33e321", "comment": "Malware payload (AsyncRAT)", "value": "e1633919c6571ca6bded69e5478c1fc85cb83512", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402949, "uuid": "838831fd-640e-4fcf-8a1d-9179c3bfbed6", "comment": "Malware payload (AsyncRAT)", "value": "247a50f17d30693ca5e3f568e737ed06708ccc446ba32757d63e4ab3b5021362e861539036c2da4901bb4d7c903e03cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402949, "uuid": "80116263-eeae-4ad7-8ed9-65648f5a81ac", "value": "A4D0234B7534CC044257C9DE80447444CCC7D7641136555424BCC7F43266074CD3D6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402949, "uuid": "3c20d38f-a37c-47c9-9019-e3ac1d5a73e9", "value": "3:IrL/d3M3wXKeF2GYoLIrL/FHBGq5NHnovdMh328EjnmNQMTbTyKNNQWZLVLmPO7X:Iri7nV4MLzGoovMmxnqL2WlvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402949, "uuid": "b29bc953-3fce-451b-9ae0-b8b21fbdbfa4", "value": 205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402949, "uuid": "06e158b3-b4d5-40e3-8f00-ab848c633170", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402949, "uuid": "59124a5f-3a3b-4983-9c6f-6cce0c424c7a", "value": "eStatement-ID018718656456384.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa8eb0f-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423516, "uuid": "a05e2248-c977-45c5-b6c3-025e8acb1e7f", "comment": "Malware payload", "value": "27d5e59e80bd0d5612520e72b617a81d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423516, "uuid": "c27ef760-81a9-4324-adf9-c2f5d9e42258", "comment": "Malware payload", "value": "2760078c966f5be5f997ea20426ca19c11e17d194f3f753d238ead0fc660baed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423516, "uuid": "df3438f4-8abc-40ef-91cd-70d931c60225", "comment": "Malware payload", "value": "be7ef07f42b5bc3b0aa7875f71a01f5875ac2faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423516, "uuid": "d7d93b15-2885-461c-81c9-81ae91616363", "comment": "Malware payload", "value": "357ab950c693d45b20fab5ae5314856e9cdbadd9492bcd11403a6f254d63dfd3c0c31f250292f7eaced5422103e4ecdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423516, "uuid": "f53437e5-2483-465d-bd99-07ef1eba9b0c", "value": "7A934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423516, "uuid": "ed5e7190-a1db-48e3-b54a-ab2997370a65", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3NphauH/jPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdNphaE/JVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423516, "uuid": "6c5ba73a-cbd9-4507-9e47-fc28b9385c0f", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423516, "uuid": "080ceec2-c7aa-43f9-a55e-dc94a0bc7ab9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423516, "uuid": "63d8a5ca-f231-48c7-af5f-ea1fb3e56f14", "value": "27d5e59e80bd0d5612520e72b617a81d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778e4c2e-ca80-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623393867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393867, "uuid": "d7d4b244-6eb8-4533-8c37-bde71d1ac7bc", "comment": "Malware payload (Gafgyt)", "value": "757fbdea9b03abed67274d0cc1ce2f08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393867, "uuid": "95e47530-4c39-4be3-9b5a-b5eca6c193e8", "comment": "Malware payload (Gafgyt)", "value": "2832c10c7d3385c5d3c86244535f990484fcf66f16a966c5ea3a9815cfd52a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393867, "uuid": "33f89819-bedb-4b55-808b-f7a1a2d30fd0", "comment": "Malware payload (Gafgyt)", "value": "f9e5dc63587c245991a3b8fb59226f89e2b8c074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393867, "uuid": "e385d5ed-9e59-4791-a960-784b8a3d9f3b", "comment": "Malware payload (Gafgyt)", "value": "970d176c8078360994f54004612fd33ac64e64dcb989264d428bb10fcc75b7a974aefcf265b6a2496097c1d9d90fbd42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393867, "uuid": "757a6077-74cd-4ca4-b388-554b421d980b", "value": "12E33B09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393867, "uuid": "d7a6b6ca-c242-4037-930f-136bd7b26b16", "value": "3072:Bn7aKpF4LSV9OdAKoxicennFEM/9OD4bxCkEFvmpwfvRQfZn:l7aKpF4eVZKoEcenneM/9uvmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393867, "uuid": "53ff9d4c-c5b7-4cfb-9975-9455b819f79a", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393867, "uuid": "77ae87d9-7d96-4d6a-a04a-0cd1c8f6bc1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393867, "uuid": "b8a85164-bb17-449a-afd7-087caa109c12", "value": "757fbdea9b03abed67274d0cc1ce2f08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5015b6a-caa3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623409083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409083, "uuid": "02369833-5023-44a5-a3c3-fe88f92ac2f9", "comment": "Malware payload (SnakeKeylogger)", "value": "6b96cac4ad3f96e811537b6f9d0a21e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409083, "uuid": "31c1f877-26ba-4b76-b0bb-39e109b3f4d3", "comment": "Malware payload (SnakeKeylogger)", "value": "2990e41f6a491ebb206d9dbe50b64459c5c9ff6789159d191033521edd85e839", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409083, "uuid": "fe575e05-cf71-4b68-84eb-4e30b868e2a6", "comment": "Malware payload (SnakeKeylogger)", "value": "565f9ca4299d441c4a7ea3306ae8c84226968df3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409083, "uuid": "5587681e-595c-4734-9adc-8133a9f0c7c7", "comment": "Malware payload (SnakeKeylogger)", "value": "2a2da86d6dadf5ef49e41c9b4a112979bcd759ef680b5cd74cb7da08f5748c6058ead418a0c3ee40f5b16a2690e848d0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409083, "uuid": "0fc3aba0-8b3f-4346-b3c6-704ae8fe65b8", "value": "BD52E77CC0A703988F45AAB82B2E9B45168D366DFB48D133357867716792D7B9023D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409083, "uuid": "a039fc4c-7d4e-4e60-a341-207aaa340420", "value": "384:BzQZJQk1W0XHBp+f5n/AX3NEFwB/CYnOZ17uNDLcA:pQZJx1l3bo5/AHNEFwB/CYnLcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409083, "uuid": "a2434ec5-31d5-4c94-9b35-b7f7569426ed", "value": 14223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409083, "uuid": "526f60a9-5237-4de5-bff8-fe5d67f35b05", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409083, "uuid": "c94de9c0-2f36-4266-a412-305b6997be5d", "value": "RFQP000001488.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfca19c-caa1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623407969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407969, "uuid": "56f4d6f8-4931-4386-ac33-f04412637b88", "comment": "Malware payload (SnakeKeylogger)", "value": "b310853bf7e87d934a6266e9856cbfee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407969, "uuid": "428abae2-6f3b-4fbe-be86-6e78689807bd", "comment": "Malware payload (SnakeKeylogger)", "value": "2a487a298c66cdb24fc08767e26dfaef11d3d3bd043997c7984e80052a7bfd89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407969, "uuid": "4a95c95d-cac5-45fb-bc71-3caa1a95499d", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed80709bb970b64c05c6a850359ff09995f720c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623407969, "uuid": "ad01a7a1-6e07-490d-a52d-752958885d67", "comment": "Malware payload (SnakeKeylogger)", "value": "05e230a2af14ccd8b2b315747e1539b5e4e8f861de423984e799b98a7ef9169b436caa9426f49177af2df85a7bd9d85b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407969, "uuid": "93cf983b-c0d6-44cd-a0d1-79db34241052", "value": "F2A401667640D813E76112F485A1F3BACF392FCC3E568203ABF57DAF76293869C09251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407969, "uuid": "b8658459-6df7-47f7-b6fe-1f467228ba82", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407969, "uuid": "7d728547-0ba6-4c5f-89bd-b781f1f9be76", "value": "12288:2tGv+Up25y8qrK/WuS/gf72zk3wOR63O9Qsn:FprKeuH7JtcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623407969, "uuid": "e3647ade-1d71-449e-87e9-f6fe6a88eb3e", "value": 484979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623407969, "uuid": "07be1e32-998c-4186-9276-9aed4deec001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623407969, "uuid": "d73cdd2f-9b4b-4f95-b10b-954763c602cd", "value": "0900000000000090000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999cc2db-caf2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623442887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623442887, "uuid": "e6e74a6c-64bc-49ec-b719-87a3fdb0f328", "comment": "Malware payload", "value": "242c83e06957e8f223814e2a7a86957a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623442887, "uuid": "c06220b8-577e-4d8d-8337-59bb551ad9a7", "comment": "Malware payload", "value": "2a7414d1df03f8c98a2ab8e8345d2c6579b61aeee274065576b79b02d9c48e70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623442887, "uuid": "5993f537-acde-45d2-b0f6-1ebb41af5f6b", "comment": "Malware payload", "value": "1126e954fcce0bc79c5bed9c11566d9f04248830", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623442887, "uuid": "cbe188ea-7fc7-4e73-8961-5c1224b79e46", "comment": "Malware payload", "value": "6cce8c52eb3c82802e892f2b0bbea5a28a515ff803f0c78931b30925d931bff5b48e5a1f61f8bfbe83de7dd90a3f916d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623442887, "uuid": "8ed391db-9220-4f80-a991-a31909bf898f", "value": "6D2161706262E9B04C0409D400951AC2AC0CAD37E36318A0FF091E8F9AF7368FA73DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623442887, "uuid": "1521a342-ea7e-4404-9d64-c19e128b988c", "value": "24:EVyHhFNRj8+fBnmz00zAJjbVoP/f5J06d2rd8ZVGn/wubZPwBc5KX89JXjepyan:PHhFnZniPAJeP/fH06qd3pZYBcYX8/CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623442887, "uuid": "74e243ee-eba1-4336-9ef0-58cfc493f516", "value": 1436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623442887, "uuid": "a5793324-16d6-400a-9c03-d590aaf046f3", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623442887, "uuid": "88b55328-b819-4fe0-8638-d6ded735caea", "value": "dropper.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d2632e-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394133, "uuid": "25e4b80d-2cab-40ce-8de7-17e27322a1bd", "comment": "Malware payload (Gafgyt)", "value": "021f3ebbda795c9cfc0366dbaf2c48df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394133, "uuid": "bb52422a-5117-4d3d-9441-6c50a678c682", "comment": "Malware payload (Gafgyt)", "value": "2b04bd1ed5db6ac07ca7d4048f9689dafbd33911b23ec133e2eaa8a7fbbd75bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394133, "uuid": "6cb32a72-12cc-4908-9e35-c4a4d243a8dd", "comment": "Malware payload (Gafgyt)", "value": "8ede09b5aa5b88cb2de36a08d42e7c46395209cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394133, "uuid": "a490e38a-3046-4b35-bc8a-1b40eb034015", "comment": "Malware payload (Gafgyt)", "value": "c41f6ab6d74d2be5a3c8a64f0207212f3976ae252512c3ae1165d79062c589c94f15e43f625a72ae2658a0bbbf1277c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394133, "uuid": "91269985-1045-4c6a-b2e2-d5138c009b77", "value": "2E734947A9659FB3C146AAB525E759300B13F8215F0F2B89713DAAF8430F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394133, "uuid": "ae784d4d-b908-40d7-9036-8ab9402fd70f", "value": "1536:8wyVzh0fcKepZ4tyG1NaEVx7Ch3yzvVrmj9VqYLe8f26e:PIzSfDeYyGl7+3MVmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394133, "uuid": "4f388b4e-4327-4f3c-93f7-a1739004003c", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394133, "uuid": "7c6f2442-088e-4f5d-9234-5c74969f9bd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394133, "uuid": "8e83f001-7a1c-4986-a3d2-e5aedd81e071", "value": "021f3ebbda795c9cfc0366dbaf2c48df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e451911-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623394147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394147, "uuid": "96979888-39d4-4ed7-81ec-a2667ee07c13", "comment": "Malware payload (Loki)", "value": "81f63c8e0fab4d42de5486e88aa5ac74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394147, "uuid": "41ffc655-ffd4-465c-a0e7-1032ff6f184f", "comment": "Malware payload (Loki)", "value": "2c4029189010085712385bb7329bf0a10851ddec9c9849e60a94962896fcdfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394147, "uuid": "1246967f-8933-4569-a5b7-571a8eed0624", "comment": "Malware payload (Loki)", "value": "f3b3d2fb57e01af4bbcc356a71e8a5abe428491c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394147, "uuid": "0764e05a-1903-4b74-9ed7-4279745021d1", "comment": "Malware payload (Loki)", "value": "1850bffc8ed896bb1fcaa22f3979c59c965ef5e86b9a394362221c1cf906b3407faba85f437b667ebf0ae01fd62c4935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394147, "uuid": "3b6f7791-6657-4192-8814-31a398fac6f1", "value": "35A423998A30FE14C7A58F7A77DE5987CB343E03F0419BA87068714E49FB3947D2189A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394147, "uuid": "2b10cb1c-45ef-4e71-9bc2-faaf68565815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394147, "uuid": "9811bb39-808c-4526-8500-970f9824730a", "value": "12288:g4tWKG1Gu7iTQezjBwpxutyAHPusCNzkw/U1:g4tc1Gu7KzupxRKuL581", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394147, "uuid": "e82512ff-446c-402d-b3dc-cdc67aa3e40b", "value": 453616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394147, "uuid": "89eca637-e866-40dc-935e-b342f52de8c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394147, "uuid": "0e146991-69de-4fff-8287-b3bc31e38926", "value": "81f63c8e0fab4d42de5486e88aa5ac74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31de96e-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623389645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389645, "uuid": "36ac4aea-cc29-41c5-861d-dd11c0c01f78", "comment": "Malware payload (Loki)", "value": "3a99afd85fb1e4bda80f0a8bb2476616", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389645, "uuid": "9c471698-bfb3-4d35-9a0f-dfe7277b0d93", "comment": "Malware payload (Loki)", "value": "2c44f76d882e07be44cb97ff736b54aa2e531ec45c4ad2fa51438824665f532f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389645, "uuid": "6864b0da-e1ea-4142-8120-e1b39cb531ef", "comment": "Malware payload (Loki)", "value": "2398d29a7cd49968a3ea037821cf864579f20ce8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389645, "uuid": "c8003232-2e46-45a9-b0a1-052fb7b16ff2", "comment": "Malware payload (Loki)", "value": "d26e76d11e3f518cfaeba981bf2b3c14d6f954c9b5ad1cf0f4c1c9735b9ddf4d5a6b683f53106d96027078f05761b58a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389645, "uuid": "53d956eb-35dd-486a-a405-a2989178e28c", "value": "2B941242F1843B27ED13823549CBD7C973B6ED4AAB0A870FA205BB5CAE767215D12F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389645, "uuid": "7f24c9ff-0d2d-43fe-8874-fd9f9b877ecf", "value": "12288:SlhcQMEUElwvXxKDe2YqREMm1vRm3d+QxHd5NK:+XUvvXSe27etQ3dv9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389645, "uuid": "18a080d8-d517-419a-93a8-cfd073c790f6", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389645, "uuid": "4ec124ab-0262-4a94-a6e1-9752d829d4e8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389645, "uuid": "d553c907-ed21-4d0d-9c4c-6064cf7625ef", "value": "Quotation For Products.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0adc50-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423510, "uuid": "4ef0ffc4-4b0d-4da1-b6b7-b53ac7d54dc4", "comment": "Malware payload", "value": "79396d63f0d6b512f549c4eaf8a4b7f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423510, "uuid": "1b1a1cd3-ac0e-46de-8b60-0371075fe474", "comment": "Malware payload", "value": "2ca6de172e2ab820e486fc0aabfafbcf83b5c8efe01477785d969d6f6db2a6a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423510, "uuid": "c4e95724-d257-46ef-983e-6982f2c13651", "comment": "Malware payload", "value": "80a746d521aca5203bf1d716fafe8c9e096ed889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423510, "uuid": "3a7d3b7f-c959-4485-9380-2411ecb7c726", "comment": "Malware payload", "value": "716868f5e423b148d5b2b1c0c3027432ecda945e57a039c8257e78e39882c3d3f6310222ff6bdb89c05ba5038887e792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423510, "uuid": "d780c859-4bec-4767-839f-72baf656fce0", "value": "EEC23BB38C6A2D55DB48C1B4B0316F7E6B53E816AA831FBA452B85658403ECCF9493F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423510, "uuid": "bd6ab108-1137-4a21-9026-df56230c618b", "value": "768:EZQxexoKcAHZ2Uc1VRDJ/uT0KoOPC60mC15:EZtxoC2UgcQz6nC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423510, "uuid": "40c25455-c19c-44a9-9866-df90e64f1156", "value": 27444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423510, "uuid": "3d2f1125-97f6-4215-8edc-0f844f40a236", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423510, "uuid": "83abdda6-0ab0-4493-b514-bdd28a224baf", "value": "79396d63f0d6b512f549c4eaf8a4b7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d2a12a-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427009, "uuid": "b13512ec-0095-4dda-99da-fc4d6d3f732d", "comment": "Malware payload", "value": "c8674990dc43a0a5244725ba7deb64fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427009, "uuid": "fd933beb-86c1-47e0-b77f-711dcd88228b", "comment": "Malware payload", "value": "2caa6ee020aa9fcc69a26c957b5488314e3182fd49ea78cecf7632e76b9f2bb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427009, "uuid": "5d2431ac-bba6-4911-b9c2-5602e44f11b1", "comment": "Malware payload", "value": "f41915a385c9c28d9595f216d13726d08d038149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427009, "uuid": "08e4dfac-f291-4742-a984-8e54da9220a8", "comment": "Malware payload", "value": "37d30144fd22a5d0854a13c2a172676addd3a3b6dd6164d321d07fbffec4daa9ec131238bb748c677ad6a36496f5d3bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427009, "uuid": "8ea12318-f9c8-48a9-a1ae-fd0dc73605f6", "value": "1F2112FAFBBB9F16C49494790E6B23107320DC8C0014D26ABA717A1EDC566517E852F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427009, "uuid": "cefb32b0-3e6c-4536-98ae-157271006cc6", "value": "24:3bNlDq3N0yTK+59k588MA/OlhCrjSkvyeJ9lwA1oXsNTawqNs:XWVT3Y88MmDvJ9qYoXsNuns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427009, "uuid": "4b414314-48d7-4ed0-b138-30e2c15dd889", "value": 1280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427009, "uuid": "a7cddce8-a0b8-4b97-aa08-f2463ae53861", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427009, "uuid": "af2752ae-22f7-4d8b-8415-3af74fe841be", "value": "c8674990dc43a0a5244725ba7deb64fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b48ae-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427260, "uuid": "bce5c48e-fceb-4f5a-90d4-14b0943839db", "comment": "Malware payload", "value": "e9ab999b82c09a024d78d27fb4cb981e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427260, "uuid": "8dc771ea-e122-4a56-9d64-c2e2981cdfb7", "comment": "Malware payload", "value": "2cf5b63cf9678daa0f7d5650bac0f4b34359adba1a96edeb1cca8f2417f2318d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427260, "uuid": "218726b3-a0db-4d35-a0af-e2761d2a7d1d", "comment": "Malware payload", "value": "98c395173b32659e5ad94c046af26790f55745c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427260, "uuid": "158ab465-8e43-42a5-9725-30251563ba6b", "comment": "Malware payload", "value": "0f96f64fda8147080f3e301a781bf43f88db5065ff96e6b51fa4ae673158505dcc819f98041b90ab835fb8adb646a8d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427260, "uuid": "16de5de6-e6d3-4083-bea3-f6a41e235043", "value": "E803F100E0EB6DE4F9F7DDB769089980BF654F916AA2CB3072905F206E1291BE201ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427260, "uuid": "9c435957-c6ca-4cee-b383-96c1eb6af5b6", "value": "768:SRieVr7/7q9fot8ZjFsbBr1rmG9Rb6IqQ4uVcqgw02NWXmncC7CxY0ST:SRZ/YjGxzTmIqQ4u+qgw06WXmncC7CxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427260, "uuid": "a4de9e73-0755-4868-a51d-2cc63a7f7f72", "value": 40976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427260, "uuid": "33feac4e-f628-42fa-844e-d3c9a33d6713", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427260, "uuid": "7263a1f5-0e34-4bcb-8c1a-4d424baa1c58", "value": "e9ab999b82c09a024d78d27fb4cb981e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9bf8cf-cb10-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623455747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623455747, "uuid": "12eef085-1ffe-40bc-b05f-e425e9cf3c3f", "comment": "Malware payload (RaccoonStealer)", "value": "69d765043e07e894fcd3d0fb74cebbdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623455747, "uuid": "e525d16a-ac2c-4d64-bb43-31776ec44ccd", "comment": "Malware payload (RaccoonStealer)", "value": "2d07abc10994157494bad3b2a9d5181c040fd8e230a168d5b9d9aaf19390ab5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623455747, "uuid": "7dc776e1-1f43-42e6-8b9a-73f052e6c67c", "comment": "Malware payload (RaccoonStealer)", "value": "f5e76634fb0b90de487a7f7d8a9a286e6a67e1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623455747, "uuid": "8cfdacc6-f695-4633-b102-163c610e3182", "comment": "Malware payload (RaccoonStealer)", "value": "2d54621f5da479a9bca39bd3658153180e699151251f2a7efef69ab08bc57ac8106895f0c3b98ff2df70a912bedd13b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623455747, "uuid": "ae09914b-425a-4bc5-b394-af5dbf837ae8", "value": "B7A4011139BAC473E6A196B21934C674122BFCB58B2058C36BC5372E7F322E25B35793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623455747, "uuid": "9f408006-bf17-4de6-99e0-168a7d65f56d", "value": "3ecbda6de31890eaa5cd272ab1b192ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623455747, "uuid": "98ac1dc3-aeea-4de2-891d-5d4075dcbb91", "value": "12288:gCuv0jfIKJXU17kbzivVVymzWnYTTTcZCqkuR3h:gCu71kbebysWYTncZCJuRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623455747, "uuid": "6b2f7016-687a-47d8-b939-e4c0195c8a32", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623455747, "uuid": "73a4cf49-dec8-4a88-9d07-f5e175db8f34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623455747, "uuid": "293b6e23-48dd-426a-a10e-6cb9820e148c", "value": "2D07ABC10994157494BAD3B2A9D5181C040FD8E230A16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e00bf3d-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623426976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426976, "uuid": "36723faf-596d-470f-8ff9-7b15d426d239", "comment": "Malware payload (RedLineStealer)", "value": "6bdc02fe75d93a6db8ef7d5255a8950d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426976, "uuid": "ac9821cd-2d64-4b1b-9096-084a62994c90", "comment": "Malware payload (RedLineStealer)", "value": "2d251c910c029085593f93336c2d8cec08339a84c535751c1a5151169cce6057", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426976, "uuid": "48ba76ca-822a-4819-a631-cd3dba743e50", "comment": "Malware payload (RedLineStealer)", "value": "3d2b4e6e285a5e9bdc4a2dd2e283070f34aa8d0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426976, "uuid": "85b2654e-8b1b-4bbd-8d63-843e971dfed6", "comment": "Malware payload (RedLineStealer)", "value": "c478055b41bd06777ac436e59216e368ddbc8f7b3197a4d1d89e10c2a44b7f66a9919d498afc022a00c7868a6b57ec6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426976, "uuid": "4dbbae5a-ccf7-4e77-a085-a79b882425e6", "value": "A6358120B5680611D5615DBED1FA9E2689633CD31B6087CB014DFAAB3D3F1C68473BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426976, "uuid": "8d5d63ca-38f6-488c-b022-36031d34505b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426976, "uuid": "9ae3a02e-eae8-4f58-bf75-a4a122a23b41", "value": "12288:rKS6sxYL+kJmoPdVp6s3EJBjCvuF17+2NdJfnTW0n/T+QNWmgmr:osxwSoPdVoBjCvuF17+2NdJf7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426976, "uuid": "fecdc512-9bb0-4e90-9bc1-fc1a28d4c9a7", "value": 1138208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426976, "uuid": "f50308ac-60c2-482a-9578-23443df19d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426976, "uuid": "4d74c48c-2c15-49e6-be00-0e36f98fa0b1", "value": "6bdc02fe75d93a6db8ef7d5255a8950d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db172627-ca7b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623391887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391887, "uuid": "f789bad9-81a7-45f5-9ddf-df9879689bf7", "comment": "Malware payload (AgentTesla)", "value": "7792ed45165589f6518121b7015dc516", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391887, "uuid": "bc26726c-0834-48a9-9546-ba10484d471d", "comment": "Malware payload (AgentTesla)", "value": "2dbc1e319c840368cea5d83819feafbfaec855e245438e8e50105c464c422953", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391887, "uuid": "ad19f024-b3d5-455f-a90d-2cc288e518fd", "comment": "Malware payload (AgentTesla)", "value": "c0ce682e0f3561e3a7540c15e5cc08e69c0ab53a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391887, "uuid": "a135db30-85c9-4b23-9b56-79f4f3fcb72a", "comment": "Malware payload (AgentTesla)", "value": "f93162c511fe526ce1c6a085852739dba3b89c0880fe3bda18645f5607df7b3b3016296d8869f22bc3ce42054fe7928c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391887, "uuid": "cab62006-fb6a-4959-8cc9-b6c0b8e0ea59", "value": "9AB4DF103AFC5B02E477ABF55AF8A05A5B7A7A276921D21C1CD071CF4932F04AD61F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391887, "uuid": "e2da15a3-576a-473d-a0c0-40dc7710ecf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391887, "uuid": "67c3b708-3854-44df-b2bf-c3264054ad65", "value": "12288:jzuwEDaodkRgQbC89xGaFhod8iP+sW+W:jzu3eEkRgqCyaqurW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391887, "uuid": "69a1b93b-9488-443a-8f94-053d0f3852c2", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391887, "uuid": "49e5edf5-f1a4-4756-a160-dc18e6c3a820", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391887, "uuid": "6321bc6c-4bb2-4824-8ee2-19f33f83105c", "value": "Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9bfa09-cae8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623438620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623438620, "uuid": "68665b7b-48f6-4abd-804d-1ca5b951fe9a", "comment": "Malware payload", "value": "1b323fcf40192afd8c2d85acca658e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623438620, "uuid": "8a423fcf-7e78-46c6-b129-a1d31371a7e2", "comment": "Malware payload", "value": "2ebf28b25bd92fcb406458cae714c8740a3fa162e664ec66b404c06990bb5d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623438620, "uuid": "4a2efbf3-d94b-4517-aba0-51da1871445a", "comment": "Malware payload", "value": "57b9c62162a645602e8eb059272bbb8bfcff8d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623438620, "uuid": "f476133c-7a8f-4560-b8bd-1ef17a08802c", "comment": "Malware payload", "value": "b5f3bceb6df574754f01875d32690bdfb50fee60e011bb38f5a138d01b0201af46c9b6c3a2ec085faa39b55653036895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623438620, "uuid": "96c4512d-4cbc-4e0f-ae6f-344e453e4b82", "value": "29A402282BFD0A16E9BB5FF9A4D06641877EB1273B23EB5D054120964A23FC585C06FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623438620, "uuid": "2b88536d-0868-4e5f-b91b-eca6fdd5e2a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623438620, "uuid": "386f3ad7-975f-480e-a215-e5ecbd2642f6", "value": "6144:zq0f9rlcph/61jE7pGczlztrJ4ZU/yJq8EIGNv7kZ1G/G1b68anUtAMH+3ZrqP:zqu9Gph/61k/zlNHZIgv7kq8yUJHmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623438620, "uuid": "4ce2b9d3-6f05-4b35-9ca6-b5e8ca740feb", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623438620, "uuid": "e4aba821-dc64-40a5-a553-819bccd38c22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623438620, "uuid": "ffaee2cc-fd92-41b2-9681-8a32a2a50cd0", "value": "shipping documents for PO#813-25319 192-463-56-265-3327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1481e1-caf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623441930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623441930, "uuid": "b4f31243-39fe-4d20-ab4e-fc906deef579", "comment": "Malware payload", "value": "a9c875d6d25bf1320276e04a1fa06dec", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623441930, "uuid": "8343ed41-aad0-439f-b83e-f9f1575d9382", "comment": "Malware payload", "value": "305e4219ba882107a71ffdef329c5daa7925e5322907cb669471efb0c8009a54", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623441930, "uuid": "895bc7ef-d16b-4063-9454-9413acef5569", "comment": "Malware payload", "value": "45ad54f83c136fd3250d44afd661676caccd990e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623441930, "uuid": "fcd886c0-408f-4605-ab7c-1e95f9c84b48", "comment": "Malware payload", "value": "18e07b7162615ede21c5591dae17b08b1a63f8707fd8555acf726c435af1fadff47151777aa1f3542cf6ac50ee251fd9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623441930, "uuid": "93e02645-0200-4dc8-b08e-8f8cc7b3e414", "value": "DEE58211927239DDEA67A2BFA1AD4FD18511F4F0E119EA2B333C2BA49ED121931F3543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623441930, "uuid": "3ac46911-9a2d-4655-bf23-c0bff6da027f", "value": "49152:mnZX3Y5AJcjUZhGoHVGB6rO/Whw3B0MZNvAS9M5/MI:EY5AqoseVdKWw3BLNvFCVMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623441930, "uuid": "a7f68fb7-3890-4352-ae24-ea3c3c0e0fe6", "value": 3133440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623441930, "uuid": "16e2045b-936a-4d62-8d8a-80b7ba6eb796", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623441930, "uuid": "414497e3-ca91-4368-a04c-efbd6ea94747", "value": "seudebitoconta8765768 qy9qfzoh fhid37.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0ec33e-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427031, "uuid": "cb859463-53be-45e2-991f-51e699d59f37", "comment": "Malware payload", "value": "6d7147bdb5dc7a6ed0a39dd1847f91b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427031, "uuid": "26558bd2-602d-414d-bb82-0ae2b4979778", "comment": "Malware payload", "value": "3101bf6bebf610b365cd93b63e235be2d70075391db2feab527055a79c86d4d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427031, "uuid": "4687d64d-0ae4-4339-b690-5e012078d9bc", "comment": "Malware payload", "value": "73aa51fa1bf98d11cc261fd18ef449701898f9ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427031, "uuid": "16621848-6561-47fb-8993-6c07bc9f2222", "comment": "Malware payload", "value": "0ae31abcb826de29f086697580fb57d171b82caca53e1eb51f54798278e8c694fbb0733c6646e5d11c7775b052d5b20f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427031, "uuid": "e24b1463-0542-4829-93cc-9d344dfb9a39", "value": "BF41121A6F901F33DDB7CC36454A2B513ACC842B616623926334D960BD3E645E7D38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427031, "uuid": "324a84c8-5795-4eeb-a83d-ad766a4b17ae", "value": "48:0Q26nuDa2l6df9G+SMTLWPkeTRooXzFaXp:0Q/numxf9LSoLW7TeoXY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427031, "uuid": "ccc7208f-ddcc-430c-aa99-d9ae4a21e5cd", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427031, "uuid": "bbc173f3-7032-492e-a1e0-e1a75d53fec6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427031, "uuid": "38c97ade-de70-4f09-9ff5-f9301edbff5b", "value": "6d7147bdb5dc7a6ed0a39dd1847f91b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c83008c-ca8f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623400371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400371, "uuid": "add2dbf0-8071-4901-9c4d-3988703ddfc1", "comment": "Malware payload (AgentTesla)", "value": "ee4b5d2d220b8b925a84755e5ad9fa06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400371, "uuid": "7ca03135-b50a-4759-a6ea-963968ceca93", "comment": "Malware payload (AgentTesla)", "value": "31e702dd0fc8ae15e8ca4991263c135709a1d64cda293a4896f89ed3b3699b77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400371, "uuid": "348b76d7-60ef-46b9-9e35-b7b4f2a80abb", "comment": "Malware payload (AgentTesla)", "value": "4bfa8d3abf280cca85905ce083fe4446ac1d4862", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400371, "uuid": "6e7db8ca-ce29-436f-a050-421b2cdc7c8f", "comment": "Malware payload (AgentTesla)", "value": "55824cdea32414a274a30c42b673745e16c4d5580204467860abd58fe36dd82b04ee72fcf56ee1616586a2f4475181bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400371, "uuid": "5d4e0340-f8d3-4ee7-8144-b529e8a66fe1", "value": "CB75BE1062409B10D13987758C23D6B04FB0AD0DEAE6CA4E7DEB7D9F38717B15A2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400371, "uuid": "4c6b01f9-8376-4ff1-b894-d8ee815a0e6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400371, "uuid": "e20fd6f9-7a78-40f0-ab2b-4e68aee9146e", "value": "24576:5ONeBUdtwsEgwsoe/z8YEoqSg5LlJfH6zMIDsxTt8nUhqF+39k6aq0+imRIyY/r:EwBUwsEgwsoe5U/BldO/jFyHaq0lyIye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623400371, "uuid": "d5fa64fd-0786-48a7-ae05-43e435700e60", "value": 1552896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623400371, "uuid": "9fda28e3-4865-45d7-b796-7b8dad5f9a6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400371, "uuid": "bbddc6ae-aee5-46ec-8d17-2f35b2033c9d", "value": "Minutes of meeting June 9th.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e25204-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623426982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426982, "uuid": "fe21bc20-7f93-4d58-ab44-81ad35d0a28c", "comment": "Malware payload (RedLineStealer)", "value": "d62aad019ac19432a4e859684dea793e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426982, "uuid": "c84a7869-7d95-48b3-aaae-d30eef486848", "comment": "Malware payload (RedLineStealer)", "value": "323673b5ac7a95ea53f2a38c8c7d51206caf1fe95dc8c4f17c4e629154b2f607", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426982, "uuid": "0cdb8b41-2115-466a-8bd2-bc2b66b44d54", "comment": "Malware payload (RedLineStealer)", "value": "1147a28d63d1fffb2e21fbd9ee6028465ca78555", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426982, "uuid": "803a09bb-207e-4bb4-aeec-e27e9c31e990", "comment": "Malware payload (RedLineStealer)", "value": "8af5772b5096243a94fdd4526b2df867f4adee4d5318471919cec53c50ec6d7e3de8fb2bebff8bf8285f5eee16732840", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426982, "uuid": "bac26295-9af5-43e2-b4c8-4585a2709e61", "value": "C594C74E3A56BE06CFFA2771C0DF05254374DE82A532B3D63EA837B809573725A492C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426982, "uuid": "78f60b2b-8db8-4ef1-8ab9-831252a3d165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426982, "uuid": "50a6a528-88a0-49db-b349-7766a4512576", "value": "6144:0fvDxqjEdO3z/Aj2SwjJxNbuDsXX3qyO8ED:idUNbuAX3q55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426982, "uuid": "2e7a9276-eb47-4201-bfc3-c567e2e6388e", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426982, "uuid": "a8d75393-c00a-438f-a31d-aea7faeffc7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426982, "uuid": "2d0abd88-a898-4877-bddd-e28271fd8c87", "value": "d62aad019ac19432a4e859684dea793e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bfd283-caa7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623410510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410510, "uuid": "9572531e-7b8d-4ab5-a391-2c5815305572", "comment": "Malware payload (Loki)", "value": "05633a5603cea9df40f2a362793d27e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410510, "uuid": "402d7c7d-822e-4b68-970c-599d5230502b", "comment": "Malware payload (Loki)", "value": "324a7365d467827269039abc22096ef44452663f691bad87f0a45252708db587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410510, "uuid": "97d6e5fe-c651-4f2e-af17-4ae5782268e7", "comment": "Malware payload (Loki)", "value": "4320eed1773e22203531f5196c2ba6eb6e406261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410510, "uuid": "01ffd11b-667b-4c00-b363-13cc9db08c5b", "comment": "Malware payload (Loki)", "value": "878fdf2d1d60bba448f12f231af735bcd83870a4b27e973d18c794dfadcb8cb1f1c46128404571277a336fbe50473a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410510, "uuid": "b6fb0054-245d-46ef-8774-76096216bdbf", "value": "F9B47BAC365079EFC81BCD36CAA81C64EA203467570BD207901725ED9A6DADBDF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410510, "uuid": "f88a38b7-f8d6-464c-beb8-7d1f22c43212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410510, "uuid": "99651535-7709-43c7-9d85-ce552901ec9a", "value": "12288:OYUBegt4E/0SRnA0mtk2BS2Z+dUa5KUYRZlJKuKOb2az6w5pXG8Y:OYEr4E/0SRnvmtkoS+Ra9CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410510, "uuid": "7ad22bb2-2852-4d7d-bc54-776588de89d4", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410510, "uuid": "af8b59b0-ebb6-4e22-9422-d019dd8f3802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410510, "uuid": "42d07190-a171-4aa3-80e4-62706b5a9d71", "value": "Hu4JBGUQLs7Xh7q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904d3675-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423544, "uuid": "697d6a91-d806-48e7-840f-c922ecdcfb12", "comment": "Malware payload (Mirai)", "value": "221258393d5ff636fecfe01ede20ffa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423544, "uuid": "1b5e8cf3-dad7-4315-aa8e-3090f692b914", "comment": "Malware payload (Mirai)", "value": "32adc7a88b25d07d78654b3e17154f0b924b1b27df14751dd55dc9d084dc6712", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423544, "uuid": "aa7246bf-5d71-4b26-b723-0e63a97c6817", "comment": "Malware payload (Mirai)", "value": "91de8d8cdc5802903eb7a275a49ab550e5bd9a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423544, "uuid": "a687b535-d715-4738-bb04-29ff41d9b948", "comment": "Malware payload (Mirai)", "value": "480ed9c490d8b3155e30e04f91a4741021b71807106d147b38ad964570299edd2198d93192aada0f7ea76eea1f0d7440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423544, "uuid": "8b30ba50-e26e-4f8a-8e39-4fbf6b113024", "value": "B3A3BF21C528ADA8C0354674F5D08D354BB3B40952532EFBAA97C26DD097AF8F06A7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423544, "uuid": "665ff80a-6092-4305-8db4-425479c6f47f", "value": "3072:W64ABNKC5RyiSg0SANcX0/7B40vSRxFd:WaBNKC5RN0UXM7BFaxFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423544, "uuid": "63eee681-fe94-466b-8b83-13f5933c0fab", "value": 99712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423544, "uuid": "d5c467b3-e4c0-4bc0-9da3-af549034eaf1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423544, "uuid": "94c71339-b362-4370-bf06-3c39c28ddb99", "value": "221258393d5ff636fecfe01ede20ffa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf17fd1f-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423622, "uuid": "c9ecfc90-27c8-447b-a46f-cf582f72f88a", "comment": "Malware payload", "value": "56b4f6893870648483a350e1d9e3a0d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423622, "uuid": "c0d5e9b7-2d96-4144-b52f-9f8554780c28", "comment": "Malware payload", "value": "330dad334d085678689ddadd7ea67c37be80dab7b0b85cd106f17d8fd883cdcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423622, "uuid": "a421e5e0-ce9b-4084-b578-a6d63fd85c20", "comment": "Malware payload", "value": "9e8d31d19ce2856306b50eb2c1e3b02d7819c60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423622, "uuid": "891dea2e-e796-415d-9670-a4b71c7586f3", "comment": "Malware payload", "value": "30a1ae2b7f8bf0cb5733d04057c123c7e28d9b3d9882cc17af068ead12ba81266b7904b2caee89b999a4c65d43351dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423622, "uuid": "9ff5eb62-c44a-4d24-b972-de8b04015c73", "value": "90B3E857FB11CEB3C85FDD730AA68A01108DA99756D57B6BB3B4CA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423622, "uuid": "977957d8-f765-456b-8eba-7af01b7d3f1d", "value": "3072:UmJnlmfYvJMUyNh45h1zKdwwjF9GhsR1Ae:NdJMUoh45h1zKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423622, "uuid": "49170f62-dc26-44b4-affc-2485f6927a5e", "value": 116663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423622, "uuid": "1d621e0e-ec4b-4ac2-bf81-963409948c5a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423622, "uuid": "55138f5e-5b8b-45ad-9266-0233a34b6ab8", "value": "56b4f6893870648483a350e1d9e3a0d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98322ef9-ca97-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623403800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403800, "uuid": "db1726b0-4fa3-470d-9a78-dd56985bb3ea", "comment": "Malware payload (Quakbot)", "value": "5a6e614b4c79041ede71dc56e9d4523a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama58", "colour": "#24E6F3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403800, "uuid": "dc3d4a96-e776-4c7c-a914-d650f39e3857", "comment": "Malware payload (Quakbot)", "value": "338b41182264fbc390c82f349f934242f85f2adcd82e37cc064855793abc01e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama58", "colour": "#24E6F3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403800, "uuid": "3aef5070-0c2b-4662-9990-a9e6554f2d32", "comment": "Malware payload (Quakbot)", "value": "d30cd8392133d35d11704d2a1556a4572078fb0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama58", "colour": "#24E6F3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403800, "uuid": "f1025f87-a1c5-4219-9092-c9891a922f1a", "comment": "Malware payload (Quakbot)", "value": "7676cef8e1714db755f574a470f7ef39dee600d5882f506b2f336f5448abd5b0f6d29e07dc94b2d0649d196888e99cbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama58", "colour": "#24E6F3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403800, "uuid": "c522a4a2-d653-42d0-b533-3e5f488bafc8", "value": "8295CF01BA85F836C52859358F95E6F4172CBC588F691A4F33C85FBF3E6E1031A1936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403800, "uuid": "2b1b7419-e2b3-4ee1-927c-e141702ff780", "value": "ba8056ceab7f94ecdc81f7e22634ffa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403800, "uuid": "354c7306-56ee-4a81-b03a-a335138c9627", "value": "24576:sBMet/DwbBYmn0d6HKJjoJuCY0YPLSz+nchhQRGjKNdZP+JKLj:sFt/DHc0kHWoJpILMrQRGjKNb+JKLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623403800, "uuid": "4e4315d2-8597-4ac3-bcce-4e33434b9125", "value": 1936384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623403800, "uuid": "235a3833-2917-4fe9-ba45-b507053376c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403800, "uuid": "0b24b254-9bae-4f5f-a367-55a50adbc36f", "value": "hret.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a031b57b-ca9c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623405961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405961, "uuid": "59f3a65f-1cb8-43ab-8f0b-068ce637f065", "comment": "Malware payload (AgentTesla)", "value": "d712c2d654c2e2a11342c5ee34eaf482", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405961, "uuid": "bc9806b0-2cd4-4360-95cd-4fd100e7bacd", "comment": "Malware payload (AgentTesla)", "value": "340daf824203c0af3cc67314d3b4b5c49d30ee8eb299f49756cf684cef2cf690", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405961, "uuid": "5f994019-a248-49cb-83a2-89b60a7f2f33", "comment": "Malware payload (AgentTesla)", "value": "5fd97f1e7c045a70603074edbb8c9457ae367cec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405961, "uuid": "e6ba9c82-9da1-4b50-a4e2-6da29eb4b277", "comment": "Malware payload (AgentTesla)", "value": "f46db01949d73b487af5cc39057d052f173349c03edc2954331d9ebe706c87b277e33105bb92137a5d4614294e9acb89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405961, "uuid": "8c6e7773-9396-4720-802a-55e9c5a5f1a2", "value": "41A4EF007BFC5B06D4776BF559A8B0499BB6BA236921D21D1CC131CE9932F40DEA1F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405961, "uuid": "7876904b-d51c-4b71-9fba-4618b875a5a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405961, "uuid": "bf0695c0-4205-4e82-9ef7-780adda535b2", "value": "12288:u6/ikL8DKh4P35aCX8++vevzxAw4XW0q03w4GRbs8ekbB:u6/tL82kdM++vA6w4o4Cbs8ekbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405961, "uuid": "d0f661e7-8c28-4d3e-a2b1-a05746096c5a", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405961, "uuid": "a4b92f32-bc26-4ff9-bce7-da7662deb47a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405961, "uuid": "37e3134f-c2a1-4103-9359-d195110ec0d4", "value": "1301367336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a245c8-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427237, "uuid": "1696ccf8-de47-4566-b98e-c128819034bd", "comment": "Malware payload (Mirai)", "value": "8466e52f1326dc2cee35a2b420710042", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427237, "uuid": "61ae1dfa-7fcd-403c-9af8-a68c3267553f", "comment": "Malware payload (Mirai)", "value": "346d49f539e31f1caaa102385742761e4f8fbc8e7e0e9981a018d79cd908c6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427237, "uuid": "85cf4e86-485b-4666-ba48-4829c1cfc63a", "comment": "Malware payload (Mirai)", "value": "b07d377bafbf42659333d2d1c6b450a52b5ab6d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427237, "uuid": "7d2c240f-cf02-40b1-9d0c-e764e5b1a88b", "comment": "Malware payload (Mirai)", "value": "ad0fd177a60ba1f2ff819693892df032b99b8e21c506e7ec7c329c58046ccd0d71985d8aa3f0be797c1bb45f0a92c18d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427237, "uuid": "745bd3a4-62d1-4a95-807d-04f09a37ff59", "value": "A503E132C4F10603D387133A9CFEB7090D28C71B46C5F797ADA47E4BA159BA92E29D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427237, "uuid": "3e451275-8b1b-454e-a10c-3699ac77018b", "value": "768:uvwDSK/o12ZN8bCYU3lXxX/Mx6GSNO1RrGzH6u2qzpDnbcuyD7UHQRj0:uvwIoEbrU3tlc6GEO10auBzpDnouy8HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427237, "uuid": "b17e832e-68c6-4a1a-94c5-da9ab3cdc9ae", "value": 39760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427237, "uuid": "a1cf35a5-26cf-423b-9e2b-c6d673a413ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427237, "uuid": "7848ac06-515d-4645-b24b-e032c9091e56", "value": "8466e52f1326dc2cee35a2b420710042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073222e5-ca77-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623389813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389813, "uuid": "a621e347-3100-4620-9298-e52cfde3a392", "comment": "Malware payload (njrat)", "value": "945dfb281b652320e2e0088cb034c594", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389813, "uuid": "023fabf4-075e-4fc6-9bee-3de293aae5f5", "comment": "Malware payload (njrat)", "value": "34cfdf725ac134e2b2c71b220d4fa7c66afa34af0f0efbbf0742e52f08e0e7b1", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389813, "uuid": "6b3868d4-5033-4aee-90e5-bff2dc640dbd", "comment": "Malware payload (njrat)", "value": "1f265e9521f3d623d56796bca6ff028791db7e9f", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389813, "uuid": "8ab5f890-5863-4975-aafa-4c2c4ac7fa69", "comment": "Malware payload (njrat)", "value": "0a488ea793d7df59ea1460acafa86fc3a1185b88760432a070245ab809ac1b3383df8d2371ee811bfc430bc699b3dedb", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389813, "uuid": "78338899-f4f5-4648-8b0e-defc2952f537", "value": "FB753301A396CF43DBBE19B692D3D12C814F9D043B54CE6D25BDBA86A2327D403C7B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389813, "uuid": "481a200b-6f73-43d5-9959-fb255b2baeda", "value": "24576:1AXrSqtseyCZ0RRUm1RyMqxIBOeaRQNSozswfn9bDQ57JWpl4RJ4+NJLE1uvJC:QrSqee5SSmzyZxTVSwogya7AlyZJLfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389813, "uuid": "302b1cbe-caf1-48f9-a3bf-5ad1ed280a20", "value": 1690168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389813, "uuid": "f889649b-26c5-4bf6-852b-de6ed5e039a6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389813, "uuid": "8dc09aa1-d119-49e2-93b0-1545a13805a1", "value": "Descuentos de hasta el 40%.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81322626-cac7-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623424377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424377, "uuid": "cb02345a-6eeb-4010-81a7-4aa977610cc9", "comment": "Malware payload (AveMariaRAT)", "value": "c288afa652187f51cd8a51225403b371", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424377, "uuid": "3419d821-8177-44ed-95cc-65c4deb4892f", "comment": "Malware payload (AveMariaRAT)", "value": "34ef4f8cfb814da5aeb5f3181301976e3622470fd9bfbfec8c016e7eed215d8f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424377, "uuid": "7ba0a90b-f74d-4dd3-b061-1a925eda0e26", "comment": "Malware payload (AveMariaRAT)", "value": "47da2c2d1f08cbdfa92576588f466b59da5645cb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424377, "uuid": "8711238a-d8f1-4df2-a6c6-1dcce46c5a8e", "comment": "Malware payload (AveMariaRAT)", "value": "cff551fcec98cab39b5ad195076cc5602693be4cfbd0e3a629db22cda4077268e78a367fbac430fa38525ffab243879a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424377, "uuid": "e9af8d7c-8ded-42e4-859e-565abc670223", "value": "CB64129729C09A5FD1634A744833588DD3B76F163E745A4F9F14BEFE133A2C26607282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424377, "uuid": "81083184-e35e-477e-a9f6-214fcaa746dd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424377, "uuid": "b71ded33-b759-4e62-b882-4961fd13f484", "value": "6144:SsTGoaQ3nNXOOE58NsvcLf21L0PVDTdsrohuJRq6IMgYJDqf:IoaQ3N6523T9DmMQJRq69JWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623424377, "uuid": "051e257f-1ccc-468c-b633-55e31dfd2113", "value": 315566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623424377, "uuid": "9d8611a6-31e5-462a-b54d-935de017133a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424377, "uuid": "ed523dce-2329-4515-8ba4-7fdaa0a654f6", "value": "PAYMENT COPY-20211106_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cb80d5-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1623423494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423494, "uuid": "806c8e36-2af7-4fd2-bc52-d6eba0d94045", "comment": "Malware payload (ServHelper)", "value": "20f307c716a689f4afa3a76b7143db22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423494, "uuid": "09256bd5-cf30-41c7-8bc7-1fb84b7dc981", "comment": "Malware payload (ServHelper)", "value": "3647e2dc4336b2eeb828371821c706a329dce645cb16f9c1c31c3faeae8f56dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423494, "uuid": "dea0f48e-cb74-4105-ac35-5279a8d548b9", "comment": "Malware payload (ServHelper)", "value": "2fd6796fd158c93b14654240533511af6fec03e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423494, "uuid": "1a35b303-3ad0-477d-90bf-a6659c380260", "comment": "Malware payload (ServHelper)", "value": "fa3719fbc978054a80fd979759f2b6605ccf3853f46e138f2d7f9d97acd31ac0e4f491b54ff684fc5f95280318a170f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423494, "uuid": "1b563f2c-44e2-47f5-a6fd-006cdca23ce6", "value": "3256F011BCE218FAC57AE170845697617A313CA483327BE72F94B5A91EB5BD02F3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423494, "uuid": "08479ac5-149e-49be-9155-93735ef35aa8", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423494, "uuid": "4d31e76e-a6cc-4d0f-89f8-63b6deea3baa", "value": "49152:gJZm5w1U7yC5Y59whp6IRNCjm78jBtrUQWT6726n4lMZLr5jJTMVmiKpN+UL7Jmw:gG5w1Cyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423494, "uuid": "e92dfe6d-8812-4dbd-a246-ded788e0fcc4", "value": 6323200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423494, "uuid": "28afb2de-aa62-40d6-b99e-7dd7fa688efe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423494, "uuid": "b906083a-056d-4657-bade-0753ce3e262c", "value": "20f307c716a689f4afa3a76b7143db22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9772c8f1-ca97-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623403799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403799, "uuid": "f1fba3cf-9ac2-4a10-825e-2051d0c98cef", "comment": "Malware payload (AgentTesla)", "value": "67765681f9b529bb58a82bcf0af78b6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403799, "uuid": "e8e4e7e0-5e4a-4bc1-8d8d-05100b5611d5", "comment": "Malware payload (AgentTesla)", "value": "37fa514013307c5a49d68d1af2a488ad2664a0ee005594136faecfdc535f59b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403799, "uuid": "0a05c333-22b5-4f0f-9395-d404a7481404", "comment": "Malware payload (AgentTesla)", "value": "b6301af9e62c232f0c02a3e8729995488249421f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403799, "uuid": "fe7d602d-190f-44e8-80a0-8fbb2c0942dc", "comment": "Malware payload (AgentTesla)", "value": "3897f2b019170677adf933a381a6f5cde88c1ee865eeaf5cf0e46fc008a5acbd1c6de504da78a4c921814e8376bb4597", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403799, "uuid": "329dd531-6e7a-411b-a091-8b4ad155dbcf", "value": "32E4CF22B2F453D9C53AABF46E65F0B05B333E652010E12EA9D4BCCF39797121862E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403799, "uuid": "21125ec5-f9d8-4c0b-8f5f-79ee065e3758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403799, "uuid": "05040690-d251-4d31-90e3-e908b2de259c", "value": "12288:QL59Fd1LIfZJrE/H6p5zqJsUxpKJEZN5DvUOL+nzg++++4+++++++0+++++++:QL5979IhJo6fzWsUTKJEZN5zjA8++++n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623403799, "uuid": "5c7de109-d60f-49d0-b6bd-6609656328d7", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623403799, "uuid": "4d84f5b7-30b0-4fda-a246-6e5bbb003119", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403799, "uuid": "57682c40-75a7-42f6-ba5a-a04231bc6c5d", "value": "Bank_payment information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fc914b-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423521, "uuid": "0fecb2c9-6182-4909-9b0a-19175994b494", "comment": "Malware payload (Mirai)", "value": "190a61dcee53c364dae8ea2fee5be9e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423521, "uuid": "4d721711-c2c3-490c-aaa9-27101e5c732b", "comment": "Malware payload (Mirai)", "value": "38b483fc7c0c1589e022e10171d3b36013cd5a040bcefafeedff6270868c5f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423521, "uuid": "17d0af95-6071-4db7-bf60-46228784c15a", "comment": "Malware payload (Mirai)", "value": "6ebd993d058adf3a8fbeec229afcb9e82ae1864f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423521, "uuid": "25033300-025a-4cf0-9dda-0c740e2eeded", "comment": "Malware payload (Mirai)", "value": "3723a395bd6028b49d95c431953c63164d466dccdd7631bf025fe2d78cd0b440760433b057ac1e27c53c0dd329138b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423521, "uuid": "e907d00a-9c45-46e3-b8bd-77208c2ce9ec", "value": "D213F13643A14D3179B18C7AEE6F6FC3234557B860D933915065087C5EA7E0BA2ED32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423521, "uuid": "77ae4992-18ab-4452-94cd-d457456f961e", "value": "768:h3dS+1aT9BJMAarLubnrw8hNnEVxS8yb+UoK74Zaq7aq6Nfczs3UozM:tdLUCLubrw+NnEVxS8yb+W4L7vlezM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423521, "uuid": "026b6f11-7864-43e1-8ba2-638b76204953", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423521, "uuid": "55a08422-77d4-4bae-b301-ad0ad738d46c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423521, "uuid": "3b704c31-55f4-4ab5-a60e-9d66ae05c7b1", "value": "190a61dcee53c364dae8ea2fee5be9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a2ced6-caca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425464, "uuid": "3eaf32e7-6c31-4a93-844c-8900c7762d13", "comment": "Malware payload", "value": "4bed8f5ad07e28fe40cfab4151686a37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425464, "uuid": "8131fa5f-1119-4cbe-b764-83823ebf4f45", "comment": "Malware payload", "value": "39bddb4288320c165bdd43d0d9ec778b128223e35ce0aa27012e3d9497dda29a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425464, "uuid": "587610b2-b875-4389-b3df-6f71447e5b1c", "comment": "Malware payload", "value": "9673e2a5dfad256bd80cfff4cada4addc8ada239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425464, "uuid": "18699969-a5e7-442b-83c0-ff16c3b8e7c7", "comment": "Malware payload", "value": "2f189f339fbf3b992d458f5608b951132221e5b81ca0d3e614062b7b54cdf1d1ba3fdf3622f4622bae90d58d24409868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425464, "uuid": "bf045d70-d3bb-41a6-9eaf-7465ac52a201", "value": "669339277B230E23C0CA157112E30732EBB5D65938B99397B9D07DAC2F16AC439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425464, "uuid": "91008296-29bb-4915-a542-1b20096bce30", "value": "1536:ET+/NTMBtNl5Gtlr679l5M4+IZjxn3mXNFPXsCRfPiX:XNTMBjXI++IZdn3mXNFPXVRfPiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425464, "uuid": "1e9bf51e-0d9b-40fb-ad03-0a3e6530fa96", "value": 95372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425464, "uuid": "6e11bb5f-b9ae-47c5-8200-2abb2ad3f92a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425464, "uuid": "20b07dff-a24b-49c5-85c1-e098bbc03cbd", "value": "4bed8f5ad07e28fe40cfab4151686a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f689785-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394202, "uuid": "19ae229e-d08b-467e-810b-7b67025a19bf", "comment": "Malware payload (Gafgyt)", "value": "5bbee16acea9efed2d1c70706b661e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394202, "uuid": "a8dc8c63-f786-4d9d-899e-9d5595cd85cf", "comment": "Malware payload (Gafgyt)", "value": "3aa53b4a603bfe914323da18319de2672165ff0a2e1a7ac125d43ecadabb06af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394202, "uuid": "6a6072df-90c4-4053-985f-a689d5eebfb4", "comment": "Malware payload (Gafgyt)", "value": "04c29d0266d77734d422c42bbee05230ffb14d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394202, "uuid": "38c2178b-a014-4732-a6a9-d75d993c24a9", "comment": "Malware payload (Gafgyt)", "value": "28b5db00fe058bf6fb207110cc910899dcb5b8e1de89d48e6fdb58057fe2e4f762bcc92b651c6c371533b1b9ef155a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394202, "uuid": "f7ab2dc8-3378-44ea-8756-00fbc4ed7417", "value": "C8B32801D5508B27C2D2277AB79F825D33232BA897DB33165A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394202, "uuid": "712470e8-0c18-4a15-a664-47d9ac80a92c", "value": "3072:wdA0a++h8tZ2hWJloMfDq9jBy/bmTQOWsXAOn:wy0a++h8NoMfDqgbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394202, "uuid": "2b0771a7-b26c-4052-8d9a-7c4ca82fb668", "value": 111528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394202, "uuid": "286c763c-4b7b-4a4d-8f7d-ee41a6aa52a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394202, "uuid": "c5b110a2-199d-4bd5-8360-3dfc6fa8bd9e", "value": "5bbee16acea9efed2d1c70706b661e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf1d03b-cab7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623417715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623417715, "uuid": "44e286d3-5ab9-4ef5-adc5-e701b704d1dd", "comment": "Malware payload", "value": "f76f1089e5298be1fb8b1f1ad9accf04", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623417715, "uuid": "e778cd94-a6eb-4c34-99bf-41e5d879696e", "comment": "Malware payload", "value": "3bf1de1dae432d0cfffd0dbe12e9894ce70b5b6de26cc598c8b6ded15e3019c7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623417715, "uuid": "6db66ea6-981d-403f-8e5c-2d741a7c3012", "comment": "Malware payload", "value": "01a635fda9fa70f25301724c147a90c97bc55393", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623417715, "uuid": "b4b6d729-96a5-4761-ac90-25a08db81e87", "comment": "Malware payload", "value": "b8246497a0b3f0c646d731d667b1c8d9e387acd5fbfb99e31d26b79c1841d2bd5d82fc3c217796ea8bce0fcd5bbbe1b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623417715, "uuid": "1be63338-44e4-4fd1-ad18-43c0dafd1fcc", "value": "19E2F295E38F4E64DFCE984B3256C3826732EBA2008949C6D31F8C3F571656B7E49D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623417715, "uuid": "3994c4a2-753d-455f-a8a3-87acb7f35cf9", "value": "768:MpQWN5p27HiMLGLM17AnW2thy9/A6GHgEQhUB/kFR3XXq5d:LHinQuWoyOTA3isFR3qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623417715, "uuid": "90f42fd6-84de-4b7b-8f48-fe68a1a427dd", "value": 31580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623417715, "uuid": "86780418-f70d-4076-b5c0-f73bf3d4e465", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623417715, "uuid": "bf8865ba-5eba-4835-a785-9a6425f4504d", "value": "f_000010.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e9463e-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423528, "uuid": "3a6ed2f1-0c35-4aa9-adfc-575aad4ef7d7", "comment": "Malware payload (Mirai)", "value": "039ce09bc7c5e6ebfe51aa4714947e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423528, "uuid": "c52d0f51-8654-48f4-abc7-fa1623e2bb4d", "comment": "Malware payload (Mirai)", "value": "3c5b928a37843c17dc4226e92394b36aa9ce05f6e59597544121614fe674bf6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423528, "uuid": "e53cead8-0a83-409b-a05e-454842249f65", "comment": "Malware payload (Mirai)", "value": "bff5c09ec762a7b1fed2e1c016bf8f7361709c91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423528, "uuid": "19bbd066-9690-4259-a0c2-f0a4cfde40d7", "comment": "Malware payload (Mirai)", "value": "0ca6fc1d04118ee4d16f41119667967f32b46f70151783d255f9e96cae099dfeaa0a3ffe5866db4b516e093852ed408e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423528, "uuid": "0ed8c2cf-1996-4329-8ce9-12fb09808261", "value": "3223F1D160EB05738A305D35CEEE609F234627FD44B77522B08146688EE98D327B9EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423528, "uuid": "ab28dd31-4543-4e35-b013-2685e51c9a7a", "value": "768:mqKJK9stxb+OKLq+GkXCfPtboVIyriR7QLqBEnRzJR9vFQ+NEawPm9q3UEL/o:V6x6bqFkKPUBiRLanRNN3NEawDLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423528, "uuid": "15e77724-71e4-48f5-99c3-e8fb288177f3", "value": 45768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423528, "uuid": "7f9ba39c-ab02-4393-af05-06e37f0fd1bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423528, "uuid": "e797b8e8-be0a-4321-9df2-3f5faa86da07", "value": "039ce09bc7c5e6ebfe51aa4714947e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07deca1-ca6d-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623385883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385883, "uuid": "26b275b5-270f-4612-9ea8-234733a7884d", "comment": "Malware payload (AsyncRAT)", "value": "722603aa75534bec9d1191f062fb2c03", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385883, "uuid": "c7ef5d43-b1d2-4103-aa6c-e4ed9dc7aa6c", "comment": "Malware payload (AsyncRAT)", "value": "3e7cecddd88f1fdc8eb055ef6ab1eacfadb706582cb0fe190d99e493baa78691", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385883, "uuid": "456db7c0-33ca-4c31-8990-62942c856f68", "comment": "Malware payload (AsyncRAT)", "value": "321ea5aa8368f394dcbdcc6ce7ebaab89861150d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385883, "uuid": "8f6dde4e-dea1-40c8-bbc1-068317571a55", "comment": "Malware payload (AsyncRAT)", "value": "1b2d566fd49a6ef0a4d3e2c00458c9eb8dc5f45c9aefd77084daa22acc5b2fc2dba2cc089214fa8530ea0e2ebaac8b0d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385883, "uuid": "e15c8631-f2b2-4005-b0d6-ec262f0e5ccd", "value": "2F92EFC1B67EC226DD910B31CDA2A5B0357ABD02BB2E0DAB35F2F2FF36655012551B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385883, "uuid": "b490ec8d-dd9d-4c4a-be92-10b1e90981dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385883, "uuid": "8bd9f8a0-5b3b-490a-86ca-693115add906", "value": "192:9DPhbcIbsHy0369P99j999M99Du999W999969999939999p99999799999A9999L:9DZcIISYI3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623385883, "uuid": "4482139f-edb5-4346-a2e9-bc22d100a2f7", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623385883, "uuid": "434a9720-1769-4fff-919a-b3c34a48c6ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385883, "uuid": "ba1b06dd-c278-403b-a5ec-415525cd2627", "value": "722603AA75534BEC9D1191F062FB2C03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9378997e-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423549, "uuid": "d63a044b-b263-455b-855d-25ebbbbd92d2", "comment": "Malware payload", "value": "8b8e29e0c47fea574d17954d41412db6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423549, "uuid": "98d4fe44-a3a9-49b7-8893-08e75cf16aab", "comment": "Malware payload", "value": "4076f217b7c9f20a247590d48f4b8f9e31c8b967b75580a46e4d4b5c8fc7b5f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423549, "uuid": "bae33496-8522-43fa-94c5-83d12f86feaf", "comment": "Malware payload", "value": "35d4251c12a67cba8fc1ed4dbcbfcabf0eb65650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423549, "uuid": "1de1946f-c723-4df1-a675-bb873783cc88", "comment": "Malware payload", "value": "9bb331d3f4b83a52b3d7b1270d4789080a31d9c65963e0ed4aeb880426e3ebc3122aeb63a1f537ec4ad9dc60a5296c26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423549, "uuid": "7fbb8d9f-7dd1-4843-98e4-2eb5df6c6c13", "value": "FBD2F10A19FA07C9F911B07A754EDAEFB2010E44763E8706D257FB18AE792C6CB1F084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423549, "uuid": "8233aac8-1540-4a43-bf41-762241910bff", "value": "768:k4kq5frVsiqif+Fo4SCAPwQaJ3KQZptGTv:Fkq5frXq0+Fibot6QZSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423549, "uuid": "a03db333-b899-4855-ac11-f05afdf98588", "value": 28784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423549, "uuid": "89c5d096-04f6-4b61-8f05-153aaf9d7955", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423549, "uuid": "315599d5-8aec-4ec6-881c-80e10c4be065", "value": "8b8e29e0c47fea574d17954d41412db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6888894f-cab3-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623415746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415746, "uuid": "4c5a8216-ca25-4053-9a51-a057e7f59177", "comment": "Malware payload (AZORult)", "value": "4a5c988e784e1f71bf43e580a030e0d2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415746, "uuid": "75daaa94-d144-441a-b0a0-0750fdcedd15", "comment": "Malware payload (AZORult)", "value": "410f552f92fa4c2652fa89dc8a6009a00a129d6bf9a67ee25c7ffc7e0c7df81b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415746, "uuid": "29acc942-d18f-46aa-a07c-f069144b8c50", "comment": "Malware payload (AZORult)", "value": "e5f69b77723648157449fed7e8ed497b1c97942d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415746, "uuid": "583d5957-0bba-42b9-8523-358c16589eeb", "comment": "Malware payload (AZORult)", "value": "a32e397cc01355f3f923a88cfab7d10cf4c0c50167bdf2be1fa661a730fdc6ee88851a9dc2f08283609e685eb9311419", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415746, "uuid": "b73e1d25-a6bd-47da-879e-8cf65b28d35c", "value": "2C64F6B55885C989D4209FF2ECB4D4F3D39C17ED0A55682A3DA8DE3D0D9482ED306B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415746, "uuid": "f0e0abd1-1b67-46b7-bdd8-21bb424547e7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415746, "uuid": "2c907be5-be4f-417e-bbd2-0f0ab2bbdc18", "value": "3072:MQIURTXJu7CI6XcNyacMMSj7GunaKGnFjLkvk9cfiMuQzkDrcKbp1wAX1NGjAvEj:MsxU7GYaKSVIScf5zkDNXLTG88T1bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623415746, "uuid": "0e007aef-f860-431a-a146-b2bdce5f93f7", "value": 337149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623415746, "uuid": "c57dac02-ab35-4555-b227-478198c84753", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415746, "uuid": "5d43f920-bbfa-4018-bf20-8bedeff98531", "value": "HALKBANK - Dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ee0f7a-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397161, "uuid": "27042664-9853-4f5e-94bc-dc680e14137a", "comment": "Malware payload (Gafgyt)", "value": "d89b13326f531f9125750bf9a9767244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397161, "uuid": "68b502f1-d3ce-4962-9ea1-cbb626238ece", "comment": "Malware payload (Gafgyt)", "value": "411d9b94e07949e21feaf3b665fffca74c081e2a45fb5ff5abb830aeb664e483", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397161, "uuid": "f65d00c4-62cf-4bde-80e1-e38701213f2a", "comment": "Malware payload (Gafgyt)", "value": "04c27b721cc3866752095a4377c7e23159847d8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397161, "uuid": "561d8b23-3235-4dea-b502-37c6896ebaa6", "comment": "Malware payload (Gafgyt)", "value": "6c98b3483007269fd0e85355c68dc9ea121857783311dec6bf3492d952ef3ceeffe2214ebceece45340bb68b73d5d29a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397161, "uuid": "cfeaeb46-cd8b-47d7-945e-1ec287ba2688", "value": "BBB3F805F9404B23C6D26BBBF79A43CE77366658ABD7330166297EB02FC17982E39150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397161, "uuid": "02c5bfd3-91ad-4f1d-8c81-fcabda8b3759", "value": "3072:iIODYOWlLQdno7K3qUmvrZxHOX5hw0bGsC7YHQQ/hVOmAD3m:iTmvHOX5hw0bGR7YHQQ/hVOmAD3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397161, "uuid": "1471c344-0e9f-46ea-ae95-76c700b7b130", "value": 116859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397161, "uuid": "5092b4e9-7524-4957-9ed0-ef4cd46f3594", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397161, "uuid": "61ea495b-dc25-4689-aa53-b32a09c5181a", "value": "d89b13326f531f9125750bf9a9767244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc60a1fd-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623389741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389741, "uuid": "45f2a410-b1da-4025-a4e2-cef44915b1da", "comment": "Malware payload (OskiStealer)", "value": "b53f6c42f93cb5ea1f088d2c82257147", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389741, "uuid": "3949c6ba-09c9-481f-b1cc-b68083486e6e", "comment": "Malware payload (OskiStealer)", "value": "4148050e2978b456d0c22c7c5f3ac3ac1c3660968f4cef13a52878c1ac6b8853", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389741, "uuid": "13e742a6-ea29-43f9-870b-5b7806b94e6c", "comment": "Malware payload (OskiStealer)", "value": "e2199bc893deebac3a7ff604887b967664285022", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389741, "uuid": "c0368695-503c-4071-8311-cabbac1b7cce", "comment": "Malware payload (OskiStealer)", "value": "3c0ac9cf091d9d6c962cc6acd6871baf3076ea650d5d2cf7f105ff6415e86c58d70fba969f7572a9ab33ffa9a5fdd2d8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389741, "uuid": "132bc228-cd3c-4fca-a377-09ee3022863c", "value": "F58557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389741, "uuid": "02c03d53-87d6-4304-afa7-afe88a3597c4", "value": "12288:cJXM8WAb6C7v5UPtB4wwrh9T2IIF/qK/gr1i9G1u3J:Ec6bH7BUFewwFYF/7/gxQd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389741, "uuid": "1aafd76e-b3ff-4527-a5f5-f1d3d6c347a2", "value": 1849202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389741, "uuid": "ff4c6275-5d5d-4c42-b35c-cfc0049a1778", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389741, "uuid": "76e7462a-edf6-4e6a-89a4-e2eaeb2eff88", "value": "New Order PO2193570O1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4702276-caf4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623443844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443844, "uuid": "e5148819-fef6-4f30-9532-060ec5713c01", "comment": "Malware payload", "value": "755aff3a424238b026f8d547783ecbd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443844, "uuid": "fdc1f89d-853d-47f4-9a85-366877e1045b", "comment": "Malware payload", "value": "41cba03f4c6ce7e24b6f2d9f146a8cb82e9a43236859e82f14b225c2232adc5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443844, "uuid": "68bddeae-e5c8-4d9d-af90-b082f4df102d", "comment": "Malware payload", "value": "d3c73271b3751043cdeb732e4c473fe462fbcd24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443844, "uuid": "e4347f32-3953-484c-9789-bee8ea8758fc", "comment": "Malware payload", "value": "7c1906eccbd93d2bf9242057b537b9a920126b4861620b0bb4e340c9cec65457c26a9eee40e89cac8fa05c8d180aa3ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443844, "uuid": "d5fd13aa-196a-4a9b-b186-0c714665095c", "value": "F775BE1022409B10D13987758C23D6B04FB0AD0EEAE6C60E7DE77D9F39717B25A2E65E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443844, "uuid": "e798bd19-baa2-44d9-b465-0a14d3668386", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443844, "uuid": "6d15514f-9903-488e-8c48-14f0b901a703", "value": "24576:OzSYNeBUdtwsEgwsHe/z8YEoqSg5LlJfH6zMIDsxTt8T2i9PGMbto2/siDUeuc/T:dYwBUwsEgwsHe5U/BldOSe+0eosic4YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623443844, "uuid": "1035a705-5c6b-4e38-abd2-3db6f544259d", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623443844, "uuid": "6ae2db46-0e22-479c-830d-1feb16333fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443844, "uuid": "10a7fde1-29ed-4d43-981a-7670300ef52d", "value": "SecuriteInfo.com.Variant.Bulz.495766.21629.30464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c008a005-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623389694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389694, "uuid": "95053dda-7eb5-49ca-a4c8-716a367b430a", "comment": "Malware payload (Formbook)", "value": "ee4431e2c986dcac3fc8078c674ba65e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389694, "uuid": "82483a95-df11-4c16-bcd7-241524ed7b6b", "comment": "Malware payload (Formbook)", "value": "4219dd0fbae4f8d9e9964eac82293fefc6a7f1b75242473f6347daed349198a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389694, "uuid": "edbd78c4-fc7d-4f81-b946-37d5c64bea73", "comment": "Malware payload (Formbook)", "value": "64aa75122963e38f52739ba819788e4bfcfb3651", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389694, "uuid": "f0bc2f41-f1a8-457c-93db-d094ef1480cc", "comment": "Malware payload (Formbook)", "value": "3781a0ca888382b3787f9eb696e0008309eb9c25803e40f038393c58e7b1848dc31b79278ac81c2b09b6855e0d25fac1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389694, "uuid": "d22961b9-6e44-4bc9-b8b4-db213f038edf", "value": "59941242F2843B27DD53923509CBD7C973B6ED4AAB0A870FA201BB5CAE767215D12B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389694, "uuid": "b1114a33-1212-49cf-a888-1578860937b8", "value": "12288:hlhcQMEUElwvXxKDe2YqREMm1vRm3d+QxHd5NK:vXUvvXSe27etQ3dv9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389694, "uuid": "f0478ff3-043f-4d06-9923-c81ff891e1f8", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389694, "uuid": "1c116e5a-7961-407c-bac4-6f6d247f9d16", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389694, "uuid": "60c3935d-22b1-4c11-bd16-9acd0d3b4bdd", "value": "RFL_PO 69002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038ac3f4-cac1-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623421590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421590, "uuid": "2881868c-2a84-45fd-b10a-d38f03dd279e", "comment": "Malware payload (NanoCore)", "value": "aff59ff4873a180e497cac498323fd56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421590, "uuid": "4d5b8d95-7a71-43bf-86a2-b02d38da8fe0", "comment": "Malware payload (NanoCore)", "value": "445bc3da96e63745748cc4d7d14faaa80122f46bc86e2a4628956f5aea4b70f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421590, "uuid": "9afa2d7f-d90a-461d-80c8-b8bea448774a", "comment": "Malware payload (NanoCore)", "value": "3cb24379d8aeb29a58fddac419f8bd0fc1068c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421590, "uuid": "e6f790d5-420a-4505-9e94-9944ea200143", "comment": "Malware payload (NanoCore)", "value": "9f93bc095ad6cdff3a8289a5fd13b77531998bfdcdb618ce79675dd75bc0889f12b3535ba541e4e58ddc37660c1ec795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421590, "uuid": "eaaae63e-a09c-4d31-9239-67bdaafa16a7", "value": "9F05BE5372A0E5D2E4A400B87160EFF551183DB21979848AB7C477BB2473E8E8A65F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421590, "uuid": "df3d4851-1591-4742-bed3-3a687e39862d", "value": "e41eb5672b7251a954bc5957b9a4dc03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421590, "uuid": "4b003cf9-2ae5-4ea2-aed2-9d70a2822217", "value": "24576:y8XyxEzOrJ2kkkkvkkkkkkkmJKiRzC0l9pMrw:y8XsEzOrJ2kkkkvkkkkkkkbiRnlTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623421590, "uuid": "de2ec870-68fe-42da-ad4c-97b5bd5d3b30", "value": 853012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623421590, "uuid": "47d4a3f4-68fd-4253-9a3d-8773f5e3b857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421590, "uuid": "257db0db-1a68-4f2b-8f6f-49ec95f9330c", "value": "445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a596e3a-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423561, "uuid": "0a1d404d-9d11-4a84-8965-aa067158edda", "comment": "Malware payload", "value": "ddf02c4901aabc6712a41010971ffc7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423561, "uuid": "620a4acd-ed9e-4d20-9dd1-264b760e13d8", "comment": "Malware payload", "value": "452b5fe11b2c91f18107c9822ebf9549ae73bfcb6fc41df12e9936b307394c18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423561, "uuid": "ec5b1065-bb17-420e-a952-adbb2ae82e4e", "comment": "Malware payload", "value": "c7ab353acf89104937f51761febca51e0c89325e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423561, "uuid": "28941f61-9e58-41bf-9b02-8efbbff044c9", "comment": "Malware payload", "value": "ce5e72ba931a707af3f629e09bdcda3d2bb000b59b90cb25c9bfd2a513200fa7c2152a6e5a00d909784e41e8fa02a133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423561, "uuid": "135332cc-ed18-4743-8c11-7bf1166bc4d1", "value": "87D2E196F0062ECBE32A2F7EB21769E99B0F8D517505202C236B16435DE734B869D7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423561, "uuid": "052fedf8-377f-4130-8cb6-f4b5d69294eb", "value": "768:ATQ2dm9Mei1oo+u5J5Lf0roOQEj2EP7s0RNYDe47f:AeKsRu5J5Lf0roOQE97s0R8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423561, "uuid": "e2b14749-da30-491f-afbb-41a49d11a3f9", "value": 31104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423561, "uuid": "d4e6314f-fd5c-493d-bd6a-bfc45ab3368e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423561, "uuid": "663edf14-defe-47eb-bf7c-79df09cfabfe", "value": "ddf02c4901aabc6712a41010971ffc7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65d3709-ca61-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623380765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380765, "uuid": "cb58a996-8d18-4a3e-aa19-c97ea12611ae", "comment": "Malware payload (njrat)", "value": "4df9b2c6531cde226bf1b0ae86d41162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380765, "uuid": "a6f600f1-26be-4e9b-bd89-3735d9d38938", "comment": "Malware payload (njrat)", "value": "4714d68dbb9f9ac36425f2ec73ed434cf57407f36063c391e0bfbb9d0b96bbf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380765, "uuid": "a5dc2e7e-5136-4983-a9fc-02ee87f62c4d", "comment": "Malware payload (njrat)", "value": "9a42c49714905ea1e5f042a683fd80ecff10fc87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380765, "uuid": "ba2e3278-7a3b-4e3f-a1fe-4beb55b8caa2", "comment": "Malware payload (njrat)", "value": "e61c2454efc6ee9ba7dcf3ef8b991cac68fbeb9248d2617f853fe203169d4d23dafedb6042ed6e8915477cce64ce502a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380765, "uuid": "9de23fcc-bcd9-4714-83e4-c6836ad31250", "value": "02E4124F19563F27DA1CE83646150DD320BA5637EB33AEEEC84DC65DC9F3E241A825A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380765, "uuid": "781db89e-8342-4508-86ac-6f983b28035b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380765, "uuid": "e3356300-539b-418b-b5b5-aba173584103", "value": "12288:xoxaLRopZpV0cs6jbfYKA/uxqxxHdRetMYxj3N5HzjfB:exaLRUZ/PvAK7x+dRetMgj3N5Hzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623380765, "uuid": "db604636-9f55-4dfb-811b-69717d2bfdc4", "value": 676608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623380765, "uuid": "1904c75c-d80e-453e-a1bb-2e39702e2cb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380765, "uuid": "e8f0bb5a-b7a4-4ddd-89e6-4d6ba8e7da46", "value": "4714D68DBB9F9AC36425F2EC73ED434CF57407F36063C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d14672-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623389589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389589, "uuid": "d68e148f-6a78-4796-94e1-e16c9ff8c8ef", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3205e465c06e1c866d7519d698cda1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389589, "uuid": "b1ec305e-e4d6-4c90-9226-fe3a4991e6fa", "comment": "Malware payload (SnakeKeylogger)", "value": "473705486cfec36329555e2174b9ec7d3fcdbb4765b54375689aa6c158ab42c7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389589, "uuid": "9d4079ec-dbe7-42a1-b32b-bd2cfcbd91e2", "comment": "Malware payload (SnakeKeylogger)", "value": "beea3d3dbba6866513e483b47bb1c2456193f620", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389589, "uuid": "46b8af63-5505-4c2b-ac3a-07e999ff5fc6", "comment": "Malware payload (SnakeKeylogger)", "value": "58ffe1f9c51776372ec11f8d568402e7073b46c5fb971781f977ca0477c51b00524dc8cfe53340e30e5b4768a710bbd5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389589, "uuid": "1b7a74a2-0dc8-4c1f-8537-fcbde99d8ad6", "value": "67941242F1843B27E913813509CBD3C973B6ED4AAF0A870FA605BB5CBE767219D12B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389589, "uuid": "6df53f43-b8a5-4503-b179-9f0eab3a928c", "value": "12288:XlhcQMEUElwvXxKDe2YqREMm1vRm3d+QxHd5NK:9XUvvXSe27etQ3dv9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389589, "uuid": "7635e2c5-fdd7-434a-a76c-a18b61c83201", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389589, "uuid": "7ae2d392-657d-4135-9390-244512fd3050", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389589, "uuid": "d6a1a1e4-4ef7-4842-b6e0-1bb4b8f1023a", "value": "RO_June_2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c1784f-ca7c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623392176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392176, "uuid": "55163cde-dcf6-4fbe-b499-ca4da2509388", "comment": "Malware payload (RedLineStealer)", "value": "84d7fc6978ca74c42913acdf24acc31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392176, "uuid": "381cecd2-95db-4e39-b527-20510ee6b3e1", "comment": "Malware payload (RedLineStealer)", "value": "47b989b710739b1c88408ca9bf1b4e833cdab68b4c205c5bcbd94bec501c9b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392176, "uuid": "a712771f-a6c4-490d-a8ca-056641d207eb", "comment": "Malware payload (RedLineStealer)", "value": "0582e854f5a685ef707f562fd6855897bb8a259b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392176, "uuid": "498a1bc2-1252-4651-bab6-53b74020cc9e", "comment": "Malware payload (RedLineStealer)", "value": "095fe8122c2579a0d38d07891f0b8ab0290bebf7fb8c6867f7475dcd2636c03bd2c606df34ff5c356c8f9290d9f24b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392176, "uuid": "7a0ac0c8-7abc-4aba-9edd-dcb1def3ece3", "value": "1F746B11B692C036D1B141321A78AFB685BDB9295F7106DB63C40F6EDD306D2AA31F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392176, "uuid": "202a466d-b192-41f8-95b7-3e00e7b8dd7b", "value": "d475ea6390829c1ee7e2c04a87d09521", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392176, "uuid": "d3cbd01c-c4ed-4f70-9dc5-338443283e31", "value": "6144:ZYhdV090oVOOeHWyLISCaaHgjhlHw6nNzrcBAn/zICAOuT29H7FlZn4V:ChdV090oVOOe2FSfaHgjhlPNvsTY7LZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392176, "uuid": "8e738482-d839-4d39-a1bb-f80fd934e9ec", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392176, "uuid": "a24c0ec3-c982-45fc-ad33-5ae1c2fa48a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392176, "uuid": "72343044-339d-46dc-9343-aa3ee8a03535", "value": "84D7FC6978CA74C42913ACDF24ACC31D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06073432-cac3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623422453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422453, "uuid": "f2ff28c4-02ca-473d-9c0e-2443094cbb9c", "comment": "Malware payload (Loki)", "value": "2a4ce5201d73e0be191ac9f3aff09a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422453, "uuid": "7ce89d96-6fc0-4a19-9c3d-25ac7cf1941b", "comment": "Malware payload (Loki)", "value": "4860ba29f6f1cc4f5300d1968363667697aa4d1d62e23cc728604166004f0a52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422453, "uuid": "9cc481f8-007f-4fa2-8efc-f57cd8f3fdda", "comment": "Malware payload (Loki)", "value": "b1212804fb5f067b0556101ce563706268b51a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422453, "uuid": "bb6a8985-96ff-4264-b814-07b9be225f16", "comment": "Malware payload (Loki)", "value": "be601471cf48be6a58327d35623da5f721e2a191315ef8fe714ed86e0fb410dd36e80c081caa14d8bddad5e518ebfa15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422453, "uuid": "462ca37a-9226-4197-a4aa-a15a6f493b7d", "value": "7874E1282EED0E1AE1F62FF894E05912C7B9B0173723F74D065151EA5A63BC1C9417BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422453, "uuid": "386d7316-f90a-4d8e-b691-604a0705d12b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422453, "uuid": "1dcda587-466b-4e3b-8f11-75d9091f9620", "value": "6144:Tq0f9bdcpz/0bCMIXhigafer/wBmFFdmUhgpr2rZN0i8L5SokPZ1AA:Tqu9Gpz/0bShBwer/rFdmUhNABLHyAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422453, "uuid": "458ae6a1-d4ca-4b38-930f-6778d71e3c29", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422453, "uuid": "feb92481-7ee0-413e-95d3-74398571577c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422453, "uuid": "f4f8f4fe-ab22-4556-a785-b14bc9b97d93", "value": "Detalles del pago.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09db7a1-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394500, "uuid": "4d0760bf-9d1b-4bab-9228-aedf53dfc6b5", "comment": "Malware payload (Gafgyt)", "value": "bb6fc8be2e510978e200fe4ce53b7c35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394500, "uuid": "0c0030d3-e1f9-461e-992b-4cda6dc18a5b", "comment": "Malware payload (Gafgyt)", "value": "4b6939fdb66ff5af521201a58e8b9d2da6bf32ce0c1748d6f62fdb8af5253d6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394500, "uuid": "3f8aa9b2-ef13-45eb-8400-e61fd6cf98b5", "comment": "Malware payload (Gafgyt)", "value": "443e6c828beb00b2e7b72d31a6dd0c8cf6156fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394500, "uuid": "516ef458-e614-45f8-8d04-63e23ae9ef79", "comment": "Malware payload (Gafgyt)", "value": "b7d8594e88ce440bc97320aee8028cf36cf048131599fac850b0bf6b81e3777e2dc784e91055e7c56429c68bc532aa84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394500, "uuid": "726ca02e-5a6f-4ad4-b9f7-68657a817f77", "value": "49832A43B72D0B43C49B6AF12DF72BF187A9F96117A76180A10EBFC44772AB02512F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394500, "uuid": "7628f3ed-5b78-424f-8ea5-fe21ce9e7acd", "value": "1536:tQe/XQMozMT/aj5ecEo39igRNapo3y6VZCEmQ9VqXjtWf2Xe:tNZrSUcEo3tMKyyCEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394500, "uuid": "f6e54e01-f10d-4e36-bc2b-fb6ea4d23d09", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394500, "uuid": "4b9d0560-90ce-492e-808f-5486220874e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394500, "uuid": "5ada8519-6687-49b4-b067-3c706a0cc46e", "value": "bb6fc8be2e510978e200fe4ce53b7c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ba381e-ca99-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623404732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404732, "uuid": "88e3f7c5-9261-488e-826a-45c5db83095b", "comment": "Malware payload (SnakeKeylogger)", "value": "921b5c2b364d1e7ae6e011d3594d7549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404732, "uuid": "9499fbcf-a2c1-4850-8f9e-191ac390ac89", "comment": "Malware payload (SnakeKeylogger)", "value": "4beea05a10eec38ab549479b017aa60b04b7adc39ca0015bbee80e2d1c276971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404732, "uuid": "58d019af-9d25-45e8-82f8-b1f15005ec20", "comment": "Malware payload (SnakeKeylogger)", "value": "b334f01c5b09cf5668a15c6584c5b37dee1c4300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404732, "uuid": "fbc3f2a4-0e3b-487e-a294-10c60dda3bd5", "comment": "Malware payload (SnakeKeylogger)", "value": "c9c8a34ea89e2705ddf176fd1995701d438a46e88e80bdf1b49f7985edf6603f9725411fd7bd96665bb4a7f0a5a52d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404732, "uuid": "3b6c0ba9-bcea-4b8b-9fc7-631c1bd1867d", "value": "06B4493439FA502AB173EFAA4BE475D6DA6FB7733B0764691050038A4723A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404732, "uuid": "1ba999f1-01f4-4824-aea4-e57a72bf0272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404732, "uuid": "fe1ab89b-20d0-45b8-8314-8ef94b30174a", "value": "12288:CCpReNMljr/aV14ZUbqvzlkbmmLeQMUWqNp6BWli9w4euBmGFhxoV4jTwan0U:3KunFJVavWXZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623404732, "uuid": "b38c5a11-dabd-4fc3-8e49-44187f7fb5ef", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623404732, "uuid": "b1b2e67d-e5c9-4adf-8e11-3b6902512215", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404732, "uuid": "c2c8e5be-b22e-4b69-87cd-7970810e66c1", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eee8802-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427246, "uuid": "20d5b3e6-f32d-48c9-a3fe-4ec1805c1c02", "comment": "Malware payload (Mirai)", "value": "2996b8e3b2f221f7af01e9bf1242762a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427246, "uuid": "3c0cf3ca-bab4-4c74-909e-c451ecf3b0d3", "comment": "Malware payload (Mirai)", "value": "4cd1ad8fb7d3ac4885c4212352f257d3fde35ab71796db80b877910d7a81ec97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427246, "uuid": "e989462f-d9d1-4102-8094-1482ca8d570d", "comment": "Malware payload (Mirai)", "value": "49fcd57a1df1329e2a913976afa0eddd6b548a2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427246, "uuid": "c8a5ea24-2ebd-4b4a-a669-76af3d0f394b", "comment": "Malware payload (Mirai)", "value": "78022f17a28e94d909970e90a838aa26f8c351210fe7bfc8e1bc823a52f965fb8d44c13b0cb954527b06ac9d9396697c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427246, "uuid": "2694919f-3c63-433e-87d7-906c53430792", "value": "AA92D017931B1DA2CAF00C3DEB6D8D4A96FB43FCB6E9A02535946734A89120C16FC797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427246, "uuid": "fa710341-036f-4893-b09d-ba5e0fc0120e", "value": "384:vx730Z6YOyOIVj/ZUpVzF3VXUtSC/GRvdk7esrBBFnzhymdGUop5hF:v50coO0ZI3VXA+S39BVs3UozD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427246, "uuid": "c6e82eb7-84d0-46df-8342-87bab99d853a", "value": 20464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427246, "uuid": "668d9919-4c6c-4865-9f96-c7c53ebab674", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427246, "uuid": "263cb048-3903-4f08-946c-319dd32b44d5", "value": "2996b8e3b2f221f7af01e9bf1242762a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81478cb0-caad-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623413211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413211, "uuid": "9ee29f41-bd49-4c58-b40a-f9097071b599", "comment": "Malware payload (GuLoader)", "value": "78c3e32a156e44865fcdf53b4783265b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413211, "uuid": "f6595f7c-0bf6-4c36-8791-aa45cfee89b5", "comment": "Malware payload (GuLoader)", "value": "4d1b07efb6e87b7c1379fc8f9eacef7443c54a57ab8e9d50c98053193316fd91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413211, "uuid": "72784832-1ad7-4315-8fb3-1fbecfeb6cb6", "comment": "Malware payload (GuLoader)", "value": "02f175cb27dcf85b810f40d3c0adc66de1467ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413211, "uuid": "6e4b4e86-3716-4204-8f77-2399df735478", "comment": "Malware payload (GuLoader)", "value": "74e9a9743bce3bc2301491426ef620613a6327d5852f80f09421aef099ffc67fe72ff3eece4474cf8b3e11e45c744bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413211, "uuid": "235d9361-1b37-414c-9d08-13e7e803327b", "value": "0DD36E11F5D89C60F2878AB2FD66F27D6BC13C625A058D27B14ABB0F1BB0653509D60F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413211, "uuid": "0979d3f5-9207-437e-a75b-90d3dff8cfe6", "value": "54ea68151857c1f30c42224007018bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413211, "uuid": "8474c15a-76a5-45d9-9992-742a56f05363", "value": "1536:v9J+koIy03uySeJTFsn9FQsZ57DuAPxElSnEtG8z:vP+ko3ytF2nQa5Nzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623413211, "uuid": "3bd56c8d-5e38-444a-bbf3-3e17080afb93", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623413211, "uuid": "0e6153e9-ca2b-48e2-8d81-a61c38125848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413211, "uuid": "0d503567-2ad1-414d-9a24-d0c6cc36ee99", "value": "Facturas Pagadas al Vencimiento 6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac25f2-ca9e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623406878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406878, "uuid": "50af96d9-f31c-4772-a3d0-875222efcf60", "comment": "Malware payload (AgentTesla)", "value": "af6c540fc4f9468ba9c85d3dc8266171", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406878, "uuid": "9c86713f-480e-4f47-9fdb-685231fa5fd0", "comment": "Malware payload (AgentTesla)", "value": "4d5d550925297c38f8a922fd35998c7a2aa22227e60a3c28be010d1bc1dab4ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406878, "uuid": "b71df731-8180-4b34-905a-c82a507d78df", "comment": "Malware payload (AgentTesla)", "value": "33ff91ac3c54b1c0cecb6013c04c8bfc330b6104", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406878, "uuid": "fa95adcd-60fe-4f4b-a3a6-d2803bd25f6d", "comment": "Malware payload (AgentTesla)", "value": "d6cf2086f1304cfa8f25491c0d8c9e69806d02cedc3393b404288d50bc96129c292f6d3dd614b58b54b7e54d2eaeff0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406878, "uuid": "22372188-6f35-44d4-a5ea-00f04b1c04af", "value": "01F4E0216788AF15F07F737DA024400477F5F02AD722D68D7CF446EE0926F868A779AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406878, "uuid": "b143292d-8190-4558-a217-96c28edae553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406878, "uuid": "eb388550-faf1-4401-8b50-dd553025286b", "value": "12288:YCCwh22XqxYM9iIfFKfffj9O9pOXjO8XGbSyG1FVbn4ESGvlqwEC7QtEXyPrZM4F:YCC0HacXjgbxGxbn4EBUCAqqNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406878, "uuid": "3e2de383-48c6-4b75-b244-bf21b1b56ab1", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406878, "uuid": "fd85a9d2-2265-41cf-aa71-57599e53abbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406878, "uuid": "e0f7ef66-262c-4ac9-a590-89807dd4c6b3", "value": "Recibo de banco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2c7ab5-ca7c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623392023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392023, "uuid": "09ba4270-d844-4eab-ac2e-1a40c8228dda", "comment": "Malware payload (Formbook)", "value": "6d454d32d0f7082b1501237c76b5d9db", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392023, "uuid": "f9975c49-f7df-4588-a83c-b072ec21aad2", "comment": "Malware payload (Formbook)", "value": "4d86f59ed10aea0a69e3eec23bb424fc19c8bb6e998f0034df66a0a260d3282c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392023, "uuid": "9f75e302-9b9f-4f0d-949e-3cfbbbdc4924", "comment": "Malware payload (Formbook)", "value": "82c250b6463cd5977cfa35b4fda6c7ea394bee0f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392023, "uuid": "282db34c-2738-43a7-b270-d9adf0a00b76", "comment": "Malware payload (Formbook)", "value": "fd9ecca5c0a789277c8d372d1bf7b310bfadf36bada3800db19b028a06390018b7f35e29e22975871066c7a350bb9587", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392023, "uuid": "9c68f875-93ca-4dfb-88d3-61353e7f6779", "value": "6045DF66618485A2D7C433701F62D676A3B5AE1C3931920E77FC3E2B3BFD2C3550859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392023, "uuid": "5fb5a2bf-9639-4159-b315-63894c48c4e2", "value": "6144:xssUi6/FU0M+R+NI4ZEvpgGF418KaC2h:3ULUPFZkUaC2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392023, "uuid": "39020b57-7723-4b46-bdab-1ffbac78f98c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392023, "uuid": "bfdcb950-91b9-40d1-ba7f-f5253bd32f66", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392023, "uuid": "506bb912-c539-4122-a23b-fb38ba102854", "value": "Price List.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe98601e-ca87-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397100, "uuid": "e5931c81-6fd4-4624-bb1d-9e91cf055b31", "comment": "Malware payload (Gafgyt)", "value": "a81fdafab496277ab8541422693733e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397100, "uuid": "b5462a0d-c828-4a1c-ae2c-daf8212579e0", "comment": "Malware payload (Gafgyt)", "value": "4daf9139d6f0bf58ea936189c51080b46f0090a52473ed3a9ac2eb051a2f93ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397100, "uuid": "2e2f9599-8dfc-41ca-a5b6-ca1732c7c146", "comment": "Malware payload (Gafgyt)", "value": "1674f9cf53c0a00a77ffc85d382c330c1eca8b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397100, "uuid": "813daa4b-2ec4-4e41-ae24-ba369d200b69", "comment": "Malware payload (Gafgyt)", "value": "90453d19dddfcab976af1c213cc7c34599d338d5f08e68be5128746fa96cf3da4b2b506aaea514f87651f2ad2b518921", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397100, "uuid": "36a12a64-e9b8-4829-a25b-986f14515535", "value": "56D3A66A3E11AFFFE2A8C63107F75B70939525932AA19741E26CDB085F7028D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397100, "uuid": "f673c4fc-5e49-4e84-934c-fbb754fb4a90", "value": "3072:hWkAtmFJDWyxY/pZO06JFEJvTGj1u++HmoM7aOAmKnQSeSa5hECpzUkpF3xemqYK:kC7KHra5hECpNpF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397100, "uuid": "9253802d-93c2-45b2-af60-0498b64d85ef", "value": 138108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397100, "uuid": "2e9c6f77-503a-4d1b-87a1-937fe77f6187", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397100, "uuid": "f57e1304-192c-4464-a1b0-eed89147fc28", "value": "a81fdafab496277ab8541422693733e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86574cde-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623426963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426963, "uuid": "d71a7970-f4c0-4938-b252-f33e156aa498", "comment": "Malware payload", "value": "f3ffc2d2687032af9b489438f51cc484", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426963, "uuid": "e4e5b17c-163f-476f-8b8a-6a80eeff668f", "comment": "Malware payload", "value": "4dfa827a77bbae8f9546fe3a4a74bc522bde248b7f168e3cd5ec40afd5468467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426963, "uuid": "72a8fbef-d331-4a6f-979f-32334adb2085", "comment": "Malware payload", "value": "7f8ff426aa09fed490303696b8412795c117af30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426963, "uuid": "19d68d26-9ff7-49ac-952d-72a239b5ed73", "comment": "Malware payload", "value": "01651ef2076bb4285fb47db71a0b451083beeedf0e647e91ea40313ab3ff8849b4b701e2a5b5a258e4ebd0738b0ae706", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426963, "uuid": "f2030ed6-ca09-4cb9-86df-70e14d3efdfe", "value": "EDB53355F368663BEC3D9BB989804446D334B606F082E7FA5DC5AEDE74C3AD849102CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426963, "uuid": "498eb9c6-7065-48f1-94c8-f63395b91e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426963, "uuid": "316285eb-d86e-4f8b-b36c-8cd45bb002aa", "value": "49152:uISj212xwaMA/IVZ9SNNj7rQ+C6Zh55HUgWYjT:KqObkzQNJ7s+C6Z7P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426963, "uuid": "70db171c-2eb7-402f-8c41-ea6623ed1f0b", "value": 2273656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426963, "uuid": "98d2a07f-a8a1-439f-b86d-40f37bba411e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426963, "uuid": "0983578d-6041-4788-88f5-c5a188fde26f", "value": "f3ffc2d2687032af9b489438f51cc484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf4a762-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427051, "uuid": "c00eaf5d-332f-44a3-b731-e115fb2cfefb", "comment": "Malware payload (Mirai)", "value": "5c58b77f188dfd14214bd1092e6e6833", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427051, "uuid": "9120e7ec-0651-42dd-9e26-770f81ef21cf", "comment": "Malware payload (Mirai)", "value": "4e1dbe18e8380812978ed4a3cc3333adfda67fd70e9bc9767e02005f1ede3c9b", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427051, "uuid": "757be57f-6db4-47fd-a3f3-8733cbd7858a", "comment": "Malware payload (Mirai)", "value": "4c6b80b2bc2bd7b54a76ab69065d787440c27ee6", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427051, "uuid": "6378082d-663c-4968-846d-4be041e7196b", "comment": "Malware payload (Mirai)", "value": "61c0b144b9724dce4b9dbca3c8d3d0d015a11060fc8cf6fa8335eb6db1bcd314995d2ec7d3edbb035e74be55598bf393", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427051, "uuid": "e4feef80-8854-45f5-a20a-4a287ed45ba2", "value": "A263027D342647F39B244D306FBD504A97DA6A76D0BD3DE2422B128891AB01C7CEEC97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427051, "uuid": "11fb3483-0bb1-4f76-ae7c-3f6d559f4367", "value": "1536:aSU8kW7OS3HuKS2sMCean9dFn1psPDQ0F7qwmATL+Rfx2bFpiAyiNHp2XLrG:jU67OoH9g5fF1irh6SL++bm0NJ2brG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427051, "uuid": "63cc5228-13d6-4969-b5a2-5e5330ee6d77", "value": 73164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427051, "uuid": "dd593e7c-aef6-4104-a825-3b5e7a11f0bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427051, "uuid": "a54344ff-a646-48dc-a8ff-24f13d8d03ae", "value": "5c58b77f188dfd14214bd1092e6e6833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97050e7-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423586, "uuid": "05570b62-ba57-4437-a50e-9fc208515b79", "comment": "Malware payload", "value": "310f16ae7b4458faad03d3e89cf15bfb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423586, "uuid": "1641b1b3-0f58-45aa-abe1-669595efe2f4", "comment": "Malware payload", "value": "4e31b895867cb18cf7c92cfda3ee22bb165f051ac07eab75a5daae9e8233aa12", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423586, "uuid": "596aeea1-e39d-4bf2-b0a8-008217cef517", "comment": "Malware payload", "value": "582099ba3e890fc3609fd192e05602bc3872de94", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423586, "uuid": "23d6d574-41de-4676-9e64-02018c689d33", "comment": "Malware payload", "value": "12ae68ba516c834a3477e2db5d8b898d2f07cc11431d8ebbb067366cdc75f83332cabd39bfd7bd5b952676ef9ab0cedf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423586, "uuid": "3db3bc11-8b04-456e-b812-b7eded9d129c", "value": "92E4335673C01268AF3D5008B3F29BE04B91AD797D3061D286EAFF7C96EF6CD4A444A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423586, "uuid": "ffdeb6b9-9b97-4dfa-a486-fdc9685bac22", "value": "12288:uVWay0EMTHL+q0WEd8H/pLsulGzMd9CAlmw764B+8/6f6JwcQNu:uVWD0tTKq0WEy+ul99jlmwm8/vqcqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423586, "uuid": "f7687be7-133d-4a11-a179-08eb4a8e34dc", "value": 679928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423586, "uuid": "3c2faec2-2b14-4564-827c-d142e34352ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423586, "uuid": "f588523f-b869-4cf7-8670-663fc065da66", "value": "310f16ae7b4458faad03d3e89cf15bfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab725a3-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427024, "uuid": "d65161e8-ac0a-4b7a-92a9-2944848db244", "comment": "Malware payload", "value": "109c9de13d6ef7bf04bfd704fd99acc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427024, "uuid": "8e98a7c5-f4b0-45e4-a9d5-5be65f4022c7", "comment": "Malware payload", "value": "4eb4038aec27dfd96a38c15118211eb3bbd7cbaa72ccbfd02725e2b9b5fa5270", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427024, "uuid": "91b834b1-d972-4f72-bc04-d1c369b3bbe3", "comment": "Malware payload", "value": "7cb4d9c43c1650ae9cba545b791abb16a637ea83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427024, "uuid": "3d9f2182-dcea-4507-b925-73dfdc356992", "comment": "Malware payload", "value": "72c4f571efa751f59a348e0527c3814b6ecf44c9aec450b421a0712544ab174323af64c6dc1785d41f412771facb7795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427024, "uuid": "48a61f09-49a9-4659-ac9d-e1f0ffc1423e", "value": "B14120CA1F324EF9F456D93847370B3977AA564843C04289E1ACDA006EC430D89DE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427024, "uuid": "a046d6a3-0d0f-4a43-a9ea-f888c06f10c1", "value": "48:Oip5E4GYg2H7M91nE/9LuEp4n36ooXHSBl:7p56WH492MEpc3XoX+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427024, "uuid": "23696ce2-3867-43c2-af23-ceab38ac9cca", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427024, "uuid": "351ecc73-32bf-4d6b-8ed7-ad53ce6cc3e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427024, "uuid": "3b8decaf-674d-4c2a-b3be-8374d6df04d6", "value": "109c9de13d6ef7bf04bfd704fd99acc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7596ee-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427485, "uuid": "02de9069-99bb-49da-aa9a-18c004ecd204", "comment": "Malware payload", "value": "9e8e08e8fdece4b70670619bb7bf3f07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427485, "uuid": "3f55d13c-6a44-48c5-b489-b7bdd7bf5fb3", "comment": "Malware payload", "value": "4eeca3926aa1a3c99e9cf51465c3c9f7c9a833cacf4fe793b16b3c1cd00159fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427485, "uuid": "b936b044-adf6-4b55-8efc-23ab412fc1b3", "comment": "Malware payload", "value": "2786618a49b04b212763258698f90f9a79886519", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427485, "uuid": "3e6de2a5-080b-429d-8b2c-521ff2d5e029", "comment": "Malware payload", "value": "32347d0bdd2e82114da010c0dfc183e7ea6b8c1d36c52be796de56e3a843850e3d6aa9a1b31800ca68e5f458701427ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427485, "uuid": "038d7df3-0873-4aa0-948f-542d610d8d8e", "value": "3DE19E427F83825BCA552F795983E010FBD7073228579E1403BE97C9D3FA8BA156623A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427485, "uuid": "d4eafb82-e63b-4148-87f7-d126f2a3a7c7", "value": "192:T5Iftsqwtk4NoxTK1p8IdfrJuvwdtTX9FxWG:TeV0foxTKXtuvwdtTX9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427485, "uuid": "de1db9fd-f8fb-4026-aae7-ec5235be5e25", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427485, "uuid": "a0fa6669-f1b2-4aae-b753-da45b6201e25", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427485, "uuid": "664faa85-b7d7-41a0-8449-160c560c6a40", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c42a10-caca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425461, "uuid": "701d9c70-0f4a-4351-89da-c821562e6660", "comment": "Malware payload", "value": "9f9c26fd8dc703529513460159c4e5a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425461, "uuid": "90a0ffd3-9ed5-4a34-b143-0bf7ff1d805d", "comment": "Malware payload", "value": "52b4fc9d08b0b751abe8f8d38e6d36a6887a68185991e689d892f4900cbc6ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425461, "uuid": "3e65fb98-eecd-4327-ad38-3157d2fd672d", "comment": "Malware payload", "value": "fafd7dc2e29895c8accf993369fa6cd167da5542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425461, "uuid": "2845a30f-4c31-41a6-81e9-6a4b62604cfc", "comment": "Malware payload", "value": "9fc01097ea9f867c9d17403e560107fe44229f053f6c57a68584505b0867e1e6ccde3c13019fff3aa77c7e5b2889103f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425461, "uuid": "a3678471-6da7-4ade-bec7-eb570bd03fef", "value": "EBF2F1E050464125E0D600BAADBBBDCA1E9AF62995890FE8C7C873358CD2FF65F78350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425461, "uuid": "c9447a5a-3911-49e3-b0c5-396730a12f0e", "value": "768:UKlQMcsYPRXyL9hG15QZ2utH3asnbcuyD7UryqknC98Ti4:rlZcsqXuIfAxRnouy8mqkCOTi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425461, "uuid": "c7f86fbc-b008-4761-86cc-95ed49fef2b7", "value": 35024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425461, "uuid": "9e2edd7e-c9f5-4eb2-9921-8d9caf86fce9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425461, "uuid": "2112ba15-dccb-46d8-a0e8-7e51b1b23ee2", "value": "9f9c26fd8dc703529513460159c4e5a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c78ef9-caa1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623408123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408123, "uuid": "d68a70a6-af49-43c3-9f09-88f1d5a6496e", "comment": "Malware payload (AgentTesla)", "value": "9a7deb4c1dc1dff1bb42585200668bae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408123, "uuid": "2491c921-e9ee-4e64-b51e-f858cc2cb7ba", "comment": "Malware payload (AgentTesla)", "value": "53f410cfeb4ba2090cbb4d494e2752e5db040dd66060562917b4ec5198b6bd28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408123, "uuid": "a9d20092-c964-40c7-b93e-cc8abec89c51", "comment": "Malware payload (AgentTesla)", "value": "29752ad3e3e4369a93a11f15855b9bc06b6ca6d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408123, "uuid": "767a0055-b035-4a82-a65e-ccce29f3ad52", "comment": "Malware payload (AgentTesla)", "value": "7077fbace58aa3853f09bdaed4508c74bf07e47b6da696295b7f8ec427a69504eababfd54f6fb4535cdcf4bf0f091298", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408123, "uuid": "f677dac4-67a8-4f62-9fb8-282b0989bdee", "value": "D915D4AC366072DEC467DD72CAA85C64EA6134B7931FC247A01305EE9A0DA97CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408123, "uuid": "42722366-2274-4aeb-980d-51e3f2c5e9ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408123, "uuid": "829969d9-992e-4aa3-b095-f815886ae4d8", "value": "12288:IZbocnfWNIaY8ziWDM3xYiL/gF/5zB3/pohoLhH3qxMOs7AKCgPK3AJfZCbXG/0g:ibosaD3M3xYFF/r/pvV3qxMHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623408123, "uuid": "e07d7ed7-29d6-4911-85f7-acdd1de01165", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623408123, "uuid": "0c28c494-309d-44e9-9111-976217b8a4c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408123, "uuid": "816a3ae5-8e60-451e-98d1-a863b5c457d7", "value": "SOA_31052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bd6e60-ca4a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623370485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623370485, "uuid": "8901a0af-28f6-4940-adc9-e72c2ffb8d93", "comment": "Malware payload (RedLineStealer)", "value": "86c9cddc86f2f3e40c8316eafacfc62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623370485, "uuid": "7f8e2fea-c405-4b1c-9e21-bafd73e2e47d", "comment": "Malware payload (RedLineStealer)", "value": "5576e6d2bde0df49ee885579d495ccacc2f3a21b45c512224f4180f96c0672b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623370485, "uuid": "500a946e-0da7-4040-854e-b0d405d8a6c5", "comment": "Malware payload (RedLineStealer)", "value": "a4a71e758f9b7141d63c03512dbcac64a91709fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623370485, "uuid": "bd82f8b9-1468-40d5-b605-f6029d73b26a", "comment": "Malware payload (RedLineStealer)", "value": "a28ccf653a9618445f2d1316ce013420b465b23292fd7a8436954f5030520d5b8045c0246c37edd621d1314ce5bdd88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623370485, "uuid": "d83c6474-7617-4f99-a3dc-c43705b270b0", "value": "A5B4290CFF65AE67C26C0F77C0135504D3E28067A2BAFA9B09D60DD60E69B45C94FA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623370485, "uuid": "3de88039-0ed3-44e7-9c31-16b75adbc400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623370485, "uuid": "61fe2ff6-1b3b-4940-b9ed-7082ddbea36c", "value": "12288:3sCUIzjWJ/HnYbIk0Jajr/2nk8f5+JMNhBYy/o:3sRujWZH8bjryu+l/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623370485, "uuid": "cf4a21d3-a320-49fb-92b6-b402fa777af4", "value": 541352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623370485, "uuid": "92ebae4b-9747-45de-b370-1ecdddd6da49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623370485, "uuid": "d1414e96-a436-4831-81d0-19524667c82b", "value": "86c9cddc86f2f3e40c8316eafacfc62a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449ec40d-ca5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623377461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377461, "uuid": "a2038521-a464-4b71-a8e3-0346a966b036", "comment": "Malware payload (RedLineStealer)", "value": "0280fb07ef705ee4bcf30994004271ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377461, "uuid": "ddbdd415-fdfb-4e76-9a42-49415c7e8492", "comment": "Malware payload (RedLineStealer)", "value": "5677b9d1528c45370a17cd4b68fc443862d4304ef1bca005c369c8c1d9158a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377461, "uuid": "c33d7f59-b224-4d8a-9b87-0489c831dd44", "comment": "Malware payload (RedLineStealer)", "value": "b86810d0898b6a85712c3b8c86e24bb1f7b2271b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377461, "uuid": "c31f4a21-e738-48de-b542-ff9d28c6a2d2", "comment": "Malware payload (RedLineStealer)", "value": "7c1c4a1095a7132ab0a99a6d2a5af5d8456c0cfb213143157b638716f3a9df90fbed431f8e302f467995f23d2e541ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377461, "uuid": "24c9cbeb-c0ca-4128-8a13-5bdd06391287", "value": "960633527DD0D9B2C9A50D324E28A7225139BE102E38DEEB63D49E69CA340D0FB35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377461, "uuid": "0ca50489-9e48-4435-a92b-4147736bccf9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377461, "uuid": "e5424cfd-a260-4414-aa4c-74a6ed8cc070", "value": "98304:UbWuFZZaFymi7g2Ox/KNLABXSz47CCkyZ9xqP:Ulye7ghcNLAJOOjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623377461, "uuid": "9e37935e-060a-4935-a1ed-03512ca5ccea", "value": 3987636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623377461, "uuid": "7fdc088c-9794-40d4-9c3f-df63f1a300d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377461, "uuid": "a9b65853-ee73-49f9-a2db-b226e53644aa", "value": "0280fb07ef705ee4bcf30994004271ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f33e3a3-ca78-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623390417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390417, "uuid": "932fcee6-886d-4ec3-89ed-7056f700ef93", "comment": "Malware payload (Formbook)", "value": "c66fe399ec0cb598b2167a348c17f6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390417, "uuid": "85793d43-7315-4112-a5a6-2aa1ffaacfbf", "comment": "Malware payload (Formbook)", "value": "57f599e4ae63304de5795909f694122665f7c492df8078f7c5abb084d09baa2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390417, "uuid": "a0f7ada2-baf0-4650-971f-eae5b68bb64e", "comment": "Malware payload (Formbook)", "value": "fcc9984283b3596fb575523fb90eb80ce702abe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390417, "uuid": "54eef7f3-bb7a-4b2e-a766-8c6523034db7", "comment": "Malware payload (Formbook)", "value": "36566099e577170872bca30c049b069df42540636ac60c587992e44495b12a4b039ab4642785244c9d56325f1c89c8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390417, "uuid": "74260cca-f892-402b-9d83-39e8c75e39d0", "value": "8725CE85FA414990ED5D2732D27BC8340322BEAD6D75D62E28DD3E3B3BBB3932414496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390417, "uuid": "e9242126-ada3-4b6e-a55a-e3fe38c2a9ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390417, "uuid": "e8ed9349-38a3-4f6b-ba62-cadfe51b714b", "value": "24576:6tN220KdM+lT+hwWVAQSW3+0NeBUdtX1q:yDRl0V9N3JwBUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390417, "uuid": "430360e8-182d-4f5b-ba9e-01f4a6b504e0", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390417, "uuid": "4cc8b9cd-473e-4626-b996-31bd96006850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390417, "uuid": "f70c3a69-4967-4c44-9931-868c8ed5d592", "value": "SecuriteInfo.com.Variant.Bulz.349164.25568.5993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617da1ea-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427331, "uuid": "4de8fddf-88bb-4825-b206-a420bc3ebd62", "comment": "Malware payload (Mirai)", "value": "af742501d8e3f751c579bccf8986dc49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427331, "uuid": "62c7d9f1-d5ed-4dd1-b8e2-6aa9649623a6", "comment": "Malware payload (Mirai)", "value": "59040aabed434a40e956444aa10ddcc1cc26780a7a27a9ba127f44388aed706b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427331, "uuid": "e2a4789f-dcc9-473f-be45-2e7e64ece00e", "comment": "Malware payload (Mirai)", "value": "2020b471ca180c597e9b40e2880822659bff7af8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427331, "uuid": "35e324cd-7e43-4a87-b8df-91aca6b7b554", "comment": "Malware payload (Mirai)", "value": "8b6b4f50e821a01afd1eebca196ff7b4178185c9bf47c03ef2f7e98cee41370aa0499618b0c4c2425b56d71500a029c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427331, "uuid": "e8adc4b9-ea61-4300-993c-a952c059ce5b", "value": "8992CF40E1876965FFBEF9341C0AD6C6EBE58F8ABB393D124589BB231805C21D349EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427331, "uuid": "8a9b2ee3-4385-4c97-986c-a4ec7effd62d", "value": "384:ezqDQbPzN72fYVE6048TBU2i4+a+AHRrV2dn2ycSK09BM4uVcqgw05VxJi:k5REn604R2itRqrUJ+8u4uVcqgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427331, "uuid": "bb08121d-034e-45b0-9a6d-0ef76c861b21", "value": 19656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427331, "uuid": "b745c2fd-8bfe-461b-baca-69fdb1231fb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427331, "uuid": "c8215b97-66e5-47be-82f4-e790b6a32095", "value": "af742501d8e3f751c579bccf8986dc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cc4da7-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427044, "uuid": "e863e9c7-d18e-4ac1-8a2f-5672e91fc51e", "comment": "Malware payload (Mirai)", "value": "e9eed6a9d91f4b196241d11a1feb7375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427044, "uuid": "79acb881-8881-481e-ba82-6504ea40c47f", "comment": "Malware payload (Mirai)", "value": "59069c630fa260a27cda324de355bdb0ac87ea205232ae90d5ffe2814c7561d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427044, "uuid": "7ce31706-af5d-40d1-9fb1-d6d9d8f41a39", "comment": "Malware payload (Mirai)", "value": "60e8d6ddb17cfa20c1710e3260a30ee5b46b8f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427044, "uuid": "70cf5585-06aa-4223-adb0-31958ac88c89", "comment": "Malware payload (Mirai)", "value": "9f6bd21148015e1d5305180e08a5c1f43a08c437c201e29a94c949117c4722b626869c99eea5a3fd32d16d0e7c5999b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427044, "uuid": "948146e0-2f99-41ba-a00c-9a9c9c107ab4", "value": "B2A36D2389B61F96EB5826F0B0A0A934E31BE94031EE1E77C845C7A43443EDEB5567F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427044, "uuid": "885d21c1-db63-4c0d-ac00-856064ca1ef8", "value": "1536:4VrvSSlexYGoJ2Q6EgxjVcQ5j9UyTd4GFStedUlMGCsxhqKqveq0ymblTHP:wg+L36EOesyyTd4FxlMGzqjMlTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427044, "uuid": "0aaf7d11-3499-4d17-854f-bbacc4f91c49", "value": 107308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427044, "uuid": "05a4e903-f947-4d93-b546-ddb969b8087f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427044, "uuid": "de17c2d2-4fdf-4a9d-b4b0-b115a3c36183", "value": "e9eed6a9d91f4b196241d11a1feb7375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8220684b-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623426956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426956, "uuid": "869fdff1-dfaf-430d-831d-2c2fa5e2644d", "comment": "Malware payload (RaccoonStealer)", "value": "7f325b52447b7945c5a0574359200dc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426956, "uuid": "daba96a5-f164-40ee-97c3-954405030fe2", "comment": "Malware payload (RaccoonStealer)", "value": "59cb9ed387391ece604f35699396db4f06155b2a259e1e00e6bbed843e64af9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426956, "uuid": "d8a73a3f-44e8-43fd-a341-f11e8f6367a7", "comment": "Malware payload (RaccoonStealer)", "value": "3eae93fe98f4ffee046948a0e4840aa765706490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426956, "uuid": "7d388818-581f-4fcb-b9a0-480222a2c68e", "comment": "Malware payload (RaccoonStealer)", "value": "eb2479f7ed9f4419f022d0021e75cbc3f485d3567f8ebeeb44e2082dec44c61b63a477499c58c107d4efa43f91f57f57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426956, "uuid": "29a5cdaa-78ea-42e7-aa37-15576c82b207", "value": "89A4E1267BAB4E12DB0456B7C5D3500043BFC6867723EB0E369603D58F037DEA69668E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426956, "uuid": "042d82dc-0398-4018-afa3-97417a308830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426956, "uuid": "94f317cc-4872-46a2-b599-381b0ddc4a8c", "value": "12288:c7cz8pD34BZoRegRWCAhpb5XbcxiM5UZhQD:c7EZ7oRbRWCcphbcxSkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426956, "uuid": "94f1110f-bc28-49f0-b975-901e758f544f", "value": 481672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426956, "uuid": "e685be26-5750-4c14-8a9e-5686fa09244a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426956, "uuid": "b8a4dd9b-d3ea-44fa-8892-52499399a527", "value": "7f325b52447b7945c5a0574359200dc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52faa90b-ca4c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623371472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623371472, "uuid": "c5833cfe-8693-455e-975a-ab57b9654b78", "comment": "Malware payload (GuLoader)", "value": "0a2ce5a915bf643953baf2fcf3b25a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623371472, "uuid": "8347c6fa-4081-4d6c-bc47-1eddd956c208", "comment": "Malware payload (GuLoader)", "value": "5a5428877719d24368bc14761dee49adf676fd883abd3a8c30b84c0b0c7e13f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623371472, "uuid": "142e2855-096f-4915-bb6b-18d6d9b45ea4", "comment": "Malware payload (GuLoader)", "value": "21a26264df4f615da898b38ef9332ff66d24b505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623371472, "uuid": "8fda5524-6454-462e-9a95-8b8af079c547", "comment": "Malware payload (GuLoader)", "value": "65c33ebf25bb0b9479a93da3e691ec0cf48a0d19b2153f24dadc0f50c2398697ae44e1a980207ba3f7525ed44d93cbef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623371472, "uuid": "fb12b9d9-1a3b-4e25-bf98-d3d32c89aac1", "value": "41E35BE49044E404E62AC5B1E65DAAAF0B2B7CB20243DD0BB2593F4B5D797036EF670D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623371472, "uuid": "d9a589af-11e8-4596-9c84-75e50bbde781", "value": "b1d5215cf0ff1abab4dacdc311d642d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623371472, "uuid": "8788b931-f9a8-4dc0-8b28-9894225df1f9", "value": "3072:CBWkR/6N08mSDea0rRzkaNTBW1NieJHz:CBWkR/E3Tia0RzkaNTBW1NieJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623371472, "uuid": "56a62ff2-7b59-4968-b928-5e3216124e6a", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623371472, "uuid": "e68b2036-be51-44a5-b53e-df96476c9e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623371472, "uuid": "6110dc39-aa2a-4683-987b-1070c8f98ddf", "value": "FACTURA Y ALBARANES (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb22cac-caae-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623413552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413552, "uuid": "a4531e7c-cce4-4d45-bfd7-295d3b27b5c5", "comment": "Malware payload (Loki)", "value": "280b2702d12137e28f9807dee5a02445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413552, "uuid": "535da0f9-44c8-4ab8-b599-030907de0f52", "comment": "Malware payload (Loki)", "value": "5ac70a3e22afa8cae1eb5d7756acfe91be7eaaf872353e26113818712cb90139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413552, "uuid": "d8c19c51-90cb-4ce5-b6c1-6ac17c95a95b", "comment": "Malware payload (Loki)", "value": "5802d44b89d83ad928671abbbd3526d7469641a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413552, "uuid": "ef42edac-b3ad-4213-8632-8fe9f05ce047", "comment": "Malware payload (Loki)", "value": "9f0f85af310608a2059f5d7639c020a12303b936df0e38b3c23fe6ca4bac44745f09291728d724f182dfb0d67e97d907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413552, "uuid": "56d66a17-31ec-4a76-8a72-53f397bfb3b8", "value": "9D1569F165A147C3C39EDDF283CAB3848B6F4AA235728212A84C22FC76DD29D55CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413552, "uuid": "8136505d-ac0f-441e-a18a-2784e9eb12ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413552, "uuid": "f812bffe-f53d-438f-ad68-bfda9b7fb245", "value": "12288:7T6VJxuSP39UxwDj6vKrSNuYK/ozuvUwW11+EpjLZM4e/ZUdtb:7eduSPn6vKJeuswWDNpnNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623413552, "uuid": "1bac7edc-104b-4940-9ce2-74d33387822c", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623413552, "uuid": "e0fa8282-dacb-44ce-8f71-b59e8cc4b5db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413552, "uuid": "c7d798c5-5b28-4a5d-a04b-1724a83fb8dd", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eccff58-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623389611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389611, "uuid": "868c31f4-a592-4f92-8f4c-91930e3e9830", "comment": "Malware payload (SnakeKeylogger)", "value": "263da37e9cc277438afdc007f85534e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389611, "uuid": "d9a33285-ae52-4ff9-ae65-5fee23882c43", "comment": "Malware payload (SnakeKeylogger)", "value": "5d13ffd77a7df02676e6a1942454299684ca2a50f6e419a9e6c7564b65a7f48e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389611, "uuid": "14825438-5d18-46e2-b81b-41c37512455f", "comment": "Malware payload (SnakeKeylogger)", "value": "7f756e2bd481114bc1d4ea15cb3b7323308fc107", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389611, "uuid": "0084d6fa-7d9c-4248-91e9-699a74d4d5d7", "comment": "Malware payload (SnakeKeylogger)", "value": "c18543a5bd45dc08fc0ef718b81faca6a363e7b2497d1e548c6cf289e551d25f2f2cce6937665f8015a70ccca62c3adb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389611, "uuid": "3d4bb00c-e0ef-4d93-b922-a08aa95238ca", "value": "69941242F2843B27DD13823509CBD3C973B6ED4AAF4A870BA605BB5CAE767215D12F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389611, "uuid": "e25a5578-da63-4c57-a9b4-6a38b217eef0", "value": "12288:SlhcQMEUElwvXxKDe2YqREMm1vRm3d+QxHd5NK:+XUvvXSe27etQ3dv9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389611, "uuid": "fa5de1f5-6b41-4143-bf0b-84bf37e502ca", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389611, "uuid": "314486e2-2a0f-4931-a904-21840e61ee2c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389611, "uuid": "f05fb49e-cb34-4173-9c50-3b9ec36e8b0e", "value": "Payment Advice.pdf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e38997e-ca52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623374148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623374148, "uuid": "d6cba850-1942-495e-8a8b-7bb35f0acf7c", "comment": "Malware payload", "value": "8c626372ee21a644e89755ad499e1e6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623374148, "uuid": "61fa2990-72a9-4e58-88fe-7243162c98aa", "comment": "Malware payload", "value": "5d39852c7ee64429fff8ac2ef738c2a9a8db9e165e355fffe5cd96da3ecf90a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623374148, "uuid": "27367a6e-e8c4-4ac5-825c-476e85249d32", "comment": "Malware payload", "value": "c60e18f8e9704e52d69d22402bdb900a6a33b1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623374148, "uuid": "80e943cc-9eb4-491f-aca8-15403ff52563", "comment": "Malware payload", "value": "24d46ce98ef231f97ac71ff320a35d14268e1b99ed4ac2c3a83a1dd3f21d2c193fbfdb0fc942c904c3c57fddb372bf5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623374148, "uuid": "77516cf7-5192-480b-85e9-2936f9d4a814", "value": "C6918D4DEF19B237DF00A8BB0C1F05B959AB8598091E3030A472A50CCF195A30B6E0CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623374148, "uuid": "4cc3d17f-a2f0-4265-9d6c-dd12cfb5e460", "value": "96:fs4u2onfc9zRKhrJ2XaVsq7StwB8tB/jt7:fTu2PzRurki7SLDLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623374148, "uuid": "e061948b-882a-4e5f-bbd9-a98737183ecd", "value": 4320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623374148, "uuid": "c5dd50eb-9d1a-4f50-b95b-a24788d8db98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623374148, "uuid": "2b317e76-ac2a-4f05-9a29-d578ae4321af", "value": "SecuriteInfo.com.Backdoor.Linux.fnqr.30027.6853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0085c09-ca90-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1623400914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400914, "uuid": "d1a773a2-a5d1-4259-a435-85e9427996f3", "comment": "Malware payload (ParallaxRAT)", "value": "f6fbf1edfd949147aab925ab8c3f5a63", "object_relation": "md5", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "BOOK CAFE s.r.o.", "colour": "#DA22C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400914, "uuid": "81214174-62b4-4c56-aeb5-46a702d47099", "comment": "Malware payload (ParallaxRAT)", "value": "5d5684ccef3ce3b6e92405f73794796e131d3cb1424d757828c3fb62f70f6227", "object_relation": "sha256", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "BOOK CAFE s.r.o.", "colour": "#DA22C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400914, "uuid": "df14e909-ec84-4158-bda6-f5adf22941d6", "comment": "Malware payload (ParallaxRAT)", "value": "295e9ac5b55c2a6da3c53470e3f8d6f79712aaa8", "object_relation": "sha1", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "BOOK CAFE s.r.o.", "colour": "#DA22C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400914, "uuid": "cb937a54-7b04-4b74-a383-f59c01409156", "comment": "Malware payload (ParallaxRAT)", "value": "578470fb5e725a3e598132e512aac8468115a78459fa599c8db26ed001d3dba71644bac91f00435f2ee4438f9c436acc", "object_relation": "sha3-384", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "BOOK CAFE s.r.o.", "colour": "#DA22C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400914, "uuid": "aef76176-0cc4-40d0-9dc9-2043526e9bbb", "value": "EBD57A21796377BBD4DB12308D1CF6FEB3AD9560073901D71394EB182B351D26B3A2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400914, "uuid": "6603869d-dfd4-4af4-a674-179e7c4cb78b", "value": "7da808529826c5f61bd5e9f891018cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400914, "uuid": "3500d276-a365-4894-ab6d-77bd305bff8f", "value": "49152:XNLyQJER0XI1w+ZEClJUPriodoP5l6HbJOhirp6dMuAzVlRO7pocaXS9P/tCdGOE:XNLJERTbZH3UP2oWP5l6HbJOhirp6dME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623400914, "uuid": "dcfff93a-73a2-49cc-959d-8224c9ea913a", "value": 2965944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623400914, "uuid": "b173d524-5d5b-4583-aac3-90b4262c8262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400914, "uuid": "c432c81e-b75d-4501-a63a-f6d38378b9c1", "value": "BOOK CAFE s.r.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c71b928-cad0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623428128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428128, "uuid": "f1ced316-6544-4733-a1a5-a366f4d4b86e", "comment": "Malware payload (Mirai)", "value": "8370e476731eeea02742219f4146de26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428128, "uuid": "2987998e-18e1-4016-8ac5-189bac05eb60", "comment": "Malware payload (Mirai)", "value": "5e0df7eb8b71c031a40c7c6998df3e1916411aea9a3c17f37247723caacd488c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428128, "uuid": "c34944de-79b0-4e34-87bb-8780bfc0bb9c", "comment": "Malware payload (Mirai)", "value": "e71197516145c3db45d21e762229c7137e46c8fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428128, "uuid": "3b36a79f-433e-4670-b33e-ef0b55f21a64", "comment": "Malware payload (Mirai)", "value": "d118d2409a924965f0271c9f7673b199ab165e7cdc3ba43ed74c36323db071d14ecae36092c85bb97b75fcaf5f587cf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428128, "uuid": "a38ab6d3-483d-4522-b1e2-189fee08dafc", "value": "BA03F134D1F40102E77A02B9A0BDBB120AC5DA1B5418E7E9CF543697B092BD32E34ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428128, "uuid": "faf44f9d-61f2-4116-9b64-7c67f63867eb", "value": "768:yvwDSK/o12ZN8bCYU3lXxXMhvlWdk7v46z/fQnbcuyD7UHQRje:yvwIoEbrU3tlMht4oonouy8HyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623428128, "uuid": "de3ae58b-b600-4b97-b842-97248ccc597f", "value": 39768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623428128, "uuid": "15542d1d-e250-4ada-9e71-c2cd3907c6e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428128, "uuid": "fadd3e14-e155-4c5a-9d0d-2343c8215bb3", "value": "8370e476731eeea02742219f4146de26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250369ab-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427229, "uuid": "c7a79874-951d-4208-b4e2-9b695ccdf915", "comment": "Malware payload (Mirai)", "value": "9873eddaa5ded6cdd27f8e2ca7f573ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427229, "uuid": "04df6e7b-384f-45a5-a4d1-5bd27ddc5bcd", "comment": "Malware payload (Mirai)", "value": "5f6a69c61b4a8661c2fb28a9b6977b2ea10fc80b338229a39be31cce6d1594ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427229, "uuid": "8a54bd39-2f7b-4ed9-81d6-396c35ceda9d", "comment": "Malware payload (Mirai)", "value": "237531a6534bab84bb26ecf74a97dec18778a368", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427229, "uuid": "6485ae28-64e4-4d49-afb1-e8162a4b51ea", "comment": "Malware payload (Mirai)", "value": "21b4af0d0f688b1ae7c7aa59de31642ab4cd41deffaadf46d8c3d220ec9424d8897788fa90f2499aba8c2bc779450e17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427229, "uuid": "33c99646-ae8b-4bc9-a5a9-627399a13608", "value": "80C34BD3F861CFFFF808E6F680570501F131E2A01AEA0A23F6226897BA651D93557EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427229, "uuid": "71452e31-db1e-491e-8bf8-9bc711c9ae7a", "value": "3072:VzttS1glvnq8XCfbzUe+dZpxdyrxxvR4jLMj8:V21g9qKqce+pyrLR48j8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427229, "uuid": "92da8714-8f04-4c9a-8930-4aa65d37f760", "value": 122200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427229, "uuid": "0713112a-bc36-45c2-b9ac-b0c806536b62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427229, "uuid": "0a1bba0f-c762-419e-8df7-36831976ac98", "value": "9873eddaa5ded6cdd27f8e2ca7f573ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d32366-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426940, "uuid": "7ad9095a-069c-4745-b1f4-fc9b00b13806", "comment": "Malware payload (Mirai)", "value": "8020065195d2b03f384fe3b9e5be06b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426940, "uuid": "6d9af3b1-597d-4400-bdfe-b9b15daab837", "comment": "Malware payload (Mirai)", "value": "5fbe4b9551ad889e1a11555b0717f500a3fb8b2c0956e9b4421943518acdb599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426940, "uuid": "86bbdeb0-0370-429c-bd8d-400236cd6ad2", "comment": "Malware payload (Mirai)", "value": "5f739b0034f33ed3d24c796e840d3fcaa2f908a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426940, "uuid": "0f5e319c-e1f5-4459-be3e-8861a4494335", "comment": "Malware payload (Mirai)", "value": "8a3c1af786b54b7a8c329c1a40958b3f180a2e65b3362c0ca40e942c6433ed91ad904822fc22c6c15502015c652a90d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426940, "uuid": "8c510cf8-016c-4b72-ac73-a6201662e931", "value": "76B2DFAC930682EDE01DC2FA0BE44B325C601FD29903BE5AB484BF1E5E5792C79D35E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426940, "uuid": "11af1b07-8925-4798-a392-9b9c9cef6908", "value": "384:rFsNvfDtONXyVzovrM8JVoiyNFtZGkQqtGd3hTkJgGlzDpH7uNj1Jct6:6pfJOJw0kZGkQqtq3hTkJgGlzDpbuR1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426940, "uuid": "530d087e-019f-4cbe-860d-a2cf59c62975", "value": 24000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426940, "uuid": "ca6ccd12-5759-44cc-9f34-7b25d5c85f85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426940, "uuid": "e4d755d8-d467-415a-bfab-5ac9450b9746", "value": "8020065195d2b03f384fe3b9e5be06b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abf734e-caf9-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623445841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445841, "uuid": "f7e9fed4-1198-4df3-8954-81f58c837b52", "comment": "Malware payload (RaccoonStealer)", "value": "9ff07e9acd9b16f9b81914c67553da8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445841, "uuid": "52f62a5b-a729-4d8c-89fa-c41272b970dd", "comment": "Malware payload (RaccoonStealer)", "value": "613ce988f2d07f72b7ccac61fdc5fa94fd3e75083214c4b74724ef2e0c1b4525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445841, "uuid": "68aece48-419e-4009-b83f-2ea5288c1de4", "comment": "Malware payload (RaccoonStealer)", "value": "e8e980c6757d0fc4e475f74a42a7d9dc3b934a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445841, "uuid": "9fc0376a-2282-4eed-9591-f7d33b21095a", "comment": "Malware payload (RaccoonStealer)", "value": "65f7c9a568418878f122dda720bb70d97c2c07c4efe868d0b60b68d445b48ef405fc5bc50894caa010fcf13a873c39ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445841, "uuid": "700b2e2a-d8f0-4e31-8ffa-2827bed1cb71", "value": "F3C4D000A6E0C035F6F336F45A7A8269693E7AB16B3490CF13D556EA1734AF4AC70727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445841, "uuid": "4b7c56bb-f5c4-4454-b438-c7e6fa9ced39", "value": "4188b4323776a45526c1308a39ab7724", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445841, "uuid": "d47e3323-7349-48a5-8e71-0bd05a4dc066", "value": "12288:Lrocg5UotD9obpDgI32owzlStlVoAUvZUt2+Xlia3jN6:3Bmc8I3/wlStlVoUt2mli4N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623445841, "uuid": "76bf41bc-5420-4aca-ba47-b8a288bde3da", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623445841, "uuid": "3bc1ce60-9fff-47f2-9f99-5a61c7084d62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445841, "uuid": "fdcf71ca-d8a4-4f09-be9a-4d8ec859f75c", "value": "9FF07E9ACD9B16F9B81914C67553DA8D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7c95d6-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623389798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389798, "uuid": "bb933c43-7e9e-4d9c-9104-6ecd3545d879", "comment": "Malware payload (njrat)", "value": "6f834804ddee4b2e620921c57b0816b9", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389798, "uuid": "10f919ee-389b-44d1-8056-4f66811dd226", "comment": "Malware payload (njrat)", "value": "62ba23cb7be95b79252c2da6130c09042446c4cb73cb215b8eb24b54a254a24f", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389798, "uuid": "21a06c26-9d68-4683-bea9-14f78db2ec8e", "comment": "Malware payload (njrat)", "value": "b1d6d8b00487a1ceaa9721bbbb5a8c784d1203e9", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389798, "uuid": "6c98e9c7-39ae-43c4-a49e-493a59b6d8d6", "comment": "Malware payload (njrat)", "value": "bf57f8bb8c6fd9cfeee9907b10c67d429e3451b8b7e787a207e954ea240dd0eaa2f21a333bbb4b15bf1d02b455f5c14c", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389798, "uuid": "2687bcb2-f058-4e25-a4f4-f338c0f60459", "value": "6C4533097CE91F2BE4CD54B5A86AE230A079DD5063A0FC277DAE3B6225B177187D321C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389798, "uuid": "5d3b9f61-cc78-4b30-bc95-315ff4ddbcea", "value": "24576:9DgExwXxUiBsBmwSrMQCOYBoEERDAqPkuor8l0qL00gcvStSI/BA:Ng6wXx1Amwx6RxAHuQ8lJL00gcvStSMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389798, "uuid": "b49479a3-0ac2-45a1-b8cb-86c7ce1cbdb2", "value": 1270424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389798, "uuid": "15059104-dc1c-41fa-9f8b-04e6f1e9d6ef", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389798, "uuid": "035aed6e-a50a-48e0-90ce-ce853c0b5144", "value": "ORDEN 47458.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8907635-ca8c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623399130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399130, "uuid": "018d2815-7ec0-4dbe-92fc-d0177a7e9caf", "comment": "Malware payload (RedLineStealer)", "value": "e79e4e45d069d326efe755963f6cca62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399130, "uuid": "248f8cb8-d2fa-42d1-9a25-2196064d2f77", "comment": "Malware payload (RedLineStealer)", "value": "62c10738bd59f6faf4911008b9def1de105a2f5cef9ae1c2ddde9812ea239020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399130, "uuid": "56381bfb-d5b0-43c9-a261-c3dd78d2e1a7", "comment": "Malware payload (RedLineStealer)", "value": "e3f06701d246ffccf72abf099dc1ece3b01dc9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399130, "uuid": "395ca3d4-1b9d-49d3-b509-43bd751bf58e", "comment": "Malware payload (RedLineStealer)", "value": "eaf8885d301894d4d6d0a348a902503453474de72c9d8195e84ce9275e656b21338480cc354cea62335d37d6c284be5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399130, "uuid": "a81e3b3d-4606-4595-a0d9-e6682637ce40", "value": "F1F4D010B391C035F2F316F059B59279993ABFB26B28A1CF12D51BEE56746E0AC30B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399130, "uuid": "d82f54d5-bad9-467d-89a7-123e5988f090", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399130, "uuid": "cfa52fce-4cbd-4b1e-9efe-0e24f96a967b", "value": "12288:b3sSDOnmk51NAiE/j+MXfVVflbY4czNPqEOiC2oaVlSkkD8/+MQIHrWlfackVR:b3lDoeiE/aoY4cvOiColgHILWlSckVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623399130, "uuid": "90f96f2e-6562-4d30-a4ed-5cdb39185d8c", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623399130, "uuid": "7d8132de-2efc-40c2-b31e-56195630dce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399130, "uuid": "82f11228-7ffc-4f57-bb35-e6068afb4b39", "value": "e79e4e45d069d326efe755963f6cca62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a3f157-ca79-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623390831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390831, "uuid": "3c158644-f8dc-4356-afea-0a0cafb56885", "comment": "Malware payload (AgentTesla)", "value": "429a3063db13e84f8e0843f46b60753e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390831, "uuid": "020a9358-94ee-4e91-b1eb-d72ccbcecfe1", "comment": "Malware payload (AgentTesla)", "value": "62e122a12ea4ccace679e22b13975e1f0e476dda8373279d99b757635c8b06dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390831, "uuid": "a45421ab-7371-45c2-8d05-c58453e96fbd", "comment": "Malware payload (AgentTesla)", "value": "de9221c73fe3610393f1f9197dfecf0896ed776c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390831, "uuid": "329fccf8-e221-4075-8299-2944643ccca9", "comment": "Malware payload (AgentTesla)", "value": "489a86c58435d4ab73cb9d662877e2a3f7b079388a8329351590f2da5473abc2e06901e1196750b4031407d4b2be0b2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390831, "uuid": "e7fcc1df-efd4-4d96-a5a2-a524e3fab609", "value": "C41568F191E003CBC3AEDEF05BD5B3808B6F5AA675398214A94C22FC26ED59D01CE617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390831, "uuid": "8e40084e-859e-4900-be52-cca978320124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390831, "uuid": "522e0afc-1806-4b5d-8de0-bee96c4e6b21", "value": "12288:t1+m5ABVldpNU3FVYWCMWrE0ak3wIJFr8JgoD1py2JeiluZM4e/ZUdtb:tPeeFVYAi3wIYJPDD5pluNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390831, "uuid": "4919304c-a2fa-4009-9fe1-0391e5cdff81", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390831, "uuid": "3131ad8c-5621-4b77-86b8-14190e70fabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390831, "uuid": "24fd1f5b-8e25-407d-b3ca-dfbbe8fdb991", "value": "Factura PO 1541973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f87c668-caae-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1623413637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413637, "uuid": "fa8d78e0-3b0f-4757-a2c1-7548d7773c2e", "comment": "Malware payload (BazaLoader)", "value": "1be4477b6d2aaac2fab1082cd6a93c5d", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413637, "uuid": "3d5cf155-ed0e-47f0-aa0e-f50ef41a1aae", "comment": "Malware payload (BazaLoader)", "value": "63df43daa61f9a0fbea2e5409b8f0063f7af3363b6bc8d6984ce7e90c264727d", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413637, "uuid": "f7c121c6-fd28-49b2-81af-cabb1df20737", "comment": "Malware payload (BazaLoader)", "value": "ee52a2a9c2849df92ff3e06f932efa5b011bd319", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413637, "uuid": "4dbb622b-759b-4988-bc85-2389ce2ed113", "comment": "Malware payload (BazaLoader)", "value": "00a8177dcc690f3d28229074b1beb5284a6b9169c8e50c8794e5a55cf48e21707073da574c7dc03bb75af51843daf118", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413637, "uuid": "b8dfbfd9-555d-43ff-8a8d-8cf61c73e64c", "value": "2F147B03B29500A9DC7EC539CE634512F9B238624720EE3F47904765EE7E791AE2AB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413637, "uuid": "5894cd62-4f01-42a6-b3b2-8d04915c6798", "value": "be2b0be70f2925af4a5677bc370a10e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413637, "uuid": "d1b78733-1074-4979-930e-a7eee2319877", "value": "3072:DHdMzjCsBtskyt+/rO2Aa+tzZugqzl/bi/CXE8cRZkoELQ3C2Up2nJIq/EVCb:DazjTbOyfA3ugAlamE8cxFDjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623413637, "uuid": "5b9a572e-0bb6-4844-992b-1d0e9b07abef", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623413637, "uuid": "4711b6cf-7fad-45bd-b659-c0fe66f2b31a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413637, "uuid": "923fa996-ff34-4127-94aa-7f98ee01d853", "value": "63df43daa61f9a0fbea2e5409b8f0063f7af3363b6bc8d6984ce7e90c264727d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35434fe6-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427257, "uuid": "846f2e34-4fc2-4098-b872-f0b99c54e6f1", "comment": "Malware payload (Mirai)", "value": "69670c48f47a05ee53a11fecb15ce10e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427257, "uuid": "a71d4500-7004-4e4c-9c10-97c50f85a013", "comment": "Malware payload (Mirai)", "value": "6432d3ebb47b494a73d0cc95aadbfdf8cd292cb163b4c4036026d8327b17b969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427257, "uuid": "300a11ec-f96a-462d-a3cc-8172516846eb", "comment": "Malware payload (Mirai)", "value": "72b72e03db54ddac543ded86e8a80ac7ccf89695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427257, "uuid": "86445bf1-62d0-4e96-9759-c89de466bdfc", "comment": "Malware payload (Mirai)", "value": "0c1e666ebdb2f118e7796e04150e34b997128571f52eb518e0e7fa2a78c55f1f59d6f3d77db5968f6f14b73ff3987675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427257, "uuid": "48102828-1352-47e0-94a8-acf7b308d062", "value": "18A2CF5EE4F05286CDEDCC37918C63AD0E55A280B2EF978C83550EC8BCEE596295C1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427257, "uuid": "22208411-ebfa-4b54-a52f-faed20eceea6", "value": "384:7VqMPykTXOhOPnWmZeTRWmBBrQUW4We2R3MNesvw/ew7bzRWGVCz0NvcPq:7oMPy0OwZYWmBhjb/RUWwdWPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427257, "uuid": "e31a05d9-d5f4-4a34-b39c-bcee11e23e98", "value": 22536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427257, "uuid": "1312bc42-94cf-460d-a5c9-aa9238667772", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427257, "uuid": "906831aa-664b-4c95-bdce-a755401c5bef", "value": "69670c48f47a05ee53a11fecb15ce10e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca56c0d1-ca7a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623391429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391429, "uuid": "e63419f3-1981-449e-8de5-4f1f1e6e39a3", "comment": "Malware payload (SnakeKeylogger)", "value": "d186d46efbdb5bd3168eefd1d078549d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391429, "uuid": "31ef11a4-80f1-4364-9535-55078121bf3a", "comment": "Malware payload (SnakeKeylogger)", "value": "650415d9358a84e995b3e8834f5e970fb2b51f1c406309ca2d51c47cca8e7a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391429, "uuid": "f8c308cd-89c0-4040-ae3e-6c4be115cb26", "comment": "Malware payload (SnakeKeylogger)", "value": "b52d012cc5f636eadecda845eefe1bf4853dd4d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391429, "uuid": "b87d220d-e8e2-4326-9608-9e4452ff77a9", "comment": "Malware payload (SnakeKeylogger)", "value": "b89a9dadce0ff6573373ff79e7c775976731732a395c2f83002c2ad8efa461ec19e7f1580fa7c41d49cb66c0503248ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391429, "uuid": "372dca59-a85e-4df7-9a24-29641bbb8a46", "value": "581558F592E003C7C79EDEF01BC0B3808A6F5AA671358114A94D22FC67EE68D42DE657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391429, "uuid": "70fc1480-8210-4827-8940-71a69d83884e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391429, "uuid": "196d5b7a-1f06-4485-81ba-92c1ac77756c", "value": "12288:REFnGsc8oNa5AnYvFCrtSdliUjOZdQ0o0E9VxLVMxu5xFT3BcEyBKTuXZM4e/ZUb:Rxa2GCrteSQ0o0EvoxITqBWWNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391429, "uuid": "d9888733-8349-4359-a892-70dc652e0beb", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391429, "uuid": "4b757167-8e98-4fb4-9276-c744fffbfb3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391429, "uuid": "fe18a891-5a21-4504-b2c6-821995a3a8c9", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8f236f-cac8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623424987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424987, "uuid": "f2127231-79ae-4ceb-917d-57203f6a7729", "comment": "Malware payload", "value": "4071ee7470f09041ebf194caf000a6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424987, "uuid": "e5362815-144b-477a-a3a9-54b56ff90f1a", "comment": "Malware payload", "value": "656a20e4d32cb66812ef2230416b3f3ee94ebcc37eb0d6111ce40116618a3cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424987, "uuid": "d6e83c81-ca6f-46c8-ba8c-9083fbbafae2", "comment": "Malware payload", "value": "e6f82f0ed134772e90b6daf9eb25aff8d6c9492c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424987, "uuid": "fbd03da2-af5a-4bbe-a784-95d542febc7e", "comment": "Malware payload", "value": "39314b661fa00ca915da6bc95ae3b7fb0de74960fc552b3e7d8194789110121cceb6748e3eeb63ba8d7b64ae13ccb857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424987, "uuid": "51e1e6ab-d0c4-439e-a887-08d0ace7ae4c", "value": "7DC412127B00CFBFC2E6463059B3C3261BB89645AB83524BD750BF0E6C725DADD562E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424987, "uuid": "fe09d73c-8042-4aa2-99a5-2f80c8862d30", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424987, "uuid": "2a77f764-ec7d-4f54-8b0c-6db6cc294c65", "value": "12288:8H8QizPV8i6wAdvPdr2htW6DOKOO0t7F9hKXp:8mN87wAdXJ2rct7F3yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623424987, "uuid": "63670935-33b7-410a-9f59-3e74d9d7eebf", "value": 586878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623424987, "uuid": "f19f6f38-5251-4ed0-aaea-3b72555872e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424987, "uuid": "b4b58eb7-d944-4517-a8bb-aa48ceb48ac8", "value": "0900988099900000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8da63a7-cab4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623416391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416391, "uuid": "6977c0f3-3433-42e9-b525-b27b4177d911", "comment": "Malware payload (Formbook)", "value": "4aa8159742becd97f9ecdda33798b065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416391, "uuid": "dc9564c9-ef6c-4367-8f92-cdbbfec850db", "comment": "Malware payload (Formbook)", "value": "65c6621762bb1bb1589a4a58d4ab2d3fa7c02e581b217b86ed2ff51227d7565b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416391, "uuid": "c14eac73-cb70-49ce-9921-8ce57574a7ce", "comment": "Malware payload (Formbook)", "value": "775aee28c33102de8c4bdd45dd09821b717b8678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416391, "uuid": "8cae47d6-bc2a-4f6e-918b-c40092cf7f71", "comment": "Malware payload (Formbook)", "value": "70b83c006c7c8b80ddb8a7ab41dce79d89ab806c44b40cd47c32e6f7b76b21b4695a8856d2ff92e01452109c55275c0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416391, "uuid": "ab1d83c0-5d9d-48ce-8e2b-a839c66d6c44", "value": "5C65BE1022409B10D13A87758C23D6B04FB0AD0EEAD5CA4E7DEB7D9F39717B15A2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416391, "uuid": "95378b67-89b4-48c9-a6d8-3e57fbf8f5fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416391, "uuid": "f1cd72ba-ae1f-4e46-8173-f7174ad262e2", "value": "24576:VENeBUdtwsEgws8e/z8YEoqSg5LlJfH6zMIDsxTt8ZnIYqmaGHB/7YaL:uwBUwsEgws8e5U/BldOpIY3rHBDYaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623416391, "uuid": "e050cbf9-2a83-49c9-9115-f02c7b48bfca", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623416391, "uuid": "cdb68526-ff00-40a4-ba10-590b6fde9cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416391, "uuid": "baf276bd-cd04-4914-af64-0015ee5ffbb9", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc80f605-caa6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623410411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410411, "uuid": "3b4e31e0-d0f2-4c92-af78-de6d601361a5", "comment": "Malware payload (AgentTesla)", "value": "502390a59aad886fa91210a1b89c89b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410411, "uuid": "9740295d-8f78-44e5-8958-e55345890933", "comment": "Malware payload (AgentTesla)", "value": "661bb6d9fd6302e1c06c8d3d6182720259df9ce73b5251127c21eb4883ebcf7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410411, "uuid": "d75e833e-0932-4bb8-bee4-bddde96e15f1", "comment": "Malware payload (AgentTesla)", "value": "b5ccfd3c93f4625bb46ddfb6bd314c7533653368", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410411, "uuid": "b90f5c77-50bb-41c8-b81d-5785564320fd", "comment": "Malware payload (AgentTesla)", "value": "7ae7d5e469f786fed78495d288efa6b296d7c8190eed376ca2f86c953c9272199f65c0970674c7f065347210880775e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410411, "uuid": "9ef34ecc-c3dd-4bb4-b585-1d1d51336c20", "value": "B825F13667889F16E03FB77D5220440463F0F01BA722EA8DBCF445EE0957E858677A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410411, "uuid": "8273df81-f578-4f49-a3a8-826fa5a03d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410411, "uuid": "ab4ece03-70cb-4a65-ae5c-24d33aa66f0d", "value": "24576:aNUWE+vLs3S9FM1o9//fK37535oI9YLNeBUdt:aUWPLUSzM1ohXcB5oskwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410411, "uuid": "79b0e74a-e43f-4e0a-858b-45d9db49d7d3", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410411, "uuid": "b0aefc84-ba3a-412f-b6f7-36aaa12aaf95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410411, "uuid": "0d67d3f4-d503-4913-96c6-75ce65893511", "value": "Scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d36d9ef-cac3-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623422706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422706, "uuid": "65b88db9-e5c7-4e97-9671-bf1125e11561", "comment": "Malware payload (RemcosRAT)", "value": "c196a6270935699ab13a241fedc5e04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422706, "uuid": "24062899-f395-43d3-ae96-e7578d761fa0", "comment": "Malware payload (RemcosRAT)", "value": "6761993e603b7084d87c6abe972c61d7129a11a60bc1ef564971f183b66e6ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422706, "uuid": "bdbb51f6-5164-4abe-b30a-fbe7fc6a4615", "comment": "Malware payload (RemcosRAT)", "value": "876c9b27920335ca8b195a384d97c2376d81e8b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422706, "uuid": "a3985605-f8ac-4acf-814b-b60a2dc3aab6", "comment": "Malware payload (RemcosRAT)", "value": "f52fa4cc8d91dc067d6e91d0e2f1f7e8ae695612edb41c332746cbd951f2b268bf8094bcab6c32b15dd45b6c8ec7cc5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422706, "uuid": "1cf0dc00-ab24-41ad-8a04-29bf2dfeeac6", "value": "9FB4D020A7B0C034F5F752F499BA93BCA5397AB1A72890CF62D616FA46246F0DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422706, "uuid": "df327ca3-c22c-42d7-994a-affa0f797b1e", "value": "1f498f6293a72d723a8c7b4c0a592049", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422706, "uuid": "3a832592-313b-4a3e-9cf6-490c8ef946a6", "value": "12288:p1/zkpQKCw0dm+srXLPr3CB/qiss+LlsfiW3oGdQwOVEe:Xk+YTL2B/qiZfh3FdQrVEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422706, "uuid": "ef94e7d1-3f19-40cb-821c-0f29bd145097", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422706, "uuid": "97cf268c-aad6-47a9-8910-8d357485948e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422706, "uuid": "a89b08df-7cae-44b7-9062-d27a8fe453a1", "value": "Sysdiagnostic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a9528f-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623426969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426969, "uuid": "6a2b9979-7926-4f5e-9bbd-4bc0f22e897a", "comment": "Malware payload (RaccoonStealer)", "value": "4b7f05a9dc569f83f9a2aed17d165e29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426969, "uuid": "9429df5e-3440-43d3-a3c1-4a7e60f6dd07", "comment": "Malware payload (RaccoonStealer)", "value": "67a3f3fde86611605ca136cb40e1ac6d2ac2459d8ba8d5452c0cf601adc86749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426969, "uuid": "302ed332-305f-413a-aba7-287506784a64", "comment": "Malware payload (RaccoonStealer)", "value": "b1cd206ea15d40c48a22a6d7fbf7d832cff907b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426969, "uuid": "47717872-2a49-4edd-a677-35f5b068af5f", "comment": "Malware payload (RaccoonStealer)", "value": "0544536092102920483910a90319a395000b3a75b4d1096700789bd1f369275f181a395a7ead9f0bbb3bf7be5dab42be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426969, "uuid": "287ed89f-fac5-4536-8e55-f648351be394", "value": "2045D022B2B14877CD732A7E9C6741989B267E403D24DC7A27E95F0C6F39681373A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426969, "uuid": "e8d1a435-53c9-48e4-b80c-870a2ac77eba", "value": "0200a5dd8d1709f649a5a9e3e9bb07c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426969, "uuid": "f71d3414-1b88-4907-abc8-cf365cdd5792", "value": "24576:0mmSOqlDkOkFWrvv4n2zjP/zRSp1jP6xl:0mmDQIVWLRP/zRSpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426969, "uuid": "388ad982-b90b-4f31-8737-0b58888f3763", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426969, "uuid": "87b460fc-1743-485e-8a0c-d5dfcdba7fb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426969, "uuid": "dffa436d-e6ed-4bb2-9625-9b9b6e8f0223", "value": "4b7f05a9dc569f83f9a2aed17d165e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b4c3db-caa9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623411312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411312, "uuid": "d5f8cdce-933b-4556-b2a0-070052061451", "comment": "Malware payload (Mirai)", "value": "5f75aff063cb0af47656276bc00c162a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411312, "uuid": "235da841-7700-4d32-a729-77f38597b660", "comment": "Malware payload (Mirai)", "value": "680740ab7217e54ad8002974a4354f3ac5593eb00aad076e33c095db1b6f79e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411312, "uuid": "1d674f87-8b42-4309-aa1a-2663e2337b2c", "comment": "Malware payload (Mirai)", "value": "f0c7721ef593095efa482c4781c9fa434a079505", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411312, "uuid": "0f99238d-6b7a-45da-94c4-70fa756c096d", "comment": "Malware payload (Mirai)", "value": "03063eb6963fdfdb9dc166b9f0babbfb816ea1ed5396cae9a67b43530d820d00be102d51c00ea32f9ded55e3177f2d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411312, "uuid": "aa07cd6e-2225-4b96-99ef-9b3f47d49193", "value": "BB83F785F98790F1C907493051ABFA3FDA72E5291172A3ACFF8D6F25DA27601830724E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411312, "uuid": "36ecebf6-58fd-4e06-a141-3f1c478cb2e7", "value": "1536:YUzqMxvkV0OeuIroLgmef/XIIZHJjRi3aQgHDFSBUj6:Y+qMjOeVroLgmE/r5hRi3ahjFSBUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623411312, "uuid": "21ee0f72-7bcb-4542-9bf8-81036d7b8ad9", "value": 82704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623411312, "uuid": "b514aa01-f0ba-4657-8aba-f073c7913161", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411312, "uuid": "b119bb22-1c50-48d0-80ee-b5b4c98c73e3", "value": "5f75aff063cb0af47656276bc00c162a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a21d700-caa4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623409172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409172, "uuid": "bc433e0e-2470-4c71-9c6d-620a9fb84f9a", "comment": "Malware payload (SnakeKeylogger)", "value": "221caaa44f3f121ad114ecf9a7433833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409172, "uuid": "92de2716-0d3e-448f-9ec4-b7beeaceedf5", "comment": "Malware payload (SnakeKeylogger)", "value": "6844f50385ed2663524a61852b773b9728c41363129d70d8d4f47a14c5c6f3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409172, "uuid": "2c2bee53-13bf-4bc1-9a5f-6507584c0e7b", "comment": "Malware payload (SnakeKeylogger)", "value": "4e5ed71d11f9f58c8e2d8943552cd5e45039c568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409172, "uuid": "8e5f705e-e9e4-494e-8f3c-ee78c3fbcfe2", "comment": "Malware payload (SnakeKeylogger)", "value": "7d457dd2f796c174fafdb8217916e19d240c1cc784149c6bde9c7034d0303a5a8083812df0994133c0f4206907008a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409172, "uuid": "28145b7b-bcac-4f11-9816-a052525fc2f0", "value": "73A4238BA6E59CABE91B0B3421B35B13D33AE31E2744210BD7982F1D9945653B70F24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409172, "uuid": "5681d4f5-8447-47aa-ba74-b9134811f936", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409172, "uuid": "25dc19bf-6a96-4606-908e-98770dcbb1bc", "value": "6144:Ds9U8jUorsTIHcs6rqpDDll9yXsE6px8W4cuRdoWwjs4YU840iisO8SfJszvEV0j:yU8Iqs0HdvtE6pxT8UWtFFzFfi7EVD1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409172, "uuid": "88bab52b-5dde-44e1-854e-5006fd9dac32", "value": 461232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409172, "uuid": "611fdf35-df06-4a1d-b1c7-bfb939552524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409172, "uuid": "94c8d013-fdac-428b-b2b4-5f0c868471fd", "value": "moq fob order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af239cb-ca66-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623382598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623382598, "uuid": "5343c4c0-2b67-4008-8db9-1c1911e6109c", "comment": "Malware payload (njrat)", "value": "595c00bf9ca4baa42b4490f2782cf2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623382598, "uuid": "266029b9-ad12-4ab8-8bad-5b669991681d", "comment": "Malware payload (njrat)", "value": "6884ac9f82a44a7702c4807deec1640b66eb71f6c750dd0ca1d5d78632e626b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623382598, "uuid": "4664ca0d-a4a8-4a86-9396-cf0b157daef1", "comment": "Malware payload (njrat)", "value": "d1441cc336655f36efc3db070f84701a1f68e51a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623382598, "uuid": "97eb15f0-f8be-4613-86bd-8d8148686ae2", "comment": "Malware payload (njrat)", "value": "9a9b1c40597af08d4c8b82cb1a57fcf462bfa66c63aa50d84a89d2c81bf49a1792b4b8eff2a0896ac5a839260c7e6534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623382598, "uuid": "e5b0dc04-dbba-4f79-916d-130c771fe214", "value": "623533EA244DC670DB1BC2B87E0618D5384ECB23BB6C18E720C99751FD36534ABE6587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623382598, "uuid": "03d06313-042f-4128-b638-fb0dd99289de", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623382598, "uuid": "7eac9881-91d2-458a-82c2-3438a6986777", "value": "24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623382598, "uuid": "42a11a50-d015-47e3-b131-e69ac6e445b4", "value": 1143296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623382598, "uuid": "717d79c0-a863-4f99-9e00-cbc32ea1c77d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623382598, "uuid": "c58cf8cc-899e-4716-a2d2-488cc4903b71", "value": "595C00BF9CA4BAA42B4490F2782CF2D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb4c57f-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423568, "uuid": "e6c06212-71c7-4c97-b0dd-0875cc56d8e1", "comment": "Malware payload", "value": "ea9d84ede20de19ad393054161ad0f21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423568, "uuid": "31709012-eea5-49cf-9d72-6badef8eafc6", "comment": "Malware payload", "value": "69140410746b0657baeafdf132abc50646585455a7908ba8cc6d8ccb8be1591d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423568, "uuid": "f819b7cb-3612-42ba-8595-079b0941ea86", "comment": "Malware payload", "value": "856c02bfd3fb790222eb4f7d8a1f5b2438bf36ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423568, "uuid": "f20f4b78-6156-4ff8-be81-3febc854c4c3", "comment": "Malware payload", "value": "d41115583f899935959572de53792832e3bc930f6e3e43558bfc7d9bb875a91e3d2aba209d8d1739202e31820bbc6d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423568, "uuid": "a3102fd1-a345-43ba-960c-dac28a463b4a", "value": "1D92E15981311B37DF267FF43B30A4D0CB756042A69D585CA34C6B8BD590ACCA886FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423568, "uuid": "eae483f1-fa5b-4a03-819f-adf4c71c2e27", "value": "384:3rccl6KRA88Cx5srkG38gEQ7Wg6IxBvNcNiKoSJ/84EWCra+N3ko:7H6KRATCx5srkHyR6I3vNqJ+4nCnNUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423568, "uuid": "c76b3305-3cd7-4958-9af4-77ea2d40d2d3", "value": 20192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423568, "uuid": "b02c0e0c-fc75-4d54-95b8-10693333ce34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423568, "uuid": "a54b8965-f6e4-459d-8839-258177693bf1", "value": "ea9d84ede20de19ad393054161ad0f21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a254cf4-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427318, "uuid": "3c80f25f-1897-4ef6-9541-143ed1414817", "comment": "Malware payload", "value": "20a99069d17cc46c5bfd5c7f99698877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427318, "uuid": "89663a6b-4a2f-4d00-853c-fd025b8fa77b", "comment": "Malware payload", "value": "6a050f1bd9671a12517f5a62985c876471ad0b1a4ef60f92267d4a9ecfbafb5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427318, "uuid": "a5716650-e753-405a-b4aa-dd63097f419d", "comment": "Malware payload", "value": "16665b4d5e9d2307ebf2abe5542efe1ce7e76902", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427318, "uuid": "19f76fdb-aaf5-4b12-a245-e3487214b5d9", "comment": "Malware payload", "value": "b4bf560a6fb461b60d2ecc4a2b3fade5c709281ebb14d835936bd2ec645ca05ddc1fc6efe7e7bc1812ae9804cf8c5e11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427318, "uuid": "57a26743-8d3d-4783-8e30-9bed3bf0a5fd", "value": "05C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427318, "uuid": "f680afa1-5645-490b-84cb-f94a134e35c6", "value": "3072:/YNa/GLBNPoQKphakpiQ9/nYEP/UnSQf/R:6a/ylo1phakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427318, "uuid": "3c9820ed-53a2-485a-a142-fd341578d0b0", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427318, "uuid": "f438cd69-1899-4251-b2fc-27c03b0895d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427318, "uuid": "c392f511-f52d-43c1-9a3e-89c19c7d4cdc", "value": "20a99069d17cc46c5bfd5c7f99698877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af03dffc-cac1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623421877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421877, "uuid": "6ced969c-39dd-4514-8fe1-f2ec6ccb0202", "comment": "Malware payload (AgentTesla)", "value": "c24db33dcb80c125929e56b349aef88b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421877, "uuid": "8aa03e8a-befc-4327-a680-f601c8ba82c6", "comment": "Malware payload (AgentTesla)", "value": "6a994554941a4823012414ea3de13cd21a9ed1e5c0ed4648fbfa91dcd81dae79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421877, "uuid": "128f3c28-00b9-4515-b2c5-b190c91cd961", "comment": "Malware payload (AgentTesla)", "value": "685b0a2469c84129e35f5009d5f46477212f10ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421877, "uuid": "55f99e56-2244-4131-b990-7d348e2dfd2b", "comment": "Malware payload (AgentTesla)", "value": "440b34fbaaa96349f5a5ce9bb1b2efca6b198cec8a24595646e5acc1b625eff7511a3174ba41027d2eaec07e815cdc35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421877, "uuid": "5f3ecd36-aa2e-436b-bf12-2adc324415d9", "value": "5705D0289EC4DA8BF37DC3748078957C83FED02B9B21C5856EBFA1DD8E66F44A852105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421877, "uuid": "a64a2e7f-528f-45cc-9d72-1e8ea82f29e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421877, "uuid": "9a64744c-2a1e-477c-81e6-db0c486ccd98", "value": "12288:U5xYukolMV40DBkqgoF7qxCUzbH4ZSgt2J0jC6yn9u3jbDMVL4qg+pwn3:U5dkoUDB4ohq1kSgQJ0Ch96DA8F+pwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623421877, "uuid": "343bc4d6-9733-4dab-a9b6-66da8201d96a", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623421877, "uuid": "7d4d258d-fd23-4622-be3c-d8e293af8798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421877, "uuid": "78e2be84-0972-475b-85d2-552bbb140920", "value": "NEW-ORDER.(Ref PO-298721).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8720bb-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423564, "uuid": "010f1b7d-0e53-4be4-afa5-9444b8468d1b", "comment": "Malware payload", "value": "1e47f02ebf83df2e4acd7adedd366dc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423564, "uuid": "d5ffd98d-6647-417a-8639-50d79af1f15c", "comment": "Malware payload", "value": "6b7f12865d0cd2540e2fe0e7eb6a1de7c9ee20c962382d4785c5464199dd4316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423564, "uuid": "2fef3010-0c70-4ef0-beb2-dd4b22dc2603", "comment": "Malware payload", "value": "88f59688375824b104e7eea00f33b7077cc626ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423564, "uuid": "79f11589-976a-4751-b59c-ba749dd0d54c", "comment": "Malware payload", "value": "b8bba9c25d063efe0b7e7ade160b541066a35df0e7a49593a9db23f10058c07c6bd60548bdc4bf6119375cd74157fdbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423564, "uuid": "537adf17-a7b8-4e66-8e0d-76e7c310405f", "value": "DC92E12B1A207F14FC83123D54A99E24E538E227D26BD356A0C87F5BFE33315E5B0059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423564, "uuid": "28dd4d0a-6f48-4217-9cb9-2d4c24773049", "value": "384:Mj1Eq5xLER+vHPOf3ZSykPOPQs7/xxkKZ:+1R5hEcuhSyUOPQs9x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423564, "uuid": "459dd391-9428-4471-8e4b-1b13021a56a9", "value": 19484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423564, "uuid": "93ddd5b7-143b-44b1-9175-97186e4e7cb7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423564, "uuid": "c569ba48-5a31-4f37-850e-84376db1b12c", "value": "1e47f02ebf83df2e4acd7adedd366dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377ecb79-ca7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623393330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393330, "uuid": "fe0efa82-117d-45a7-ba43-a06ffb692ac8", "comment": "Malware payload", "value": "02964b771fa8d545411e3e3675b5956d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393330, "uuid": "c093376b-d8a4-49c3-b768-d9bbec9e5ff4", "comment": "Malware payload", "value": "6be657cf8e28f5473102498b6671c000cd0013bfa02c1dcc248925bd78f148dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393330, "uuid": "aa84edba-d31a-44f8-82a0-264d3db88fce", "comment": "Malware payload", "value": "4ca05e7ea548f1295409bb2f35686ef85e29e003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393330, "uuid": "e273dd21-1ba5-4e8a-8ff0-043f9f400b25", "comment": "Malware payload", "value": "a4a3661901756946e08978e66777ad3e3e3a96a1b11f8d9f4ebea5671871cdac071faeb9755876316a33c6b959869926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393330, "uuid": "f64a1e7c-ee1e-4dc9-985e-7c2d5e630dc1", "value": "A1D5334A917A289AF2FF16788460D8B765FDE306ED03EF5BF01843214EB57C3610BA19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393330, "uuid": "fbeb7a9f-359a-4b23-a9c9-a356c90f1d12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393330, "uuid": "30c0a6a9-0c40-409b-9bb3-9d38bade10b2", "value": "49152:yL6srA1WXguBZ2rzFPKJOklgyOBLxSXw+W7SClcW0BQB6w4sn6iVyLIfI:yL1kUXguBZXOGVYkQvcBBQB66n6ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393330, "uuid": "a0460c88-0b4e-4b37-83a2-bc84d1704d09", "value": 2940928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393330, "uuid": "9e9431bb-5226-40a2-becc-7763e0d77438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393330, "uuid": "c44fd801-5d71-4f52-98ed-5308f4e1e0f6", "value": "02964b771fa8d545411e3e3675b5956d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7a3153-cad0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623428124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428124, "uuid": "d16bc640-e5bd-4e81-8a2d-9f6f935e7b69", "comment": "Malware payload (Mirai)", "value": "e54d851d3895de15a68149e6a723f058", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428124, "uuid": "0f954742-55c7-40a1-8415-0219a1846c29", "comment": "Malware payload (Mirai)", "value": "6c5e98bacf6737334b8fdbf4c8aa06f87bebe316eda93a3b8286ddce2d377297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428124, "uuid": "a0ba54b9-fdb4-4ad1-bda5-6aa65be6dba7", "comment": "Malware payload (Mirai)", "value": "cda27357cd6c0bc8676f05ca5a0febb4c6fd4811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428124, "uuid": "b9400e92-873c-445b-8c79-5f96ddc30587", "comment": "Malware payload (Mirai)", "value": "a40e836e6f14fd980bdefa582ac5d1e861891665fb32cdda805639cd7b8acdfb5ac8352fd5ea885164f5c20dd62ffff0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428124, "uuid": "29603eea-26c3-4ed3-b9c2-710894809645", "value": "9B63023C75117553DE34083097DD460DAACEEC62B2BB38A225239799652780D3ECFD97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428124, "uuid": "84b8cdcf-1649-4016-95fb-1a8ad016fcbc", "value": "1536:aSU8kW7OS3HuK+xYHbX7Gg5HIHjQTBaqDL+Rfx2bFpiAyiNHp2XLrB:jU67OoH9+uHnGBj0BaML++bm0NJ2brB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623428124, "uuid": "3aa12eeb-d476-43ff-b4ad-158921d74810", "value": 73148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623428124, "uuid": "ebbc1d46-2745-4f7c-a79a-58ce07dc60d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428124, "uuid": "ce7906e7-3e90-4bdb-a495-ae6f47e66f5e", "value": "e54d851d3895de15a68149e6a723f058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fc276d-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1623397227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397227, "uuid": "700cf4de-7649-472b-9e7e-d5857c3d52ce", "comment": "Malware payload (FickerStealer)", "value": "86234cc193309f58baa991edc17e6e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397227, "uuid": "b813a9cb-c7cb-4926-bed4-38f757465c61", "comment": "Malware payload (FickerStealer)", "value": "6c8b67843326b740d17af91ba222e513fb29c45b6decab158009e71f94a8e62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397227, "uuid": "222f3c70-461a-47da-aa28-881d5dcd9add", "comment": "Malware payload (FickerStealer)", "value": "0427b7001848e22dea92ce575f5c71b46cc6455e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397227, "uuid": "d5bbfea2-9a06-450a-81f3-9ff94fcb0498", "comment": "Malware payload (FickerStealer)", "value": "2e6c8e79c2e4d96146dae8cc214fec45069011b72376ecfa30993d503cd5e936aadb0fc25c7b204fffa4b97f8ea6dd00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397227, "uuid": "3cc0e167-b424-406c-b992-f98db4fa74e9", "value": "80063301BED098B2D5B61A374E799B23503A7D110F299EEB53E8599DCA301D1B730BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397227, "uuid": "01a88e2d-53bd-4763-b7b7-6d78eb65cf95", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397227, "uuid": "1728b112-7b86-4210-b6df-f8973d85addb", "value": "98304:UbPFZRT8F+BmZ+DrZ3smzo5q9fBXSB47C0kyZ9OR:UfJ8F+cAp9fJkojOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397227, "uuid": "70a6abad-ba38-4ff9-9b8a-c0a4d029aacc", "value": 3949060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397227, "uuid": "513e9ea6-6222-4d93-9906-d18c61f00a55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397227, "uuid": "b880b463-091d-43b6-ac8d-c7984a08d15c", "value": "86234CC193309F58BAA991EDC17E6E4C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fce88d-ca87-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623396862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396862, "uuid": "f907e9fb-ec93-4810-8767-d92269e12526", "comment": "Malware payload (Gafgyt)", "value": "09208ce604f3ed21c90ab43e1bec2bd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396862, "uuid": "7a2ea281-7b82-4fbe-b28d-34816353e877", "comment": "Malware payload (Gafgyt)", "value": "6d5a5b2804005c33b8118567a5743c06a98b3a8c5377cdb8fa66243354cc592e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396862, "uuid": "e7ef2c41-83c8-45e7-97c9-8da6e953c401", "comment": "Malware payload (Gafgyt)", "value": "6b88b848e4888b030d21805ccd3762a60a695c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396862, "uuid": "9e82e6be-78c1-4aba-866f-746eaf1a7aa2", "comment": "Malware payload (Gafgyt)", "value": "e7d90ea93cf66c211b668e057b38ec03a4b736a38734fd097908e7f36734e8a48ef9882918344be61e5d9f7b4dd46740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396862, "uuid": "a3ea2f4d-cf8f-4b95-9901-21b7d05788a0", "value": "66933A0388619F77C14669B135EB1A300767BE220F5F1F99766C9AF4074B9CEB50EBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396862, "uuid": "5b6acf06-961f-4cf4-b146-b0f471b957a0", "value": "1536:b1+NWehaTLjnKRuccvu/ebbYxFDcCF5hA9bCEJDMnhR090jUeQfXm:pWcmRP/eb4cI5hA9bMhR090QeQfXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623396862, "uuid": "97386a5c-2670-4df6-a245-21eb4b68701c", "value": 97017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623396862, "uuid": "819cd442-0006-486c-9451-3e03b296dbd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396862, "uuid": "fe1b47a4-8426-4867-86dc-1c5ce83ed929", "value": "09208ce604f3ed21c90ab43e1bec2bd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8872b9c-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427020, "uuid": "504659da-9ce8-4fca-a670-a49fe185c8f3", "comment": "Malware payload", "value": "22bb6f4576f56782a7451a38e7b84472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427020, "uuid": "1a28548f-b3e2-45fb-925c-0c20a9574d37", "comment": "Malware payload", "value": "6da9c799faf355bbe41c2c046afbe668084de0629af8c86671123391f078a27a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427020, "uuid": "a6f05d8a-fbc9-4a85-922d-6c632476baee", "comment": "Malware payload", "value": "826f350582ce49c8d78452f7631935ec6e156aa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427020, "uuid": "b953667b-60a7-44d4-8ee5-6967f93afc43", "comment": "Malware payload", "value": "a7a251b7d95d640eed0f4f103ae26786d3b49195b49f1229152a385f8c1f627f591dcd6b1af6c0698f3e89a68f9524c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427020, "uuid": "6857108f-65fd-48f5-90f7-447e74769dbc", "value": "0E21FC0DF2982D8FDDA71438642F023670307A5AF4135013E3658E3F7A7B5D4220B18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427020, "uuid": "6bb5acbe-61f3-4abb-9dd6-0078cb99a10b", "value": "24:3AaAa8DzSWPpbP78Pwy74+CiCTHv//hHrJbD8ECAfGoioxj+rXSxNT1AhCQ:QaApP3hb/mkTvnhLJH8DAf67XSxNh8CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427020, "uuid": "3a4391cf-49df-43f4-bc67-7cbe5c89b7d7", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427020, "uuid": "70f0b18a-4008-406e-a0f2-c431b8a15196", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427020, "uuid": "f4662be6-71fb-402d-89d3-4db1e8aa6861", "value": "22bb6f4576f56782a7451a38e7b84472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ddeec2-caa8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623410880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410880, "uuid": "87e826d5-5c45-4a6d-8a06-21c75fe8807a", "comment": "Malware payload (Formbook)", "value": "3f4cc7f69f0d3b70a20dfd2243bc16db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410880, "uuid": "9a3d4515-e373-43d8-8b95-5351780a8cfc", "comment": "Malware payload (Formbook)", "value": "6e556200dba57fdce36308bbd34c19398ecf627828627b380244aeede2f90176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410880, "uuid": "8823f7ad-b190-4ecd-8af6-e17a33a4c4f4", "comment": "Malware payload (Formbook)", "value": "b0e2841f5c7d754e4af796088b659c204edf5fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410880, "uuid": "2d734d9b-78e6-4213-9174-2067ba292759", "comment": "Malware payload (Formbook)", "value": "f31ba23e2479d75ccc7a648049ed909c3a5e61fccb80f4d6c72c9c403136dd19c08965b8847a361f040d9a1960e1f727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410880, "uuid": "8f6934ad-d901-4685-bce0-224a5f48c197", "value": "AB15D4AC366072DFC467CD729AA81C64EA61347B931FC207A01315EE9A0DA97DF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410880, "uuid": "a30e9e29-5df0-434a-98ea-3ce7b359eb5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410880, "uuid": "7ff7692a-43cf-4608-9dc4-02336a00113b", "value": "12288:yhS4xbbDSZqDULqJeVC/59xQ0tmvkZjsn+o2JUHVe6zDXhscccku2sX8EFObPpan:yhPx7JeMhY0t/i2JUHVe6zbO/u2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410880, "uuid": "36eb0c77-f9e9-4073-9a1f-9322fda0a269", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410880, "uuid": "1ea6ec4d-990b-4c62-a44f-90f3ceccefbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410880, "uuid": "e4377f12-de09-4f3f-831a-eb5c19a8e418", "value": "Order 275594 04-D4E5A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b305c3f5-ca9e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623406852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406852, "uuid": "19744d5c-3514-4f5f-af51-34f637777fd8", "comment": "Malware payload (Formbook)", "value": "21f077fa0e739f6174e2452abc30bb7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406852, "uuid": "3e9eda63-1a54-4d46-bf6a-eab716c7d554", "comment": "Malware payload (Formbook)", "value": "6f536ae781fd98358126408aa6991b4bb3ec3f9940929a22b25f785b71ec770d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406852, "uuid": "2aca2fdc-5afc-4db2-8863-d76ea3c8f25e", "comment": "Malware payload (Formbook)", "value": "9d60988db53eb662eb6a8e2f824036348f5e7ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406852, "uuid": "b98edab9-a05b-42e9-bfb7-f9aa3a2979fc", "comment": "Malware payload (Formbook)", "value": "387ef1f64b06dea2a3c6915a3761590523ac056d61d8f99e615574eaa10fe2f866f3e5071add13c00bf2af0ac6c537ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406852, "uuid": "e808fbd7-579d-4a92-b0c0-4f218c91f157", "value": "3735D598547898DFFBA7433ADC00B2647496EE983585984631A3F7B47D337802A2DB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406852, "uuid": "de80021b-3a8d-4d46-a5dc-0cccc36de45c", "value": "e077016a28329385307019c238609f17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406852, "uuid": "7827b9f7-8082-4414-83cc-28ffd00f2ea1", "value": "12288:D1cg+pOHH8f/6xUJ492ctspCbQHA8N44Oo40vqX0uNb+T0HXX+jBnnXLVgKR3mEx:D1BjH8f/6AwbL24Eq/XQBmEsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406852, "uuid": "011cbddb-e9c9-47ef-9ab1-287cb81aab14", "value": 1081696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406852, "uuid": "5389a044-6543-4274-8ef6-0abdf8a7b829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406852, "uuid": "a92141af-af8d-4ab0-99d0-192c1c905c29", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db958d7-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427271, "uuid": "4115760e-0d37-4c5b-8f39-e489669565b2", "comment": "Malware payload", "value": "9765f8c2ce12fda76f47f7e0eea0f259", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427271, "uuid": "c3e5a25e-0272-4fde-9d45-b6bf1b15bebd", "comment": "Malware payload", "value": "70038549170d08a27c95d7fffc05dae21ef8b614d73474f5b1a4f6c4b0932fbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427271, "uuid": "9e6a9666-a6c8-45db-bc52-dfb0f0e96640", "comment": "Malware payload", "value": "17b27a5bf7d50aa8f7f1f27a5d62d06a8c87993f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427271, "uuid": "620abc50-d6d4-4804-83b2-879f23e82acc", "comment": "Malware payload", "value": "badd73fcbb844870c87b844b2e4ddf31f5a2e9788183e7f0258cec7d44966dd19f2beca8f5f4db114dcab6d3f181ce7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427271, "uuid": "5440ac20-b1c5-4819-b0ea-3c4f505ba8f6", "value": "7264029BE9727C4BEE4B4FF021A70A461BF8D2DAD3C659907368448439FE24293647C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427271, "uuid": "e1a2399c-10f2-4e67-b994-d25babc81cc6", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coa:7O/QJHZweEL/NOjCHm7FZZnch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427271, "uuid": "867f1f7f-5648-4172-b12a-3002de490f9c", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427271, "uuid": "7db6b3c1-f4f0-4616-9011-99e46d20315c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427271, "uuid": "80ed9fcf-2d05-46b1-b39c-093717f6c77e", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68266449-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427342, "uuid": "d1defaf4-f52a-4931-9085-0f2ae9902d9d", "comment": "Malware payload", "value": "f1165da1bf343c5c986547c184311156", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427342, "uuid": "b154e8f3-6180-4be0-b883-8297edb12b99", "comment": "Malware payload", "value": "701e8e574a0dd36e0c28628721496a57a48f94e49a60b354520f7127da76b6f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427342, "uuid": "be5fc6fc-f4e6-42c8-8e2f-13bb453ce040", "comment": "Malware payload", "value": "dcb2ea86fb4501648b088c6de0b9520ac44e6c28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427342, "uuid": "7ddb0781-2eeb-4da6-b299-6c46ee54dbc6", "comment": "Malware payload", "value": "635cf12465061a336783303181d083e311e89852e4133e7429a933dbcfd0576bc0f9b71277dcbb8152de8bf273785edc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427342, "uuid": "f352be88-e7b4-4dcf-b891-ffeff08396a4", "value": "C4F2F14FCD89EB5BC89A4D3A50885734AE5464DA73960FE417200ECDFA70947BEC663C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427342, "uuid": "04e8b3bc-1c81-4592-a9f6-c688845dcf97", "value": "768:Y0VbbuTWVRwAaRX9CVgtzEqWF7l3zdqhThRgzZnMiQ0t3Gi4k/5gWn:NVnuCHahQMZ4zAThezZnMMt3Gi4KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427342, "uuid": "1eda19b4-171a-453e-9327-e9ef51a50da4", "value": 36992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427342, "uuid": "1beb5a5a-2158-47fa-8857-21ce27349990", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427342, "uuid": "2e4a0b8a-d7d9-4637-a41d-b352e749e694", "value": "f1165da1bf343c5c986547c184311156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c524e35-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394197, "uuid": "22bbf6d2-64b5-4042-8120-828fa9385409", "comment": "Malware payload (Gafgyt)", "value": "27bdd5464961c22aac37b878959114c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394197, "uuid": "a7ee8dae-0cb4-413a-b6ae-3e5d519ffefa", "comment": "Malware payload (Gafgyt)", "value": "7054459cf6da678f452e3eeaac2b9299762aaedd10ef4fa6a0654bdba16da78e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394197, "uuid": "8cb38917-dc87-45f4-b474-9687fa8f20c1", "comment": "Malware payload (Gafgyt)", "value": "1615c3e87a9b81b92e042a1d7c11de3473fb766a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394197, "uuid": "5d4f442d-66f1-4bf2-ac10-b708db92550e", "comment": "Malware payload (Gafgyt)", "value": "63bf50fb39c8380cf5b0942fdb004b4ed4a036a53e442037b0ff7358926b99d84b6332b818931b861d166a51b34f030a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394197, "uuid": "13099f33-0515-495c-ba3d-073ac804c36e", "value": "37734B42E652CAB3C8930BB6029B5B264A31FC3A1E2B9F59F31D7DF49B124C87217355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394197, "uuid": "69dacc68-41ab-478a-a098-1eba1745fc6b", "value": "1536:0+xNVpyQWuKv8xKBnq5PeOj5zML+amLI2VOCjXUfJRk:nNTI30xKBnq9eGlamU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394197, "uuid": "307708a2-b5e1-4b9e-8b53-c35ea66410eb", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394197, "uuid": "44eb5554-bb26-4ecb-b110-cc7f38ffe5c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394197, "uuid": "217e32ae-7358-452a-86b0-d2d53c05f288", "value": "27bdd5464961c22aac37b878959114c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85862ad-ca7c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623392285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392285, "uuid": "fd7cc5be-2ee9-4713-89a1-3816dd31de40", "comment": "Malware payload (AgentTesla)", "value": "7c8ebff62083aaaa70e6ca8311776afa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392285, "uuid": "66da1db6-7f0b-4144-9220-f7405bd3dd3c", "comment": "Malware payload (AgentTesla)", "value": "70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392285, "uuid": "612f61af-ef08-431f-aef6-ccb1e20ecde6", "comment": "Malware payload (AgentTesla)", "value": "ae068ca1a02edd4f2e50657a1f223e86f1bbe499", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392285, "uuid": "be6f1c1c-74d1-4039-9785-23a32919cbf8", "comment": "Malware payload (AgentTesla)", "value": "8895dd95c1ea8cd6b56264d3cfb0f25ab843956e6ee315986501bf6c1e7e0164b2c8e3d89546e02981df1b452e416557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392285, "uuid": "ca847257-e505-4637-a0f8-5663aa53d6ca", "value": "1F1579F565E047C3D39EDDF187CAB3848B6F5AA231328211E44C22FC66DD28955CE68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392285, "uuid": "2c2ce36e-b7a7-4470-8149-7d38d3c561ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392285, "uuid": "63d81241-90d1-41fe-a315-af00c0d4c187", "value": "12288:etYPbbR3qpPHzhM+2KObZUQW+v5JKAn77Oc9NGlqeEsXaYXZM4e/ZUdtb:eWjbo1HaMObeQHRJKjINUaCNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392285, "uuid": "470f4dd2-95b8-4e48-8c4d-ba70c1afdd2e", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392285, "uuid": "1590bbd5-7cd8-42a3-83c5-56746453c94b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392285, "uuid": "9dadb0b7-07c9-4a7a-93f9-0b093d8da151", "value": "Proforma Invoice No. 14214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4387e70e-cacb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425992, "uuid": "ac70e589-c774-49f9-8514-6afa25ca651a", "comment": "Malware payload", "value": "1bfc630e4042d9c965587ac1d3354b1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425992, "uuid": "fea34589-ada4-4e5f-969e-0b60943d4b89", "comment": "Malware payload", "value": "72a2d46a719d0f91dba8feddf983e956bbe2bc369e05184dda4091e424745f72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425992, "uuid": "29ced5c5-27de-44c8-977b-908b25bcd3d0", "comment": "Malware payload", "value": "27a5ca30ec117af772a2a0ef3bf1f7bc660b8ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425992, "uuid": "3d24898d-9bc3-40c2-a294-d03e4a7aed37", "comment": "Malware payload", "value": "e611817ff5d84dd7c3ed4ab39a6bb1010d3029fcdaab2893f48e5357e5598a0702761c0e74a68152dc3c9581f523ded6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425992, "uuid": "58a214a5-c9f7-4616-82b9-00f382b21626", "value": "5CF2E066D6294A53FFEF3B350DAA52D257882BB032BCCAA311005FB49943B62D755CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425992, "uuid": "1e4a5cdd-9b99-41ea-ae7b-f92b2abccce2", "value": "768:DHjObYgSEZUiqxUJdmKlnNUPUJtABztU4uVcqgw02NWXzP58BR:zjObYDEZBqxUJdmKJi6U5U4u+qgw06Wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425992, "uuid": "edd5ec6a-17d9-48b5-bf29-98af4fb40bdd", "value": 34800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425992, "uuid": "44723779-4c8c-496f-b0ee-0a38d47a0b59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425992, "uuid": "96857039-6de3-41b4-9907-9ae5f60fc60c", "value": "1bfc630e4042d9c965587ac1d3354b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a631e949-caab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623412414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623412414, "uuid": "cf76f122-9f19-4448-8252-4ef17624c775", "comment": "Malware payload (AgentTesla)", "value": "95201005885c91db292adaae627a5d57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623412414, "uuid": "562c3590-7b4c-4b1c-9d0b-95eca845768f", "comment": "Malware payload (AgentTesla)", "value": "73f2e9b534cff49f248d0d3469902ac7c3150da888786e5cde16a935ce4ce0c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623412414, "uuid": "c050bd4e-5ce1-4f7c-8773-5dcf6a11b0f6", "comment": "Malware payload (AgentTesla)", "value": "d172e70ecb7f3206bcd34d7d5b51be54d9bdc350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623412414, "uuid": "2488d64e-7bf6-443d-9874-69857b8a8298", "comment": "Malware payload (AgentTesla)", "value": "f02f233f298556cf2f92712a9d83cbef9d34af9e3982a9bb524d1d2f6d5f41543d920c5eb8020fdef5a72c010e483941", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623412414, "uuid": "020aea67-f298-455e-af4f-a4f2c5141162", "value": "36157AF5A5E107C7D39EDDF183CAB3848B6F56A231758212A84C22FC36DD29925CE14B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623412414, "uuid": "0c571420-c2e4-4037-b74c-afae321c5b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623412414, "uuid": "5d71f8ae-d89d-4cc8-a769-6f404ee65ab3", "value": "12288:4IiPCg6zYjxAYcfPxu87cSumg7G+pPM0rgpmDKuedZM4e/ZUdtb:4NPC1zSeHXh7cH66PmwDxedNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623412414, "uuid": "0016bb99-82d5-4849-9dd1-575f2afdfbd9", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623412414, "uuid": "7f9ac3bb-b66a-4c39-a36d-4005cdc56485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623412414, "uuid": "faa7e2db-4161-4f83-bfa6-40bf965e7010", "value": "SecuriteInfo.com.Variant.MSILHeracles.17940.23513.15553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735ff3d7-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426931, "uuid": "0657d81a-be3f-4474-ba71-b70c46678670", "comment": "Malware payload (Mirai)", "value": "7d1cf92479ba4c62b95fa41c4303c02d", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426931, "uuid": "15468bad-3b49-4c2a-8852-1bd84187b661", "comment": "Malware payload (Mirai)", "value": "743f8cf1de199bf3fafa32deda862aafece6308af0db7426e832a48595becd0e", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426931, "uuid": "f554363a-620f-4d81-93eb-d98553e4fdb4", "comment": "Malware payload (Mirai)", "value": "177ebadc02750d833dad30136cb29dc24bf62ac2", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426931, "uuid": "6fc32acf-7b1b-403a-8075-6a534dacd1ce", "comment": "Malware payload (Mirai)", "value": "e11180e9a66ff48ce41da03e1c48eac41cb95a28d96f5e787019a9b517a4b197ef8248d6144430aa27f1f271b34d1a9a", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426931, "uuid": "9c4c0976-d5e8-4b5b-81c8-6705c2c7d154", "value": "A3C2E126A215CC10CE710C768C74A0C71D194BF0F9BE587E6D764CE835A488E2EAE7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426931, "uuid": "32158311-5740-436b-a0e9-d04f3f325866", "value": "768:99xM13LhiOjyPNXdXKZzk8/+/HZ8uaovuvWg9q3UELyN:92h7245/0Z8ujvuvwLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426931, "uuid": "5a127003-c6a7-4f76-9bd6-fac34293f8bc", "value": 27444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426931, "uuid": "123ea36c-5f9e-4855-9c29-20132ab04865", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426931, "uuid": "92e7745d-7d61-4d01-bf3f-38b852e5aebf", "value": "7d1cf92479ba4c62b95fa41c4303c02d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0f9e60-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (ImminentRAT)", "timestamp": 1623389793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389793, "uuid": "600466a5-f36b-494b-a2a8-42cc6f7555eb", "comment": "Malware payload (ImminentRAT)", "value": "0ded8995c11ad86472bce12ffaeacfaa", "object_relation": "md5", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389793, "uuid": "523eb506-1c5a-4a7b-b633-deb6ed27c9ae", "comment": "Malware payload (ImminentRAT)", "value": "7474d79bab51fd603a093f10146d59540b4a89f9829bdc7fd607b4ede61cfbf7", "object_relation": "sha256", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389793, "uuid": "6c103682-52b5-4065-8997-8519da2abc90", "comment": "Malware payload (ImminentRAT)", "value": "fede609f35008cea7ac603ae836138cef588887e", "object_relation": "sha1", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389793, "uuid": "f04f8531-1e7f-42f0-8bc4-385ea02d0dca", "comment": "Malware payload (ImminentRAT)", "value": "28a4c02ba4337abca340494959162436864b2fbc4a9af4596586ea8ed295f362be270d58f26957633700dc7afd730444", "object_relation": "sha3-384", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389793, "uuid": "bc191c35-29c9-4b64-9cd5-f7be1a280881", "value": "AE5523161ED70F4BC56BD27970C6AA2900F4ED056752839327AA372FA332B7913E631D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389793, "uuid": "95bd181f-2b94-4788-8199-10c54370d771", "value": "24576:ph53rOf3GarsjlZDMTMzxiy9AD76OQNBEYV2bB1wNwDg9jeVVnJhfNX4lLnW:p73rOf3tgjlZDMMVg76bzq1wNwDiQVF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389793, "uuid": "5e0d4bd2-243f-43bc-8ba0-82553c21f582", "value": 1352088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389793, "uuid": "83734836-16c1-4d50-9fdd-d0123210c228", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389793, "uuid": "bf3ba6ac-5057-4165-b53f-5862c83320eb", "value": "Request Letter for Courtesy Call.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed14d74a-cac4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423270, "uuid": "b29da5b2-b14d-4aee-b277-535256d5d2b1", "comment": "Malware payload", "value": "15d907e7d9f8286e5053796c9d78fcec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423270, "uuid": "430ebfe1-f385-4d5e-8a99-09b7a570ba20", "comment": "Malware payload", "value": "771e4f69520f71afe6a6e9a4eb4de7dcd8d7521d90db290ca6c27b1a95c532af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423270, "uuid": "1ceeca8f-1885-438a-87f7-af7451c0471a", "comment": "Malware payload", "value": "b7d7329e94e2292ed53e2778cebec533ac599030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423270, "uuid": "3d32a705-0ca0-4bda-85d9-e2f334a245fd", "comment": "Malware payload", "value": "66c649a335583c81e02f8d06720533ace55ba54977402c83a4009234c3fedc034518851ce0eaef0a5e89742ed8d80b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423270, "uuid": "184cf45b-13f3-49ea-8ddf-9fe01c5cd99f", "value": "0925F13167849F15E47F777C9524400867F5F02BE322D78DBCF485EE0922A818AB7A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423270, "uuid": "8bd4731e-c392-46c9-9b42-819f4a91163f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423270, "uuid": "ac2df0b4-6b77-457c-a67f-2879fafd09d4", "value": "24576:vo2y0RBSy/DrDoqbg1L+8XAaIXqziNeBUdt:vXNzrrDoeg1qYBIOiwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423270, "uuid": "6773cfe7-8375-40a8-84a2-c0aeb198413d", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423270, "uuid": "da654fef-b3b5-4704-8a0a-13eeec36717f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423270, "uuid": "cb411c0b-7db8-40de-92f7-bfd38db453f4", "value": "15d907e7d9f8286e5053796c9d78fcec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8249853-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423611, "uuid": "7e5beba2-666c-4503-9c2c-d414849db029", "comment": "Malware payload", "value": "42d4d3d0b42d64249bccb19f41697168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423611, "uuid": "420a6558-cfd9-4ee2-bfcc-154df023f753", "comment": "Malware payload", "value": "772ba1a8a29c1cb88060006dc984584eec74def45e7c432b8bf944860f65946f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423611, "uuid": "87b67880-7054-4b9b-9f07-bf748d793c7f", "comment": "Malware payload", "value": "b75f5d0e598228e8fd3ff80a7ec6e0500003949c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423611, "uuid": "2becda36-7ccf-4034-9591-5727816f5c7b", "comment": "Malware payload", "value": "691ec525956215605bf536b4a676db67db5d33851fd4d7a63bd063af4ca6398b655bd3a4ecbbd35d73998e5c13115010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423611, "uuid": "0826fe0a-5983-42ba-8007-04a6cfb28159", "value": "08933A07B71C4F43C1DB59F029BB2BF15765B9E112A36181B91BAED04B33AB82523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423611, "uuid": "c3347062-31f2-49c7-bc99-fda757076f67", "value": "1536:v3oCHK7pwmQVTXUvbwPzLDOHMyILsiO6aRv/lz585hPJ+8OFO6V6qDjjofSee:v4L7NQVTXUm/gvILsi2/A5hPI8OFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423611, "uuid": "f9ef81df-8da1-48d6-9c10-f83fddea4cc1", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423611, "uuid": "9dbd68b4-46d4-4173-998c-c89b886b5b80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423611, "uuid": "e1eaf06d-27b2-45a9-bbe1-4ed15372e7ea", "value": "42d4d3d0b42d64249bccb19f41697168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc11a646-ca87-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397096, "uuid": "4a3319fd-8af6-4597-9eae-c9a49f561158", "comment": "Malware payload (Gafgyt)", "value": "70fea3a73945ffcbce03a3ce92e13540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397096, "uuid": "ff30a113-8956-4c28-a369-7dfa5501a71f", "comment": "Malware payload (Gafgyt)", "value": "7aac8ccc6d1d11b6112c7297e9e1761897cfb5c9b6a31acf473ed6b6d20e48d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397096, "uuid": "bc6204f1-02c8-4bcc-b654-6e7d0086f301", "comment": "Malware payload (Gafgyt)", "value": "b07e5cea8fe19f6e182789a581aff530f86b43e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397096, "uuid": "39577d18-5b0f-4563-b11f-cc5f759cdbdb", "comment": "Malware payload (Gafgyt)", "value": "eb6072a7323d49ed3b9ca76086754ae4b76098746474b0b4ac87d44a33e54da6773dd526b261e1d137bf7423445dfbef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397096, "uuid": "86fd9658-7b70-4db0-8f06-444fa5bb4315", "value": "4EB30A05FC404723C6D27BBBF79A438E77366658ABD7330166296EF02BC57982E39150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397096, "uuid": "5c3ec10c-99c0-4c2c-b349-c0c6964f57c3", "value": "3072:5+ODYOWlLQdno7K4q5TCjaEShOu5hg2bYRQ2KEh7HoDQHDVpZAlvm:nTCjw8u5hg2bYR57HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397096, "uuid": "2ce71c43-8021-4490-9d64-b1178d55cc3b", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397096, "uuid": "99c44eb4-ee4a-4a0e-bac2-9be67b2435ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397096, "uuid": "4ef44a8f-2b5e-463e-a7b3-f4a4fd488777", "value": "70fea3a73945ffcbce03a3ce92e13540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce6c1ef-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426920, "uuid": "d7315d62-857c-42e1-893a-19413a279f28", "comment": "Malware payload (Mirai)", "value": "1b592e2bf24644a1d9dce24f801cb93f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426920, "uuid": "aaab2b23-6679-4bf3-9190-72899f009e00", "comment": "Malware payload (Mirai)", "value": "7be1fcb06852bc6ab869a97612e969b8bd739a0af8d95f080bcb1a213fce94a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426920, "uuid": "25f75cee-e023-4b74-9b65-c2cb702b966b", "comment": "Malware payload (Mirai)", "value": "80569e8c68ddd54d7135828150622e7f88ad24e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426920, "uuid": "b9cd60f5-a238-4f7b-9d9f-2a6da05b74e9", "comment": "Malware payload (Mirai)", "value": "538876367fb568e062f568d5e79b1512cd7d404cf8eb1b2e6c43ed50f0a92bc8cb365a060fb9924c31300b6297334ae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426920, "uuid": "6be9b5c7-f468-4d31-a0ac-0de455712392", "value": "E6A2D155E5D52DEAEFDF8FB24D91C5801352CF6E2352CD9182C15E11680586FCE20EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426920, "uuid": "72080633-1d07-4514-a703-4d5192615b97", "value": "384:x3wyzpz4ILWEfNojMPp7vWSsXaN8cBMCJ9K9mA/9GvZNa1MmDM4uVcqgw05LxJEv:xHtz4WWEvp7+jXK/d6WaOmA4uVcqgw0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426920, "uuid": "fca75811-2381-4319-b88f-5e30e6d27f74", "value": 22216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426920, "uuid": "608307a3-bb9e-4416-a663-ccfab76a8e09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426920, "uuid": "dedfdcc3-6c2c-4f5d-a00b-4529c37ebbec", "value": "1b592e2bf24644a1d9dce24f801cb93f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c5e7d8-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427234, "uuid": "c1b09699-c556-4d5f-8072-9880864d3deb", "comment": "Malware payload (Mirai)", "value": "673df7ee63fe9f68583111aace897cfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427234, "uuid": "a4554ad1-ade8-4bbe-a2b2-03f02d4693b9", "comment": "Malware payload (Mirai)", "value": "7c346f8ed3d1209bf84cbcc78cec6640c25b40a96f323c2a45ed3b2b2c2e4be1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427234, "uuid": "e40144ea-e16c-4895-ae81-1708391cf9ac", "comment": "Malware payload (Mirai)", "value": "a50a7c7915d60fe3af8ae35ca34db507b9c0426e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427234, "uuid": "9172cba6-b702-491b-b34b-b788cb199ddd", "comment": "Malware payload (Mirai)", "value": "39f6c1846a0198a28be55e2c4b122628743f9e523445c68355f55e90d2089a770a40d498124c38b61df66de9d92a5fca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427234, "uuid": "251139cb-a6df-4207-9fb8-fb1e1a318368", "value": "A713F1722857B529EB305933BE0148D1AEF7EF3C12DE71242765893FDC85B2B291C296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427234, "uuid": "42b3c6ef-26af-414b-b77a-038a0ef5d415", "value": "768:Dh+Ggi1RKxsQnejrM5xBPAAU49L+rOlRsrfEesxRToCMnSVUdghcd9QGss3Uozo:z1Ry5vRpLaf4aCMnOs5zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427234, "uuid": "c922ebe8-5ab7-417d-a414-3d56eb534c95", "value": 44780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427234, "uuid": "a5956a5c-b897-494a-b2d5-f9a9d630d1e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427234, "uuid": "0ed8200e-09cd-49de-ad23-56e08c66af63", "value": "673df7ee63fe9f68583111aace897cfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725fb511-ca96-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623403307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403307, "uuid": "f0279545-e080-46b0-81e3-03fd4d713826", "comment": "Malware payload (Loki)", "value": "0003d7d5cffefc208f7373be61d99dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403307, "uuid": "1d515949-f34e-4ba7-a3c4-52511fffcc62", "comment": "Malware payload (Loki)", "value": "7cbad13dc85083ae51a277ce1a1a30b4a75ffaaea500f3e065782f2c1720d795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403307, "uuid": "0943f6d5-0789-4564-a203-47f99167a65d", "comment": "Malware payload (Loki)", "value": "8625246dbe7e8432d12f90ebade00a0ae72b8066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403307, "uuid": "e5307de9-9bc3-4def-bdcd-2155d72f5e7a", "comment": "Malware payload (Loki)", "value": "63f714eb7cc0a1bb9d6b5382ff4007f8d90f12aa6d7283f3fdcb7e68e40120e22701cf0f64ea7be544cea6cf3145bb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403307, "uuid": "e5a1d668-5263-4aea-911f-038c6a0a24e9", "value": "8865AD1023409B11D12947358C23EA704FB0BC5EAAD6C64E7DE77D9F38B17B25A2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403307, "uuid": "99f63ea6-9da5-4e23-b96b-3e19f5d7a0a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403307, "uuid": "e2f4b935-0e7e-43bf-b565-734d7d576c29", "value": "24576:XfUSH5KWzIh2xNeBUdtQqA0Qqze/z8YEo+Sg5LlJfHwzMIDsxTt8CCQZivg7tNi0:vxwBUQqA0Qqze5o/BldwxT6euLl9h6Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623403307, "uuid": "957d003a-9ffb-4325-9031-564ab7f4ace7", "value": 1457664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623403307, "uuid": "371f1734-5cca-41c7-8b44-1d7f3a3dcf62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403307, "uuid": "8a2b3ff6-96b4-4199-99ae-794ad4f14a17", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5754f98a-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427314, "uuid": "0aeedc37-753d-49b1-b7f4-ddb4aad51bfe", "comment": "Malware payload", "value": "a4a5eea7ba083c1f3560a632cf226282", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427314, "uuid": "74836699-b269-4665-a8e3-3912a14550fc", "comment": "Malware payload", "value": "7ccbd014bc32d55ed0e970d440969f2725cc50339baa00067d0b8e5a0ff629ed", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427314, "uuid": "e21c93c2-62dc-4975-bdc8-380f98559397", "comment": "Malware payload", "value": "b67188c18520449dadc34f3c0c471c7bf9082526", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427314, "uuid": "78451e5f-5542-4af2-b370-1e5bfa1c3a45", "comment": "Malware payload", "value": "21e671a734f04b1e3d4d10449cf39ef2f0b4daffcf768471c25f285abbaa1f556ecbdef5517868d6f5fc6ff574f455f3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427314, "uuid": "ec9c2804-d149-451a-9584-227677b0c63f", "value": "CB1301FA52B5EA7DC512AAB1E98542C8E67EF8B58513C23D4CC37031D7D79422830ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427314, "uuid": "447aa401-5962-4031-91b6-89439a576c2b", "value": "768:bXf/JStNe8b9mJTsKJ6eeGTeVHTM2iop5dtcuumtj6PWo8P2v9sPeQXYJVR8g:Dn4tNe8ZwHTozM29Iuuq1+Fue6SVig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427314, "uuid": "76fe87ab-d782-49bc-ac34-e69903d97488", "value": 43976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427314, "uuid": "2680ed16-c48c-40d7-9fda-9305bb7ef054", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427314, "uuid": "8afd3d61-2107-41e8-a1fb-4e5e67a85666", "value": "a4a5eea7ba083c1f3560a632cf226282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430cc29c-cacb-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1623425991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425991, "uuid": "67727ded-dfc0-49e5-9349-588f4dd7aca1", "comment": "Malware payload (QuasarRAT)", "value": "252ecd2827723011e3d37edeaccd2599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425991, "uuid": "2100c1c4-e9c5-4000-b369-922e23b19755", "comment": "Malware payload (QuasarRAT)", "value": "7e53df2cb418ad47d225c64efe2cd9a111b4a010ed363a1f9bcd6e23a807c244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425991, "uuid": "9d881fc6-af92-42d2-a1b5-213a6086aeef", "comment": "Malware payload (QuasarRAT)", "value": "9525bec4453a777d852838a62f82ece0233b9487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425991, "uuid": "37acc623-9b2d-4346-af3e-20d6e1f4aa6f", "comment": "Malware payload (QuasarRAT)", "value": "32018e07424864461e8f5115475335a42268d560158cd537417465fc110da0efab6806c57966b3d5f4e290b00b9a79de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425991, "uuid": "7d3c6e88-7161-49f5-aec4-1afbf02f0478", "value": "F5B46B4023FC852BE5BE5779E871052067F9E40BB26BFB5F4541B0E92CA67069E40BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425991, "uuid": "2ffff3c7-7ec1-464c-b9b2-37e3090560f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425991, "uuid": "2b4d0bf2-0985-4211-94b7-48d88b689f7f", "value": "6144:8TEgdc0Y5Xc2rao+RGmZOxclf7PQHydcEHab8F9hvuhYV6cTR314:8TEgdfYdrafXdXdzmhYEcd14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425991, "uuid": "b9933299-3841-4012-97fa-c298aad91342", "value": 523792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425991, "uuid": "6e9d2537-cc30-412b-a86d-6559e1c79b60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425991, "uuid": "33d56e46-2cf1-4036-9325-320aa96b9b08", "value": "svchost-ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6791ad8d-ca94-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623402430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402430, "uuid": "d5a9da8c-2c4a-45e9-9c98-e9a1f1d8d14f", "comment": "Malware payload (AgentTesla)", "value": "2d610e4d27c89e8c2d5665da8bcf6e92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402430, "uuid": "0ccc28cd-316e-40fb-8ec1-c268dac8c26a", "comment": "Malware payload (AgentTesla)", "value": "7edefe1f7ee89333c843233b07723e43b3ff4e202ef14df8f4db4d40e71b238f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402430, "uuid": "069b6bb1-27a8-4289-bca7-418636c8c0ee", "comment": "Malware payload (AgentTesla)", "value": "36974165e2cb64f68b63dcd0956a43c66677ccd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402430, "uuid": "6edea695-53f5-4904-9ac8-ecc75820f765", "comment": "Malware payload (AgentTesla)", "value": "392d7578aca9f42304213e22e17d76eeb0818af37739197b697feb55b1e05ec4d4208280ee462bd328d5d558f52d42ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402430, "uuid": "dc63a87a-fcec-40bc-8279-d3ecd58b5378", "value": "D4157AF1A1A047C3D39EDDF283CAB3848B6F5AA631718215A44C32FD22ED19E65CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402430, "uuid": "ebc85ad8-1321-4dd9-96ac-6e6544851798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402430, "uuid": "50f2570a-5550-4bbb-927b-0fdc14e8c4f1", "value": "12288:0BavNBkuER0R3SB4UjDkzLUSQoKC406X76Tqg0z41uBZM4e/ZUdtbl:0BEBFSB4skU9R5rQq7zPNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402430, "uuid": "068b195c-3d3c-459d-9f0d-9de73dbea533", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402430, "uuid": "00eb564d-7c72-42e7-ab86-615c11a6bff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402430, "uuid": "b510d759-bab4-481e-802a-c69bd8b2bb9d", "value": "Order List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20228392-cac4-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623422926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422926, "uuid": "c8cd2b93-67b8-4d1a-8949-93a62038bac9", "comment": "Malware payload (GuLoader)", "value": "69e0c1c7c4804211232d152431ea4e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422926, "uuid": "f9c1c661-81c5-4007-b01a-b6c46260b5b2", "comment": "Malware payload (GuLoader)", "value": "7f206aa1eaf11083fb83752515833780091c1eef6b80157686b48af5051130bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422926, "uuid": "77940970-396a-484f-8e6c-5809bddf01f1", "comment": "Malware payload (GuLoader)", "value": "2e82e49ab14eb28329ba3c87c45783b505aee72c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422926, "uuid": "81587542-a69f-4163-a708-c186cac11dde", "comment": "Malware payload (GuLoader)", "value": "9e2aa768598792798776e88434fd93ae1f0489d1dd28c53a3ae9b0a329f7ab3acdc8365f0bc96f55b05c673ab3710301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422926, "uuid": "46103057-b477-4f1c-8777-f68a7314e25d", "value": "E7E17086BEE989B3E488C77402DA597031A2985540B4CE12EE7D9FF97C3464B77E0A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422926, "uuid": "ca7eea05-ea13-49d1-9722-8a67248e17a2", "value": "48:y1iA9NWJts8x02IBhWCDvnnag8UHFlXzS8U:0iENWJFx022hXagxjzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422926, "uuid": "a9f9531c-e2f2-4611-a8d0-2d5a4060d31a", "value": 6911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422926, "uuid": "9a6ec8f4-0d43-4a15-ba20-b950c0ba7522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422926, "uuid": "fdd75696-5744-49d8-8ba4-29592342a9e9", "value": "69e0c1c7c4804211232d152431ea4e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417a88fb-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427277, "uuid": "3342735d-4543-4d68-a2fa-56b2e1d30fab", "comment": "Malware payload", "value": "28e075ed82179c3e2689ceb91d5f0787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427277, "uuid": "16a41e76-a0ea-4407-b901-a65c8861a4d0", "comment": "Malware payload", "value": "7f5a45f71693d878fa257c77bf8920a178b95fef3e58dad7c8cd52d27e8451ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427277, "uuid": "d63da260-3ea3-49d4-a07f-d04491b1fcfc", "comment": "Malware payload", "value": "4f0ea099f64de403f063edeccea0eb265437a77e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427277, "uuid": "af3bf7d3-f185-465c-80dd-cc540639bdff", "comment": "Malware payload", "value": "06881207fa32edfcef94fd0cf62200f716b0652c2750c268a272be5e91643c9e0c5385b8ab4c9935d258d99f5293f991", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427277, "uuid": "87743081-ee10-4f70-bc23-22525f8991e2", "value": "F703F1F1B3712515CFBD94BC0E8EAD5B4C212B8E1C948DB1A7C9603649E6EA03F9C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427277, "uuid": "a34c9887-1df7-4d80-b871-c375e1b27740", "value": "768:BTcEKSvyeRNgy79Z5/WN981Mmym6SyAQsjTrLFRQEnnbcuyD7UryqCX5Pv+9:uPSvvpjE8zy/S0Y3LjJnouy8mqCp+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427277, "uuid": "c188eb16-ac41-4dd8-8fed-8c240cc3497f", "value": 40704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427277, "uuid": "48c0833f-eda5-4852-886f-0af84925d1e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427277, "uuid": "32dc14a6-79c5-43cb-9875-4fed5c4cdbb0", "value": "28e075ed82179c3e2689ceb91d5f0787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaedfa7-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623389738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389738, "uuid": "a18587c1-44c1-45a3-bdca-872412a603b6", "comment": "Malware payload (OskiStealer)", "value": "fef66893332d66cafc48607326acd484", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389738, "uuid": "4ac5da0b-f6b3-4507-b776-ae5301fa09d8", "comment": "Malware payload (OskiStealer)", "value": "8208cc2e82773d7f36c05aa486375fd3eb3ed78d4db71b9de8e63bf631ec6332", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389738, "uuid": "143ee57b-4519-4ea6-aa35-a475ad7e2cbf", "comment": "Malware payload (OskiStealer)", "value": "149dfdaf67e2054a45c05c1cdc739953780fb6de", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389738, "uuid": "453e0c8c-9e37-4d2e-91bf-d52679fba7e4", "comment": "Malware payload (OskiStealer)", "value": "ab516f1991892197410fe6c234e6f8babbd8a7d68b680c2de87ea731243a7dc99d6fd2f63601770505d79fb708aeb31e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389738, "uuid": "35940602-0839-49e2-b68f-21455ba303ff", "value": "F3941242F1843B27ED13913509CBD7C973B6ED4AAB4A870BA201BB5CBE767215D12F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389738, "uuid": "64ef291d-5081-4c6c-a530-86a1a5fba9ce", "value": "12288:mlhcQMEUElwvXxKDe2YqREMm1vRm3d+QxHd5NK:iXUvvXSe27etQ3dv9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389738, "uuid": "76ecf2a3-6b2e-42e8-9cd3-afe7d46abd6f", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389738, "uuid": "7db808e1-373c-450e-93b3-d492e62547f6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389738, "uuid": "d7f9a188-c4fd-4617-90aa-6be9483957d5", "value": "KIUU bank details credits error.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7356798e-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623397296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397296, "uuid": "2fb4a117-18d1-4724-adb9-0458221123de", "comment": "Malware payload (njrat)", "value": "a21bedb02ebca2c462b8b66ec99e78ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397296, "uuid": "503366a2-8403-4f56-afcb-175d417ec027", "comment": "Malware payload (njrat)", "value": "82e47e8b1ba6c56723c73ff708e0d6d707724610596231e665773e7b50e8aa66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397296, "uuid": "c23bb621-1785-443f-b259-7702ae659181", "comment": "Malware payload (njrat)", "value": "cf674e995ac26c73ec2896f4a8a0520b4dd80f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397296, "uuid": "bb2180ab-6fbe-44ef-8f00-8d19eacd6519", "comment": "Malware payload (njrat)", "value": "fc54a4570acb2b7f416e0f70c3ebcb5a004480c487d559a0654c39a044244b3bd3677bd8f92759fa242166eb4167d309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397296, "uuid": "3ee57311-02c9-4b43-b795-23087032d507", "value": "33B2194E3FA98856C5BD07708AA5965003B491870423EE2FCDC550DBAFB3BD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397296, "uuid": "da8ffb03-68e4-4f06-9a26-99062eedad47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397296, "uuid": "e8c251cb-fdee-4515-bb3b-b26a6a6252e1", "value": "384:+8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZWU:4Y+sNKqNHnSdRpcnuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397296, "uuid": "cc24481d-e875-4f05-affe-ae725f7ddcbe", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397296, "uuid": "28cbad52-6e9a-479c-b728-3b24d6b823f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397296, "uuid": "181b0fc7-0883-4537-866c-d724097aa4bf", "value": "a21bedb02ebca2c462b8b66ec99e78ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c6b577-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427018, "uuid": "2afc5ddb-d45e-4f89-b6e5-fb3cebb22e87", "comment": "Malware payload", "value": "e6bf57711c592cb4dc1bc8df7cb08154", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427018, "uuid": "8980ba48-93e9-4ac7-bd14-f29cfd97565b", "comment": "Malware payload", "value": "82e639a63ff2fb1220bdfca9e433ca4993a224c42a25bfd3e3c99027e3bcb08c", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427018, "uuid": "0589b055-648d-490f-bde8-81958bfd205f", "comment": "Malware payload", "value": "efe0a6fe4808348e907e23cfaf2dfef976090f9c", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427018, "uuid": "07b880f6-13b3-41f9-810b-96e0704ab1e4", "comment": "Malware payload", "value": "dc5abf704b15b07943f8a64241e9df4196313e494257bdc65cd63f8b5463a11940fe21c2e966ad4049f788dca95e5f1d", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427018, "uuid": "646f90ee-b210-45cf-8b8d-1a1a21b1eeb0", "value": "CB31DFD1A6D05DBDC8E455BFAE574310B37C9F80E1CA7123921D73A86C1EEBCAD26089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427018, "uuid": "a8ff56c9-14dc-4493-9647-8f6b318eeefb", "value": "24:cAJqoKGpa7Urz/jlfbXK1G9Vev3gRGD9ily/NBuLlx/LAkKoXhE9gZgS:cAJqoKGpa7UrLZgR30CNBuD/LooXhEcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427018, "uuid": "f950b6c6-3047-4dcf-91f4-e3204077ffdf", "value": 1496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427018, "uuid": "283de13c-abb0-4991-bb1e-84f786821e98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427018, "uuid": "be51c2ca-1c18-4e9c-b946-0b14f544a51f", "value": "e6bf57711c592cb4dc1bc8df7cb08154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b2a4b3-cab3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623415580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415580, "uuid": "05f9ccbc-eeab-429a-a9c5-1b3a17986228", "comment": "Malware payload (RedLineStealer)", "value": "614cfddb51dba0312c63065d623e9dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415580, "uuid": "bb6fe799-973a-4907-aaf3-44f983980e41", "comment": "Malware payload (RedLineStealer)", "value": "84243ed89d2df4bf4299db31c40259766f2299c821bb8ca5f76629da44ef07c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415580, "uuid": "75669d49-322b-482a-8a18-b7cab8949b5c", "comment": "Malware payload (RedLineStealer)", "value": "dd9482c850593d649a9bd1503fada02b77085018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415580, "uuid": "9a48ca7a-3ab1-4272-a647-15ce1625b3c3", "comment": "Malware payload (RedLineStealer)", "value": "425aeed53a5e9a1ebe113d1c83df858d6f322e3002330e87982a1b74322dba50dfe27515d781ac1c6243036544782096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415580, "uuid": "7e2a0385-4c3e-414d-8d0b-f95fc453af2b", "value": "A085AE207981D700C19A0636CD9BD5744FB8AD0D2AE28B2FBA9B335B29727735D0E5CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415580, "uuid": "494c3dc4-e35b-4c7a-a51d-54a615f58aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415580, "uuid": "846b7c70-2b9c-48c1-97f1-99e03160e276", "value": "49152:AHLAwBUesEj5YCs2oe5qBlduVnKYCaocji0LnkOL0:AHJsEj5rs2eBlGKYnocji0LnkOL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623415580, "uuid": "fb3c0d80-7c0c-4ddd-8508-5fddc5a32dcb", "value": 1799168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623415580, "uuid": "62c5cfa1-c3c1-46a9-88fd-3b19aa2164f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415580, "uuid": "7b3e41dc-5136-4ff9-937f-e1634bd04dd4", "value": "614cfddb51dba0312c63065d623e9dbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69d5485-caf6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623444653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444653, "uuid": "116340ca-4c0f-4841-9352-52a31c5f719a", "comment": "Malware payload (Loki)", "value": "9d144ffa8dc62013694cf9436918eaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444653, "uuid": "f8ae2e8e-8e7a-40c9-a79f-354ff3125111", "comment": "Malware payload (Loki)", "value": "848c6815044f0f563f7c0aa684b2181e1044bc20cbb89592bf37d2cc0c25e911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444653, "uuid": "74552d8d-4220-4abe-808b-8d81890fbffd", "comment": "Malware payload (Loki)", "value": "2ee66013117538bb51578c2f2547f01496b3c662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623444653, "uuid": "4cde5717-203f-4073-9806-395b13fde5b3", "comment": "Malware payload (Loki)", "value": "688a1f4af05251295a9df5d3c649a5574aa68f722e55ea0cdbe55b3634815753c27a4cffe00cf1432e19a213266609dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444653, "uuid": "cd67d5ea-1c8b-42bb-825b-cef2c2422915", "value": "28E4D025624C9915F17F93369071520443F0F507E322EF4DFEA858EA2EA27C393AFA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444653, "uuid": "26076856-9521-45c1-b14c-24e28604969c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444653, "uuid": "e84d2ef3-b100-4f87-9b66-241301a79b99", "value": "12288:G5Zf15tRPvH1OjqkhlMV40Jj+mcCdIDF4Yna0AWyxofsjlKCEndAILzOk1:G9qqkhUNKWYna0JeofWgPdAILz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623444653, "uuid": "8c26f2ad-aeb4-461d-81a6-7660ebc595bb", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623444653, "uuid": "6d39e199-cf65-417c-a6f0-5ad80d1bad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623444653, "uuid": "22e075ed-e932-4bf4-a1f6-5a92bfc67a84", "value": "9D144FFA8DC62013694CF9436918EAEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dbc791-ca93-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623402016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402016, "uuid": "7eadba70-90b7-49f6-9a9d-60c5044dbebd", "comment": "Malware payload (OskiStealer)", "value": "1eef9d19ccbabcbcfd3b1509e54886c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402016, "uuid": "9e507e42-fb5b-476a-9fa6-1d823156b8f5", "comment": "Malware payload (OskiStealer)", "value": "84cdb9ed95d361af46291bf3423855d70adbb56d0e9fd51f325537b249233730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402016, "uuid": "f2b009af-a9e5-4a87-a200-cbd9e0d1d253", "comment": "Malware payload (OskiStealer)", "value": "6853dbbbbc69ab661d3dfb79491e1f0017d33529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402016, "uuid": "9cc4f168-df33-48ac-8c80-b15ac4cd9be6", "comment": "Malware payload (OskiStealer)", "value": "647bd90340cbe71fa41fe69983e94eb74ad89152e22c9e2780d3fcc769ca81f72b720d934e26756e1045fb0ddfa8afed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402016, "uuid": "a50455f8-17bc-449c-b08e-bc8562e67232", "value": "7465BE1066009B51D12947758C23D6B04FB0AD0EEEE6C64E7DEB7C9F38717B21A2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402016, "uuid": "d237db86-afa6-4098-b2f0-701fad9e8b78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402016, "uuid": "198e5f5e-ab1c-4c11-8483-2b1b2c5b5226", "value": "24576:KQPNeBUdtwsEgwsoe/z8YEoqSg5LlJfH7cxPYokFLJ3lp5VmwTEuXKwhzMIDsxTo:RwBUwsEgwsoe5U/BldbcxAok1dXVTEuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402016, "uuid": "d7602dae-10e9-4339-be38-dbf750e2ede6", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402016, "uuid": "11575ce2-133a-4489-a3e0-1e1b2682da94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402016, "uuid": "1196397f-06a3-4e8f-a95c-5a40bd2e80ea", "value": "9VJhD2bmjXNfdk0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601826b0-caa2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623408431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408431, "uuid": "d31e1347-ba06-47e9-b111-ad41a6aee5b3", "comment": "Malware payload (AgentTesla)", "value": "5cff42958cd317e239d575732f7f9114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408431, "uuid": "7f81929a-c8e9-48b6-ab4f-5e153d9d27c7", "comment": "Malware payload (AgentTesla)", "value": "8636a1af1afb3fa83c218cbc4a18f37782b835d4ab8b27148d6f99cb849453a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408431, "uuid": "75fa037d-7c5a-4b47-a2ca-88fcd6b3df53", "comment": "Malware payload (AgentTesla)", "value": "dec2ad475f2989f5096e02e00b45b265dd10c8c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408431, "uuid": "eda32243-a400-41cd-9989-a76c0217d2c0", "comment": "Malware payload (AgentTesla)", "value": "c74c428e287b21e450f92b5e7977de9a96ea2ae222fb15dbdb7216daaa72cf3cbd8dcbb0fd979796b1aa8b63fd047f9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408431, "uuid": "3988eb24-5f66-497c-9f7c-249a7c208425", "value": "B12579F1A5A147C3D79EDDF183CAB3848B2F4AA231728211A94C22FC76DD29E15CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408431, "uuid": "58215478-f10e-4ea9-ab63-7fcb38f81d32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408431, "uuid": "0dcf530f-6840-4769-bce9-a22cdaf0ce5c", "value": "12288:j4ZHNvC3A163SoAPBsFHDEp4rcVyfab52ZM4e/ZUdtb:jKHNvGAoxFHDEMY92NeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623408431, "uuid": "bf3c1151-ba99-4732-9d8d-aec192f287ec", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623408431, "uuid": "320e2179-6931-4a82-ba42-3d2a0b394db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408431, "uuid": "460cffce-0f4e-4891-b2bb-876b3597e5ab", "value": "PO #R58490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3a5f36-ca5a-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623377418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377418, "uuid": "99104f66-4d9e-4e31-8242-ae162e418a7d", "comment": "Malware payload (AsyncRAT)", "value": "60b38fcb88892b72f97c72a04b03ce29", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377418, "uuid": "0dbc0fc7-4bd8-44f5-b4bc-09ecfe646d98", "comment": "Malware payload (AsyncRAT)", "value": "86a970ceae4a26b7b3cca4894885278b76aede70d85c92a2c55d9fe4d950a879", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377418, "uuid": "b7dfa14a-13a5-43d6-b9f5-9b8626a189cf", "comment": "Malware payload (AsyncRAT)", "value": "90a9b8272b1c39aba84ceb9c53aa1b041fb61f6b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623377418, "uuid": "a82bdccd-1511-4d83-8dee-35cc4dd26c42", "comment": "Malware payload (AsyncRAT)", "value": "c578143d975ca54fc30d456163448b98b0289b0b50317afef6d18af201da4e9789eab0ef7f143d6778d0e389615a8a26", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377418, "uuid": "49483756-ae3e-4ce2-a1d4-7655a927b1ed", "value": "28F4D0363A1146C3E75D4AF3FBCA3208577B4D5126B2D3CA99587DEC06B3352B8094AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377418, "uuid": "d6b44d3f-af52-4a50-85ff-e791cdb4e7d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377418, "uuid": "e131b0a4-56f1-4a22-a075-c6b470777aa5", "value": "12288:Q0ohFAWmVksgs8XJcTO7AvH9CbBuOuqQu9cGv6m7S6ZM4e/ZUdtb:HoUXhgbcC7AH9uuONcMI6NeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623377418, "uuid": "8a474923-7c73-4bb7-877b-d6d23a2e8087", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623377418, "uuid": "b85c8dfc-ef56-4d37-b89f-a251344940a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623377418, "uuid": "b2f72e93-cbe3-473d-90a9-efe090db0f93", "value": "Request For Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad42a6c3-ca7c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623392239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392239, "uuid": "5775e9ad-26ed-472d-9f6e-9831774ec488", "comment": "Malware payload (AgentTesla)", "value": "d18408259775442e03bb7eb9b7a74bb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392239, "uuid": "4467edab-ac57-4568-bf40-a6218fd3c91a", "comment": "Malware payload (AgentTesla)", "value": "87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392239, "uuid": "ec816ab7-bba6-4a92-9ba7-65f14b20f38f", "comment": "Malware payload (AgentTesla)", "value": "dc0fb8389bc1721c899575a5d51638fb7b5638ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392239, "uuid": "6c19806a-6e70-46ff-9157-afbca404cba0", "comment": "Malware payload (AgentTesla)", "value": "b07e4df028d4de24157382ec4232e25e48c6f21adc5a086bce2634ae1878bc4ba4633980cca9a865203950b7b34bd833", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392239, "uuid": "547ce2d1-d9b5-4f78-a0cf-5cfa2d9556d4", "value": "07E423A7D84B6446DF823CF26F400AB98E9EE8F53315CCDA4505C49621AE3FDBB4462D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392239, "uuid": "e64253cc-36e0-4c91-a0fd-d348dae17c71", "value": "12288:IuA+hzn2yaxkcSWm0t/C4y8912AidXjnAJ/0f8E/42j4tBhtw+iHlPcA1nm+f:Q+hn4Lt9C4y8919iljAR0kEQDtvtwHH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392239, "uuid": "ed08f8b1-543f-4a52-86fa-2f4dc14a2b38", "value": 707652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392239, "uuid": "dad4feb5-eccf-42f6-ac03-8f92c168b550", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392239, "uuid": "6e040303-e000-4bb2-b232-599d597c04fe", "value": "Proforma Invoice No. 14214.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee0bc23-caa3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623409019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409019, "uuid": "e25a2aba-def8-473d-adf2-8aa5d5bcc6ec", "comment": "Malware payload (SnakeKeylogger)", "value": "163ba273fdaaa7bf6f9e4b6721f1f2cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409019, "uuid": "b87b6269-0a60-4307-b1c0-8b28bf18df0b", "comment": "Malware payload (SnakeKeylogger)", "value": "8828c538658610555a6d5f0ee1cb2f46bdc6be661ac9980acf4790287d818274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409019, "uuid": "560ad667-c5f4-4963-8794-8c8414b6f28d", "comment": "Malware payload (SnakeKeylogger)", "value": "19891a9edde1e0f41761918fb52b54337e426a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409019, "uuid": "2339e910-2c9f-4c15-a862-e4d95daf7d85", "comment": "Malware payload (SnakeKeylogger)", "value": "50b08d7206da7732146c2c1c7e3145e30671c903081d415f08d8802eca1b5240cd5c1a974a5eb634278e84e0a3510b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409019, "uuid": "3f642f5f-aa14-45ad-9ae5-8250a2a06228", "value": "D165BE1026409B50D13947358C23D6B04FB0AD0EEAE6C64E7DEB7C9F39717B15A2E26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409019, "uuid": "8cf0b053-5afa-4cff-8d28-c3677ce9aaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409019, "uuid": "2a2f4954-e3fb-4808-9974-75160f61b1db", "value": "24576:cOvNeBUdtwsEgwsXe/z8YEoq6X99uPI3Bw6g5LlJfH6zMIDsxTt8gYWr:JvwBUwsEgwsXe5UgD2BldOIYWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409019, "uuid": "2068ffa9-270a-49d0-a256-139475acfd44", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409019, "uuid": "df8d1119-c0c1-4f9e-8d71-9b356454c794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409019, "uuid": "f1e09c9c-aabb-4017-8528-d8ab417ec7d0", "value": "proforma Invoice (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae94c20-cac1-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1623421951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421951, "uuid": "db11d35f-7004-4ef0-9563-25cabf5f5847", "comment": "Malware payload (TrickBot)", "value": "c6fcd45cbffe733beab01bd9d7706615", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421951, "uuid": "1660f7a3-289f-43fd-ab4d-92e966638d34", "comment": "Malware payload (TrickBot)", "value": "896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421951, "uuid": "35e677a5-e5ed-4b37-a2b5-2efccd8b3f11", "comment": "Malware payload (TrickBot)", "value": "31665331a602e39481fd00e3dfe7869bb5fb5280", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421951, "uuid": "690866d8-dba7-49ae-9d12-a45639f73854", "comment": "Malware payload (TrickBot)", "value": "908af0ef19c1534a6a7db99ab64ce61cef29b42f5403a1a2f8cbabe5e76fd0915fce105fa32c1e9c71137d25b91bd4bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421951, "uuid": "0ec43dde-f2c3-4bf4-9e55-6b510620355d", "value": "EDB4E10232E48877D1EF12354967C3996AB9BE115AB5C68FAFD8358E1D312418E33B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421951, "uuid": "7c366c21-4107-4d80-b40b-3595512c1ddc", "value": "528e27d2cc3d057ff5499c1ccde0cb87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421951, "uuid": "decaea66-a6c6-4ba9-ac62-7abf4754e7d0", "value": "12288:1kPMN7eLQ0DzEPDCc/TwV91gTMA2E9dnTRYUr5:1/OQm2sV91gTMzad9YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623421951, "uuid": "3f8157ed-b129-4131-9040-219e7682d56a", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623421951, "uuid": "a5849ac2-565b-4df1-9422-943be992b447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421951, "uuid": "fa5ce6ee-b272-48fe-8b71-e00987666326", "value": "c6fcd45cbffe733beab01bd9d7706615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6e472a-ca7f-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623393444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393444, "uuid": "dba966b8-f35d-4a7e-b74c-3b154cff44fa", "comment": "Malware payload (AsyncRAT)", "value": "fd3653e56ec3d9d0b9ef97effdb17184", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393444, "uuid": "991fef55-0d52-4a29-959f-34061b72d762", "comment": "Malware payload (AsyncRAT)", "value": "8a37b04971384e94c7a09edba0036671777f7cd157c319b8ea1546e4b862c3da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393444, "uuid": "a394f239-b946-4ba3-af3f-319eb56cb8be", "comment": "Malware payload (AsyncRAT)", "value": "c5c3e73401794e44f7364d5a7d62a5b6bd6198ad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393444, "uuid": "3242db16-00d7-44b4-83a3-9df6413a4aa2", "comment": "Malware payload (AsyncRAT)", "value": "24d1fe16644fe54f81b7fd1a6b28b6b592f710175f92bc0fba72a0fe55107bbe764a6481350985298ed676c43746f72f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393444, "uuid": "dabc7595-1a6e-4acc-b92f-beddb539ec37", "value": "5194D00436F88702E076AFF96AA860555BBABA277521D21C5CC171CF4932F04EE91F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393444, "uuid": "f0bbac99-b5c8-414e-aca3-305b0e2aedf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393444, "uuid": "857eeaf5-35fd-45a5-9b37-fde03a84f970", "value": "12288:56/Y4QdwQREoX6xf8uQ8dSHRwV5HbzJGBX5K:56/vQ2Q+v894IwV5H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393444, "uuid": "b5797fd4-b6da-4745-a995-0f1a7604d957", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393444, "uuid": "cb64e829-f8e4-49e5-8e4e-cdc1439f4536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393444, "uuid": "e871b2f1-546d-4ba7-91c0-7574a44d5634", "value": "PaymentDetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4872984-ca7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623393647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393647, "uuid": "5a3fb79c-b0f3-492e-af0d-36e776011033", "comment": "Malware payload", "value": "9f0c18837dcc2e473eed03b8cc101e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393647, "uuid": "13e93a4d-809c-4876-9e59-3bb94b6be65a", "comment": "Malware payload", "value": "8aef801dfbf52c2d13d7932a49d5ec1aae0f7c2ad184bddd0bfc555f4ee194db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393647, "uuid": "040286fa-7d54-4b90-aa7b-129cee22c3a1", "comment": "Malware payload", "value": "f0476999544251c597d1f4bc8f03120a3d3420f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393647, "uuid": "2b0d7df7-8ab1-426a-aa26-7e757d60a531", "comment": "Malware payload", "value": "bb39dc298d8586e56a971361d17d9442b44885e063c54c3e6eebfeea2eec3d541759728583ac068cff91cb2c73548fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393647, "uuid": "364ddafe-9e52-4252-b1d7-0ef5408e4504", "value": "4A963393828A4A23CBFF94B371221C78015D2C938D6F81BD4D696351A4875F7A9F362F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393647, "uuid": "e2b959ed-d2e5-42a5-aa02-015abfef9b9d", "value": "196608:W5DCIDLN1WoY5Ss2t1YuQwgHzE450yOpVEPIWNlsddDshflMK6+w:W3nq95Ss2w84E458LcUdd8OK6+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393647, "uuid": "ffcc141e-5bf3-42c2-886a-b040f3774bb6", "value": 8658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393647, "uuid": "215a3692-a4ff-46ee-962d-19dd3a92094f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393647, "uuid": "5c137486-3686-4e9b-ba4e-27433b468c91", "value": "9f0c18837dcc2e473eed03b8cc101e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb15c8e-ca93-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623402034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402034, "uuid": "f46238b0-4758-48f3-b555-78ae444fca4a", "comment": "Malware payload (Loki)", "value": "7ffaacb62a43c87e17078084b449105d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402034, "uuid": "7b66edb2-ecb0-4176-a458-c8825c6ae323", "comment": "Malware payload (Loki)", "value": "8be067f8aae2b0d4bd04d200b3426eef34bf62cccfb94d7fb8d8d011aac00ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402034, "uuid": "b32ed8bd-a8f5-427b-abb5-136f79b3dbb1", "comment": "Malware payload (Loki)", "value": "0d18622389728c82b71c2b00c718efdf3dd502e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402034, "uuid": "86a0aca9-e9e8-42f3-9141-e587124095b1", "comment": "Malware payload (Loki)", "value": "babf23ccf5004c201dfa5cc1c1831a91dfd9ca6a755b0911d39f7a6b1a2a01c23624882a7b66f509af75e8bfc11ffe42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402034, "uuid": "7ed9e6dd-abf3-4f35-bc70-4f71b37c77ce", "value": "4765BD1026009B10D16A47368C63D6B05FB8AD0EAEE2C61F7DEB3D9F39B17B1152D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402034, "uuid": "c3559e64-114e-457c-9fac-1437872f10fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402034, "uuid": "713e5f7a-2c81-4705-bdaa-e5c9e8e694bb", "value": "24576:WYNeBUdtesEgQsde/z8YEoqSg5LlJfH6zMIDsxTt8dXSoNinVtsuNS8pol46r:vwBUesEgQsde5U/BldOEognoP8per", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402034, "uuid": "3a4135dd-a228-4cec-9fa3-e2b003f9f4ce", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402034, "uuid": "9b6f9953-01ac-443a-b8de-1841aa2c6944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402034, "uuid": "1350d4d8-b089-4c99-88e6-7339dfb68703", "value": "Detalles del pago.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04c7977-ca8b-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1623398660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623398660, "uuid": "3786093e-b8e7-486c-a4d7-41aa4f93e658", "comment": "Malware payload (ParallaxRAT)", "value": "072243895e92e4f1253b8486c16e207f", "object_relation": "md5", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IPM Skupina d.o.o.", "colour": "#ADB3C5", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623398660, "uuid": "dc6e4e55-75f1-467e-8042-c52a17e3fa52", "comment": "Malware payload (ParallaxRAT)", "value": "8c6e507be687fd725cf66f3a4d405a43fc575a275024a5ed164e90b873fe447c", "object_relation": "sha256", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IPM Skupina d.o.o.", "colour": "#ADB3C5", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623398660, "uuid": "87ad1c13-e159-4b8a-8b4e-aa413d674d7e", "comment": "Malware payload (ParallaxRAT)", "value": "8de3ba388bc880b3acd526a961c884497ac20ded", "object_relation": "sha1", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IPM Skupina d.o.o.", "colour": "#ADB3C5", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623398660, "uuid": "58e2e8fe-8bd0-4544-9b5f-60573f4b29fb", "comment": "Malware payload (ParallaxRAT)", "value": "ad0967acaaa902ac3f7e50a25d5ec763c0a3ba75297d87c36099a560144d0b3a05191124035d7174db257c3ca1d1b717", "object_relation": "sha3-384", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IPM Skupina d.o.o.", "colour": "#ADB3C5", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623398660, "uuid": "8d5a6b98-42d2-403a-9367-9df45cec6f2d", "value": "51C57C2175089A73C4522DB3B848FEB1B26C6E610E3640F396A4BF1B3B347467516F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623398660, "uuid": "b99be8ea-0d60-41dd-9f94-b269aaafef00", "value": "e5afbb1c76dc40ba5faf804eadf5878c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623398660, "uuid": "da347838-72ed-4e6f-9c7a-b67bc291579e", "value": "49152:IGw0jUHV6hXR0KxOYt7pHIAFot5I/g/wr3zTNsQltgQA3Adu0mH8yK:IGw0oHOXNsYt7ZI8ot5IYYTHNsGtgQA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623398660, "uuid": "9150c830-b3c2-4ccf-a932-5779350d3054", "value": 2495432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623398660, "uuid": "547b2314-152d-40b1-8761-16adbabd3aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623398660, "uuid": "616c744c-a2ee-4085-ae3b-559384993a83", "value": "8c6e507be687fd725cf66f3a4d405a43fc575a275024a5ed164e90b873fe447c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de00e68-caa9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623411326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411326, "uuid": "de6f84f8-e6d7-4b8a-8c78-4c8fa3ee3053", "comment": "Malware payload (SnakeKeylogger)", "value": "de4039cc5fdbd0be213788b5748b1447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411326, "uuid": "9b02a884-f728-41e8-9dd4-90d6392403ea", "comment": "Malware payload (SnakeKeylogger)", "value": "8d06e14ada3f687c4049ed12f411723aebc45ad9fbaccc22999061110a8103b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411326, "uuid": "3b2f6ded-3ebe-42bc-a5d0-46862bc0167b", "comment": "Malware payload (SnakeKeylogger)", "value": "5ec9e99d548eb2b041b5060dd96a67ea3cca680b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623411326, "uuid": "287443d3-f8d4-4379-82cf-ed5b9a0ecf07", "comment": "Malware payload (SnakeKeylogger)", "value": "c54b411da655469794a05a64adda141ebc46bd0f103c61287cfe830a02c2514fdd9b11238ebd4f40338a60ffca999396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411326, "uuid": "05207853-de77-494c-9613-eac7b950e125", "value": "10B44A2439FA501AB173EFA64BE475DADA6FB7333B07A45D1091038A4623E81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411326, "uuid": "8e966950-6c5f-46a4-93bf-831381db85d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411326, "uuid": "8b118ca8-73df-478e-93ca-89939ac5ed10", "value": "12288:VDV5MqtOVWdYAnhpWp1ndEwn0TjsUhx70ScMOddZs45Gl6:FTLV3mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623411326, "uuid": "0bc62b7e-612a-41ca-bb5b-92da7419afe5", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623411326, "uuid": "410169e2-b996-4a70-95ca-b2c0d9d87007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623411326, "uuid": "eb6d4b69-cd9d-490f-9705-bf0c4d0571bc", "value": "de4039cc5fdbd0be213788b5748b1447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d0ae8a-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423603, "uuid": "cf6d2a7e-aba8-4cae-afb2-543d7d285bc4", "comment": "Malware payload", "value": "0d985e8dfb9c51a214736f219923260f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423603, "uuid": "1e1e1e87-41ce-46f3-83e7-0c6c43d208f7", "comment": "Malware payload", "value": "8d8a32bba4283f0d093bd0613239b1604827270741f87844de1068240c6e38c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423603, "uuid": "7b6e844f-58a9-4dfa-b701-b8d962e76923", "comment": "Malware payload", "value": "7e833b2b84596ec05fc7c0e355a996a3c77e2607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423603, "uuid": "d4c9eacd-81d7-4cc7-8ea2-e0436abcfbaa", "comment": "Malware payload", "value": "839a5c59ce205479660c67d2dda6daed72fffe3f646622d17cb43bc5a48261a13ef549dfc8076853bffd06c49a8a1f4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423603, "uuid": "9bdf31ae-cefd-43b6-a382-06124eb1fed8", "value": "22A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423603, "uuid": "3cc83cdb-6e31-4d14-9523-1b2b687e9958", "value": "1536:xfRuqNM5h7t/RiRt4nOphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRNphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423603, "uuid": "bb2173a6-1f6f-4f72-8c18-7049f6fde2d6", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423603, "uuid": "bd332208-4b2b-4500-8b80-b84463fbb01d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423603, "uuid": "00e51ead-801b-44b6-bbd8-a7c3ce6d985f", "value": "0d985e8dfb9c51a214736f219923260f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbce6bc0-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423617, "uuid": "19f1c2b8-6667-418c-bc92-d9713780df7b", "comment": "Malware payload", "value": "b11e389a06a4b5c036c67bc993dba8e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423617, "uuid": "5c2eecd1-9296-4937-a613-33cc31dc42cc", "comment": "Malware payload", "value": "92cf7138034bfed013b5611b8c98af7b9fb6a4d3cb30bcc10244d066a31001ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423617, "uuid": "d9188d92-0106-4c4e-93ab-8ac89546fbf9", "comment": "Malware payload", "value": "ca3d282448b03718fd1c97997dc6e903a950cf6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423617, "uuid": "18a0bb55-b346-49f5-b669-2cbb236abf63", "comment": "Malware payload", "value": "cde5cf2f6147112ca2fb18ec10c9f478b9e18864511373d69d0e03ee867bac86d9409bdd622e22c65bb1f599ee77c846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423617, "uuid": "f90d6142-b5af-4e59-8400-7f5c2692039a", "value": "25C33B06F5508753C1C3177AB78F561A77232BB897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423617, "uuid": "f045177c-c8b4-41a0-95ac-351424cc926e", "value": "3072:ed3Da04A7iNmLJMQJBV5hd5Kynz2FAdmyDQUJ1UX4Tn:G3Da1ciABV5hd5K3FAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423617, "uuid": "fbf8d48d-c6df-4fd9-a011-e0a52eb31027", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423617, "uuid": "b30365f2-49ce-438a-a876-6b68b277b0ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423617, "uuid": "1e9c7b9f-bdad-4e62-925c-dba8c733afb4", "value": "b11e389a06a4b5c036c67bc993dba8e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a992deb4-ca9e-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1623406836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406836, "uuid": "aa4907e5-2765-4339-b2fc-c853fb23895d", "comment": "Malware payload (TrickBot)", "value": "fefcd3be7442dab1e25ed12903406a40", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat1", "colour": "#38B7D3", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406836, "uuid": "dfdf85af-4a16-4b12-acf3-39f4a9d1b68a", "comment": "Malware payload (TrickBot)", "value": "930c7ac2d2e3dcd05a616c9bcd078c6c153e78c3506cef585b61442b1ab3b9ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat1", "colour": "#38B7D3", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406836, "uuid": "a6b82bc9-ae34-4a01-9530-3b812d65ae42", "comment": "Malware payload (TrickBot)", "value": "ec6d52468af5b590a1a2a9d041b894d9a144c99c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat1", "colour": "#38B7D3", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406836, "uuid": "7ff51549-e250-4f39-a25c-af15f659ea59", "comment": "Malware payload (TrickBot)", "value": "f39d340447d0a234ef38d5bd93956314b2bdc5b2a9f5dcd11839f17975f2270e560ea152ffbd71def41b2917407c09ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat1", "colour": "#38B7D3", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406836, "uuid": "6fe69eeb-7f1a-4b4a-91e0-068ce3aca65d", "value": "2284F0217190C032E26A153989A5C7700B6EBC718BB1A4DB2BE95E7F1F253D09F3539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406836, "uuid": "4e88b40d-2fe4-4e79-8434-f3670c3a25d4", "value": "43f067960d989e115b411361e49fefeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406836, "uuid": "ace60180-3c4d-4bfb-89b1-9937af81f295", "value": "6144:ptk89R4/ROyx02q1uCg2pm/HC1XdwGNksRC4up5dildQmg:pGWRKROyqXgamfMkkldQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406836, "uuid": "7abb3faa-04bd-4c09-83e7-51ef81a0b72a", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406836, "uuid": "c5f6b22b-0149-4162-83c6-a6978c1b0ccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406836, "uuid": "0b7f1496-c4df-403a-8b9d-3f14a953cb04", "value": "fefcd3be7442dab1e25ed12903406a40.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e12a4b6-ca82-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623394710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394710, "uuid": "e8461734-967c-4c96-a5a2-0b4d0ba02bbb", "comment": "Malware payload (Formbook)", "value": "d2a8ef4a18e3c6dc377daf765b37a9ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394710, "uuid": "94ef73bb-8dde-47cb-891f-3fa17dac2034", "comment": "Malware payload (Formbook)", "value": "931959c2c56185581ab2639948e3e207c5cb3c1e1c0225567c31f03a5b39e65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394710, "uuid": "de9716c5-8041-4549-8344-0fa82cb3c433", "comment": "Malware payload (Formbook)", "value": "7c6bcb0d6e1528af56b888657a26c186c818493b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394710, "uuid": "969e180a-8cdc-4002-850c-f6036ad0f9df", "comment": "Malware payload (Formbook)", "value": "0aa979ac4338be88564f3da8ad0d48ef8e82ff19a1362358a853d190c424c3351df5c3218be61fd4d5db4fb926cf81fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394710, "uuid": "fb9df28a-ad7f-4c43-ab51-6fce64c40141", "value": "36B423644A607D28D6E89BFABB8F6D87CD303D23F8902A99315CF14909F7344B9A541F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394710, "uuid": "fe75d7b8-38c8-4c10-b9d5-1b4a57821ff3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394710, "uuid": "2218a0d8-41fa-4513-aab2-e0e9441d2b35", "value": "12288:mQ985Wz2+Q38+VAYy2qoTGWA6Tp2x4tWKG1Gu7iTQezjBw5U1:c5MQ38tpsA6c4tc1Gu7Kzum1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394710, "uuid": "35c9d75c-76ca-48f0-8ed6-90fea4946432", "value": 542192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394710, "uuid": "f40d4546-24d8-44f8-b207-9db3b6de4ac8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394710, "uuid": "acdfc943-b830-417b-a306-002b95c3f021", "value": "d2a8ef4a18e3c6dc377daf765b37a9ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd0c6f9-ca8e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623399890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399890, "uuid": "4db170f7-fac9-4e06-9a69-b4c82bb32f1b", "comment": "Malware payload", "value": "df00b79f4df4660b7980895f35d0a101", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399890, "uuid": "1a37ee4b-e1d2-4b51-9348-61146930e787", "comment": "Malware payload", "value": "94394fa78d1f2a54235bb0f43f81baaffab9ccc464ec089148d1cf08edcd71a1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399890, "uuid": "b722ba29-3334-4151-bd62-5071a5baf673", "comment": "Malware payload", "value": "449c6a604330c1e5a94ae2963097a5f93011c332", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399890, "uuid": "33cea458-4c99-43ee-9769-cd8227b21735", "comment": "Malware payload", "value": "e9825b6d158f8f8645ce52d02743f7c4c111f405dde5dfc0beb432531719e7cb4bb491310cfd2e6cdf94de20db6e15bd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399890, "uuid": "95cd216a-4c7c-4cdb-a772-0a12a5d3ef69", "value": "CE92AE8FBAE3185CF38B52B6C0085684D7197783E50BB96779B0D96ECC722876B09D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399890, "uuid": "b055d8ec-d34c-466a-8f73-59d974bf12e6", "value": "384:1lecO7apFogsgt0MHwgs7rVr6Nv2r2Sh2p0XIOsiWaruLC:1E7clt0P7b2yIDTxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623399890, "uuid": "48edbfed-37f3-42c2-9937-d31892b8ba45", "value": 19906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623399890, "uuid": "7facf847-d3d0-41dd-8958-f20bba45efdb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399890, "uuid": "0e250f8a-86af-42a1-893a-c3df534179fc", "value": "IMG_050_77_103_85.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bf7794-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623394137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "36eb452e-2ac1-44bf-aec8-af1a749deddd", "comment": "Malware payload (SnakeKeylogger)", "value": "2648886dbd37ccc239ca91bd3d2f4e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "33e71697-026d-4bde-841c-c521944e929e", "comment": "Malware payload (SnakeKeylogger)", "value": "9448c12a9d9d81d61ac8a3976b433803f2c5a63abe8cb6e74b323ffa3d8356a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "fb3059b4-61fc-40e7-8709-226783ba49a7", "comment": "Malware payload (SnakeKeylogger)", "value": "0f689a281560251938a3be316b28c5a5cd29a24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394137, "uuid": "49a8b1e6-c3c6-4e74-b474-59152f70ccde", "comment": "Malware payload (SnakeKeylogger)", "value": "975965149daaab5e2c41607150184cfe058e97777267a1f28c46f5e44442d511e5b5e63c7a544a9d86f659fc9014aadb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "06264bb1-3de9-4b61-b612-330a8a6995a2", "value": "76A422241674ED10D9899FB9FACE0D97CA343E13F8407BDAB08CB24F45FB5A81591CA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "315f3d54-9e76-4bc5-86de-badb6329ca89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "852a6416-4672-445d-a43d-68a92ff7b9ba", "value": "12288:S4tWKG1Gu7iTQezjBw83duxTdt8yc9jQ0rDXU1:S4tc1Gu7KzuCQxTdtMvr41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394137, "uuid": "86f19333-73ef-40d4-ac11-d59107c3f49b", "value": 467440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394137, "uuid": "c22fe8c3-d5da-4b93-aa6c-d5b20c76569d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394137, "uuid": "704b8e8d-b7b4-4c37-a07a-cc3a3420f81f", "value": "2648886dbd37ccc239ca91bd3d2f4e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabf2763-ca7a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623391376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391376, "uuid": "2ce47cbd-82d6-4d28-a1f6-3ad0abf41df0", "comment": "Malware payload (SnakeKeylogger)", "value": "53e32e0585e6e6f350acd5559a16ea4b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391376, "uuid": "48d7e0ff-f15b-4b25-9b6e-897948e0cce8", "comment": "Malware payload (SnakeKeylogger)", "value": "97d1d1810e3e4b893c8fd9a223ef8dda55a0817b02eddf39c8b1d651e9c06756", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391376, "uuid": "1c8c27ca-7446-4067-98de-8d2626d4547b", "comment": "Malware payload (SnakeKeylogger)", "value": "fc7a99d2d96df43b5436a6d4ee9cde26cfb5b6e0", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391376, "uuid": "98bc70a0-4d70-4a78-a6d2-e202ce70600f", "comment": "Malware payload (SnakeKeylogger)", "value": "f357d6b0781329f840c00b8fcd45baa87882613c90824ad603fbfcef801ee758a29560a4e5b5ae6775baba316d61f688", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391376, "uuid": "b87ca4bb-8aa2-40a9-af40-4c6366aaf254", "value": "6CE433AEFD3579901ACFA9014D6FBD930A284E011806D7C1A7F0CE8807DAC5639A77F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391376, "uuid": "4280e066-7162-4b38-bd4a-cd03af60fdae", "value": "12288:mCL6CoIJznVK4xXZj+4d9aHZNzgO3biRXBHOyi2VGX7Li70nwU6/gh19kcRtZz4T:mu6CoIdVzpHcDlGRJOv2cXdwUUcRtZzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391376, "uuid": "b49d47b3-0abb-40b6-be3a-a6ad0dfe8e7e", "value": 714137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391376, "uuid": "6146f470-b2dc-4758-9574-50473a2fbc59", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391376, "uuid": "0ebabc2c-6f28-4e71-8696-ee153afd1b53", "value": "Proforma Invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b69354-ca9e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623406912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406912, "uuid": "79dd2282-dc28-4f5a-ab3f-85fd6d612df7", "comment": "Malware payload (Loki)", "value": "5cb41faabbf546b658ac48f12ba8a221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406912, "uuid": "db2e6a44-4b87-4e70-a412-bfaa23786947", "comment": "Malware payload (Loki)", "value": "97e61264e6103f4a664ea6d3a2a5894a209322c476374aad0fa2f1dd25b5da6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406912, "uuid": "60641c8f-e12f-4db3-9275-e320c234d438", "comment": "Malware payload (Loki)", "value": "ab0d6ac633119a5cb26b32a5d6f52cdc8fd4821e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406912, "uuid": "e3321511-cf5c-41c4-95c6-ae8e3c93aef0", "comment": "Malware payload (Loki)", "value": "005a6f5d6ade7ee0e4b5a69f16bd4bd0fe7d7c09c8f8633463361485afe59818a6ec0cebd9921ebb20f16d64ab6b0277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406912, "uuid": "270ab060-7c2e-41f6-b2cd-57a054a1e6c0", "value": "0EB47BAC765079EFC81BCD36CAA42C64EA203467570BD207A01725ED9A2DAD7DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406912, "uuid": "4ce9f6e2-2ed6-4baf-b3bb-cc5168f79528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406912, "uuid": "3da4b4e4-8719-495f-9b4d-0c6fe81b6344", "value": "12288:sA4HtpgRpDtAWPTNCcpvAPc+WB5KcJuegIb8eYInr6AvZY:H4HzGTE2npJzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406912, "uuid": "0151aba4-c901-4522-90cc-76ce821e6cdd", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406912, "uuid": "2001648a-f205-4aee-a3c7-c45074bd75d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406912, "uuid": "8e84f339-9407-4253-b057-87aaf92adcd3", "value": "xxwUG6h4XVLKFh0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7609fc34-cae0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623435096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435096, "uuid": "89e9f668-9aeb-4f69-94bd-4de6b6f06410", "comment": "Malware payload (RedLineStealer)", "value": "1f9d361ef3e0b0a79a77b1d71e7c72f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435096, "uuid": "9e8019d4-eac3-4982-9d28-ac56539849ae", "comment": "Malware payload (RedLineStealer)", "value": "99e94ccce8f8e988167bd066d2244242bf1e632708f72bf9c19955f8c80cdf12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435096, "uuid": "448c285b-0dea-4f00-9bf0-64e6c97b5802", "comment": "Malware payload (RedLineStealer)", "value": "bfb5bcd2b4142152a9d458b64ad9bf89bb17e4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435096, "uuid": "6df9e7fd-ef05-411f-939e-03995c4f45a4", "comment": "Malware payload (RedLineStealer)", "value": "89f014f79c9e37b987292acb59c41aec8d40eb973eb3fe34ea56bc2a41a5630188cb3d556f6cbe5cf48f97e299303d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435096, "uuid": "efc399ed-5cb6-432a-99aa-9058752e58ee", "value": "26A2083477D88678ECAA0F7849B6D641E371F4C15102FB1B1AC8914BA9F3B94CA317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435096, "uuid": "1c380068-65d6-4924-8bda-de4a69e3dbda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435096, "uuid": "8bcb4414-56f1-46e5-a883-5b2d1491c1e0", "value": "384:lw2Wv2oDxn4JMJKBl7SY579coTrvOy3xCa2zealA15BwhPjiFaXXoGYVoXJ5cPRl:O2ixiMJKD5QoTDOSIeEnM6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623435096, "uuid": "63a17617-28e9-4894-b055-90e5ff9c0b6a", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623435096, "uuid": "9bae6f2b-c72b-48da-9428-d895e550f374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435096, "uuid": "aa1d90d7-b561-4aea-96f0-bb376c7c4985", "value": "1F9D361EF3E0B0A79A77B1D71E7C72F4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc05e555-caca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425765, "uuid": "ef1ef706-81bf-4ac2-bcf5-0cd3b3e31076", "comment": "Malware payload", "value": "35dbad2bb2408c5b8028bfb115ba1198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425765, "uuid": "e5883502-edba-409a-8ef6-2567525ddc78", "comment": "Malware payload", "value": "9ddad6e5a39426d56ed75ed774a70ba41ff0063c260f17d868b3ca548880e612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425765, "uuid": "d567a6fd-29bb-4a38-aac7-b54efea1311a", "comment": "Malware payload", "value": "8e175821faa7dcdddd080ba294b788867f89194c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425765, "uuid": "f6bb6cdb-a57b-4dec-aa15-49fa9c570b6b", "comment": "Malware payload", "value": "74ebff9a4a08954199ac1060611b799e343b98b0bee7c8904a2398c9f4cbf7a75fb177a9a6713497f4d83fd2592d0b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425765, "uuid": "d0921526-1379-4242-b6ae-2a1e926c44a5", "value": "94653372B2015364F47996FC2DA0FA673C73EAC1B349238378959A24456FCAD0FAD394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425765, "uuid": "cc3b5654-454e-4784-8b7f-62ed4207a071", "value": "8763b6a1950338c007a6f25d75afcd8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425765, "uuid": "e948a8ef-79a8-4f87-937f-f7bb3cdb4f33", "value": "24576:UrJmZuM2kAZGuBbb5CJr6OmwAThAueUQ8XdV5VkVEvGQN6uiSuVBoqezUbiO6M6i:WfWAZhv5CBsAuLQyioPeVBoq++iO7690", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425765, "uuid": "14d45e43-7f9c-4ed1-80d6-50a3c58de638", "value": 1542656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425765, "uuid": "2ba24c3e-a2a7-4121-a2ae-6585b5663666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425765, "uuid": "9b28da9b-5540-444a-a1c4-31c3915e3813", "value": "rootkit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7264873f-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623394288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394288, "uuid": "57ea29ca-2b3d-4824-8c46-650d99fdade9", "comment": "Malware payload (GuLoader)", "value": "2db978e7cd2512c358518b1981fee079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394288, "uuid": "f55d04a3-8138-4d6c-9d7b-91d05abe2f60", "comment": "Malware payload (GuLoader)", "value": "9ec05fd611c2df63c12cc15df8e87e411f358b7a6747a44d4a320c01e3367ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394288, "uuid": "03cd5e8b-061d-4deb-8865-e70e10669310", "comment": "Malware payload (GuLoader)", "value": "22736d8d3ffe0e79cfdc0c08187bdae652d3a23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394288, "uuid": "f362e2c9-b12a-4554-88a7-cad49e35a5f5", "comment": "Malware payload (GuLoader)", "value": "57a69bafc4360bb0066478c417edef5b76d90ae4b34693c33ec35e4071aba96a93aa73760aa8458a599efafde328a38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394288, "uuid": "e6b2b304-df71-4806-9c77-88bf669cce58", "value": "CB143B16E343A426E55180B1FC09E1FEB014AF362DABCD07B6F4FB666474D9368F8606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394288, "uuid": "acd3df4f-e8c0-4a1e-a9b2-319cb1ce8ffb", "value": "51114cc98630aad2088aa48f6e7a2e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394288, "uuid": "bf2d0ffb-70d2-4524-a71d-6cebd6ef5147", "value": "1536:WNwYHz6OVtodLOhD0rd7NOG9jwvEJdx+hE+1nvK+LDWiYmGPeR2pB/uA0sicOnyQ:cH6OVt2LvdpJnJiv1CKWy8p4ALipl5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394288, "uuid": "87e8ef77-cbcd-4886-9839-69dc86b878a2", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394288, "uuid": "d635d0dc-1792-4ead-b9e3-e685f567f515", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394288, "uuid": "2e5287f3-40be-41b7-b4e9-b0fa43684067", "value": "2db978e7cd2512c358518b1981fee079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31145762-ca78-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623390313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390313, "uuid": "27d2e4bd-b760-4174-9e27-1a3bff467a76", "comment": "Malware payload (Loki)", "value": "60ce782d8c140b615213c5a6c7439f0d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390313, "uuid": "021619d8-1961-49ee-9fcd-437fadb851ef", "comment": "Malware payload (Loki)", "value": "9ed3b4a1f25328f29981f22200b31679e9d0cbfa056578836e398781ca7f93f9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390313, "uuid": "0ea9eed4-680c-4597-ac13-a616cec53673", "comment": "Malware payload (Loki)", "value": "bd8e34e7c3fe8cba43018c6c66902d7d02808485", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390313, "uuid": "4989e0b4-9e1d-41a2-b419-a86d3eb9f998", "comment": "Malware payload (Loki)", "value": "60e792cd35fcb16bbb9841cffe12cb57a4c95f0b539ba5cf0d4836e46ae095aa55c843df7473bae929f46939d69124e2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390313, "uuid": "00ca3ffc-e9e1-4721-a6f4-717e22bfac66", "value": "25C423A6995EF604CE11E3E47FD32CF383651B939664F6292B28B7D4840920EF680FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390313, "uuid": "e956f1d3-8456-4c20-bf48-c508879f7340", "value": "12288:yg5p0ZBcvs0Jkzs+NF2g9fKGiDt1BNcnepmY70MhiN3YeAApOxA3xP9/5:P5p0Z5n2g9feTrcneh839DpOODR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390313, "uuid": "38c4b6b6-45d0-42e0-8fe9-38c8b4711ccc", "value": 575940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390313, "uuid": "4644b4bc-c1a8-4dfa-87c3-50fd0d797a33", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390313, "uuid": "ddaafbcf-6903-4725-96e3-a4e46599886e", "value": "Detalles del pago.pdf______________________________.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84385e22-ca95-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623402908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402908, "uuid": "b4e5d101-37f2-45fc-a148-92503bc94487", "comment": "Malware payload (Loki)", "value": "a7f5f434e6ff69a238bf75082c975fbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402908, "uuid": "20db6d55-c8a7-429b-9fac-9aaaf760038b", "comment": "Malware payload (Loki)", "value": "9f00d2c67b04faada1cba4e07202fb6cb56c1590d5a4a9e5af7342e0b655c96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402908, "uuid": "2fdec53f-8531-4194-a7dc-aed2196308c2", "comment": "Malware payload (Loki)", "value": "d0afa757467d5f8cf4b58a230890480940686e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402908, "uuid": "39e38f5e-4863-4398-b607-9aabbc5dc996", "comment": "Malware payload (Loki)", "value": "894b12784a77d4eb3f6779c04dec114fd66b36faf9490612e2dddb1d3b5688842568c8280533220f2312552f8e6056df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402908, "uuid": "ca86f104-aef2-4254-8f5d-8aff39f28216", "value": "7265BE1026009B10D16947368C63DAB08FF9AD0EAED2C61F6DE73D9F39B1BB1152D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402908, "uuid": "166ec392-008b-416c-b959-05b2e871e7aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402908, "uuid": "cd1f3014-cc64-4bb0-9b8a-43751ad34d7e", "value": "24576:lQYTBcYeCpGYlr1+NeBUdtesEgQspe/z8YEoqSg5LlJfHTBddSZ4H7Tiz5H1Fh3U:lQYTBcYeCpGYlr1+wBUesEgQspe5U/BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402908, "uuid": "9c79000e-4dbb-43cd-9167-b523bd0712ce", "value": 1523200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402908, "uuid": "dc4fc445-0ee2-4f46-8329-4d607421988e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402908, "uuid": "ecb3e644-9161-41fa-a787-72fa7bea88d8", "value": "Detalles del pago.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6ccb74-caba-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623418841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418841, "uuid": "8746c26a-3b19-4179-a100-77b575337f91", "comment": "Malware payload (Formbook)", "value": "759b0d51f128f54e516ad1941a896d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418841, "uuid": "0d90a3c0-2f24-4e24-a02b-e3299d883b69", "comment": "Malware payload (Formbook)", "value": "a08bf89a7e4c15fb33684e268199df85727a6ab759a1d7f3d5ba2b7a0e49f17a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418841, "uuid": "fced886e-c063-4a90-8940-1dc3af707d51", "comment": "Malware payload (Formbook)", "value": "13e8d9d44cf15bcfc43952eebc3f10fcafed23a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418841, "uuid": "280068ad-840d-4865-adc0-ace066f78f75", "comment": "Malware payload (Formbook)", "value": "555bb49a8bf25f61359df67f1d846e64e2667b89f7ce02a1acc565e1a6a08afbc2f61f0ef59b40ce200f027c3977ab7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418841, "uuid": "77ca2ddb-8dae-4a7d-8905-0196f94fd712", "value": "3E24129D31D184AFE8466872B77EC7A6DA3EA0441326157B7F702FAF38103C66867247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418841, "uuid": "b664c9ba-8350-4662-8607-337a41449263", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418841, "uuid": "ff882c81-8d86-46ea-967d-f08452b202dd", "value": "6144:Ds9S8uq8rbsONjyPS4cebFLeingaqlN1oENmejm:yyqmb+Zzngrd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623418841, "uuid": "1c95b2e6-8730-4bc7-8448-eadc28c82d1f", "value": 221568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623418841, "uuid": "ea075e48-1e29-4aea-a506-39cbd0d24974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418841, "uuid": "aee95d46-41a1-4351-9b3f-b2d20f675828", "value": "OrderKLB210568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb27b4f4-caca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425790, "uuid": "4037ca43-e431-45a3-850e-4dda3cc5a043", "comment": "Malware payload", "value": "08d2ae8c175f0185463315c7f6c68db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425790, "uuid": "7e4dbd53-4077-4073-bf89-3b08a49dd858", "comment": "Malware payload", "value": "a1a0ca95d42cb766533d9c4a8260cdcea4abab6d17214b711b7f366fbafe2413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425790, "uuid": "5c166f8f-7dc8-45a0-9bb9-45c1430783cb", "comment": "Malware payload", "value": "c0112f00545a22b383e521f75c8090871faf58cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425790, "uuid": "b4450ae3-1271-44ed-9df6-8552e17578bf", "comment": "Malware payload", "value": "61821ba4175913ef2370797778be5accf33522e52985d14380225e277a7f76642ad1ae45af96c2cd4bec7b672f5caf21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425790, "uuid": "5d965735-0c73-4647-ba9e-146b92e2578d", "value": "53A5338C6D66C426C58239FE0A364B87D7F4FD632A8B7D3679F246AC321113A367641C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425790, "uuid": "b4abed14-531d-4ae6-bdad-167193c179b2", "value": "49152:oWTIMep2y6aX1TDX6/IL62VhaSVnX6lem:oWcMyDKA3hNX6lem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425790, "uuid": "1d3c2b70-963f-4974-9789-d9febc44c5f4", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425790, "uuid": "9522b122-6c7e-4e18-b5d8-957babe9aa88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425790, "uuid": "37706cb2-f9ae-444f-81d2-aea9bffc0ca0", "value": "hm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef366147-cb02-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623449902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623449902, "uuid": "2c0aacba-9a32-42bf-b480-a25489f26528", "comment": "Malware payload", "value": "9d7c44e4ce86a81316436563104f345d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623449902, "uuid": "18f43f64-07f9-439b-9489-6a48bf942322", "comment": "Malware payload", "value": "a1dad697a6d93f98bb70d3d023025cde72d95faa1cea168a5b1e81137817b089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623449902, "uuid": "145f472b-709d-4dc7-a047-4f0d82a9f8df", "comment": "Malware payload", "value": "3b711f7dfac4bb776d40af2b5ff65f18782844f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623449902, "uuid": "5c4cb70b-8e4b-4bbe-9e44-6544d2e92717", "comment": "Malware payload", "value": "96dfe550c589d342e4f4bc59186ad225f005f49cad39042afebfe21743ae85de3569801a3e77d3ae396bdf21a4390a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623449902, "uuid": "2a7ee5dc-2452-4fab-acff-47c31316d091", "value": "11C4492039FA5119F273EFBA4BE4B496DA7FBB737B02A4291051138A4733A41DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623449902, "uuid": "30a8cb9f-5bed-4ee9-be09-fb99184b0374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623449902, "uuid": "b74109a8-2945-43f2-9269-a66422e7fa83", "value": "12288:R33/aQ0eG2TisXPA8R6egDXnS9eFcAdMYRGiziFtVAcDi3EwB4h8xI:RPjr51gT+eFfPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623449902, "uuid": "ddb889ef-00e2-4883-9b7c-0ce2d20df63d", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623449902, "uuid": "7d26b75b-86e8-43eb-a9f5-8717be61b756", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623449902, "uuid": "6a8dd45c-09ad-4bbf-9b63-fb4fec9459d2", "value": "8964532115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a851c9f-ca89-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623397576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397576, "uuid": "da55df2e-9d8c-4892-ac7e-36432160e793", "comment": "Malware payload (RedLineStealer)", "value": "8cd51c4ba5a61fec3157fd7480ae4aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397576, "uuid": "8501633a-8d1c-4363-9fb0-a5e0cd7c0081", "comment": "Malware payload (RedLineStealer)", "value": "a21ba2cca50c3cbc2bef552358a550bb9b0609c2b85dd57b8f868ab2057c8b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397576, "uuid": "a03ed530-a4d9-44d1-abeb-f21bd5cc3cae", "comment": "Malware payload (RedLineStealer)", "value": "2d4b391d455cf180d1676cbcf1605e84fff45990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397576, "uuid": "876f1c6e-dfc3-46e4-9b0a-5f3d7c3ed268", "comment": "Malware payload (RedLineStealer)", "value": "9079e742a3e120390e1512467866e238d47170982e164a39389ecc852cd156ba0eb0bce78949eeb69ecdcf2538411b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397576, "uuid": "ea2ffe75-cd98-4024-b3df-a8098a0c5803", "value": "3094B74E3A75BA06C3782B71C0DF15268374DD42A9F2B3663DA963F849533E33A452C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397576, "uuid": "8ce71332-9195-4cb5-b99f-e475f8e7dd18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397576, "uuid": "8b83d209-940f-46b5-9f14-e18bed20e1e6", "value": "6144:GocT6Juc/oIQXWHKXxO6bjZbvzsqu4hORoLYezAsskV:tcM4OcZbv81GJcsskV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397576, "uuid": "c13038b2-d4e4-42ae-a07d-b0fdfd2db7b4", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397576, "uuid": "18f79099-4c04-48d6-b197-015012dcf411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397576, "uuid": "c923e59a-3794-4e82-9ae5-805039ddceb5", "value": "8cd51c4ba5a61fec3157fd7480ae4aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c12d83-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1623423578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423578, "uuid": "abfddb31-aa99-4e2a-bc19-7bc2d71f3fe4", "comment": "Malware payload (Dridex)", "value": "58f33be45dd5de4112666ff6babbc583", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423578, "uuid": "d07cda24-d482-430c-b1e9-332c48ba6bda", "comment": "Malware payload (Dridex)", "value": "a2c44031072fa5f19a299ce6294b8bfefb80bc829b323007838ffaded741f1b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423578, "uuid": "318ed890-6689-46cd-8c9c-d0d6d9f25ae1", "comment": "Malware payload (Dridex)", "value": "1841e586bc644fc4467342d2075398afbc481258", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423578, "uuid": "c00f8a85-1545-474f-b259-58697b9c78dd", "comment": "Malware payload (Dridex)", "value": "5a73469b43fd6bb1bad09651eab2fac42f2f75aa88caf2eaf09990b5ce52777add1e9b90b1b845df34708565695c1487", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423578, "uuid": "74a878ca-d696-4f5f-bb58-49bec2edaf49", "value": "6C04E153C6DE045DE397C034AADAB06BE396BF711E2CC848F5E9C15A82B2D434B72E51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423578, "uuid": "61518302-510a-4d5c-a7e8-93ed56edf3cd", "value": "5594ced7851e7059f91664ceabe2c1e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423578, "uuid": "4b32e494-0305-484b-a749-9508349711be", "value": "3072:MaI6YY/DDdmhdj+O2WYXwU3qstRty89ksDpqOim1Gz4:MazYY/HO1kPdy8ksDA1mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423578, "uuid": "7fe6b52d-c62d-43cd-be7f-aff39ec05f56", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423578, "uuid": "70af16a3-0878-4cb9-9b03-439b6790b4bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423578, "uuid": "d0f91d27-41fc-41ad-ba51-07af606361f0", "value": "58f33be45dd5de4112666ff6babbc583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6337d68a-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623426904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426904, "uuid": "143ac089-28db-4a00-9e22-a847df7a3bb0", "comment": "Malware payload", "value": "e0a85a4b5242edc76cad1c8493564e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426904, "uuid": "04660e64-3dd2-4c06-a725-c27faf0e86db", "comment": "Malware payload", "value": "a3015561445a62c6c57a0fe8422c8518c94b23219b382ed711262c60a9c6725a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426904, "uuid": "5cbd2082-5a15-4979-be0d-600040aed243", "comment": "Malware payload", "value": "ed7a955e538213ddc4c8fdd0e122bc5079b81fe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426904, "uuid": "a408f7a7-d765-41a7-b174-0b69af4b6304", "comment": "Malware payload", "value": "b77067deff0d28518d82cd5b6afaee25b4bcba04a6cdac2c501cf62cef849c385262b24095482b11b4c87b2ba30a450a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426904, "uuid": "3703a8bf-c40c-4eaa-9708-a29132ba87c5", "value": "9A93F893B801EEB7F40ED77644D34B24B270FBA14A531A32731B3966AE762D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426904, "uuid": "a4843384-8807-4779-9b3f-0dafceea5595", "value": "1536:zk56YnMKW1gw78tAgVdYyIiV1MH9OSHYVeyC679l5Ma2GHFBmzSNVPXsCRfhBX:Q/s1JyVdYyIiVuH9i52YmuNVPXVRfhBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426904, "uuid": "7c0afcee-7b34-42a1-9d57-21c3df8a87b4", "value": 90724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426904, "uuid": "8ac8c750-87d9-4a81-8a56-64e5e105e6ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426904, "uuid": "bc08009f-f57f-4e2b-85fb-522e362be254", "value": "e0a85a4b5242edc76cad1c8493564e0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc9be89-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623423592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423592, "uuid": "183aaedf-cef3-416b-9731-16d773798ef3", "comment": "Malware payload (RaccoonStealer)", "value": "ebb774f909e492b4a4b64f0ded09b7bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423592, "uuid": "84c246e6-2d07-4d99-bb1f-c9d58e85c4a7", "comment": "Malware payload (RaccoonStealer)", "value": "a3bdabe80c498e418f5c8b87a34a7b88013b6c803385012bacff4bb388207c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423592, "uuid": "1dd4030c-144d-437b-83fa-6af581ae2c18", "comment": "Malware payload (RaccoonStealer)", "value": "90eaca358f728824e22f5aabd18455eb8fc1b724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423592, "uuid": "d59dd3e7-fb15-463b-9257-f3c761e7ff0a", "comment": "Malware payload (RaccoonStealer)", "value": "62623a6b9782ce7329fc4b06e3d641f9de56c2caf45357fcea079272f07476529e6d6696225ac2e8056fa0492fc732e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423592, "uuid": "e5785fc9-fb2d-4334-b806-310af39c5593", "value": "FCC4E010A7E1C034F5F736F4AABA8269E97A79B2673490CF52C516EA46345F0EC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423592, "uuid": "6730bcf3-f1e3-41e6-adb1-2233d0591c59", "value": "661bc2c985f77ecfc0f4afb69eba9855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423592, "uuid": "7b20cc4f-ce53-44bd-8142-d5ae2ff64f85", "value": "12288:qywcbHDwWmg6oKb4Jx93NsKAdRDt7m4YLg9r2/:gyHf6pux9KK+n7HnrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423592, "uuid": "96c0b561-9e0a-4bdf-a569-27fb8b1bfd46", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423592, "uuid": "3d7c43c0-f20f-4647-9078-7c0769cf3e9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423592, "uuid": "0d4623b0-268d-4b97-9be2-b226b44fffff", "value": "ebb774f909e492b4a4b64f0ded09b7bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89f63ff-ca93-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623402110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402110, "uuid": "9c2da224-70e7-4aa0-a21c-47999e15a3ee", "comment": "Malware payload (AsyncRAT)", "value": "a4695298dfbeb34ed733ca2b0c1538e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402110, "uuid": "5399ac1e-53f7-4ca4-82a8-3b87d2a1b224", "comment": "Malware payload (AsyncRAT)", "value": "a418d42bd0343460ebca4a5613f041089de955c47a0f73d4b01c162f7fb88201", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402110, "uuid": "3ee6be1a-e8cf-42df-b196-30fc4e982787", "comment": "Malware payload (AsyncRAT)", "value": "dfd73ff8a8a6c433043ec214937e75e6577e2af3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402110, "uuid": "94ea8179-2d1a-43c9-bd6d-862dd71f8808", "comment": "Malware payload (AsyncRAT)", "value": "934a0d6bbb8b2411a9eab169b45e9c0f7699b6fa190751419c50db7b9edb3266f0ee9f8a4e57332576a6d423a3f6790f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402110, "uuid": "a5e4f402-7341-41fd-94a9-c2ad4fa562d2", "value": "11C5011FB384DB56D6392831C0DF539007A04E9D31BAEA562FC87E953A02F7E18546EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402110, "uuid": "1f22c78b-029a-4f22-8537-dc91f740fd81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402110, "uuid": "d17e93ca-2227-4b89-b6a9-b0dd2c46a90e", "value": "24576:Rcf3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f3nW2f+:mf/f/f/f/f/f/f/f/f/f/f/f/f/fuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402110, "uuid": "987d1041-c2aa-43cf-b1a0-8909517fb5e2", "value": 2587648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402110, "uuid": "322522c2-5e0a-42d9-b1d3-4612cf84f994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402110, "uuid": "a88ecf78-de3c-49f2-8dda-e4994028f7d9", "value": "a4695298dfbeb34ed733ca2b0c1538e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7beb0f0d-ca80-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623393874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393874, "uuid": "74df77af-5b3a-43fa-9a66-66401299b368", "comment": "Malware payload", "value": "d86922868602b785f595f06a0fe875bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393874, "uuid": "3c1ba382-df7d-4241-a916-a182c38788e8", "comment": "Malware payload", "value": "a4d4332bfa88880a57d2aabf980ffa67ba399ca922c6d13a59e2577dbd80fc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393874, "uuid": "1c5e664b-724a-4091-9657-28e038497cd4", "comment": "Malware payload", "value": "3bf566c302d65d9a0ce8ba8464935b4594885d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623393874, "uuid": "ba7e678d-2d55-408d-a59a-cf6c226f81d2", "comment": "Malware payload", "value": "8ebacf2158bb0039c1d444bb66f9c10ba90669c6e6d5be659cc582e547a75e3b7361a8664db90f16183d469709ae5def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393874, "uuid": "c60fff05-9698-449a-875a-b3a0098ecc0f", "value": "31963393828A4A23CBFB94B371221C78415E2C938D6F81BD495A2351A5475F3BDF362F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393874, "uuid": "95fb04a0-7f02-4ba2-a947-fb2a47627998", "value": "196608:FBZEk9jjXSKobI2e57AQ0KINzI6NQgMTbIJ+4f9q7fTA7zXoMsu4:Tv1W7bI2eOsOI6NknGM7b+4Msu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623393874, "uuid": "8f3b2c1d-3e71-4ad3-9d48-45d0c81ede17", "value": 8669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623393874, "uuid": "5fcbc21a-0216-4ccb-97ce-2f8060c7e9ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623393874, "uuid": "e569ecdf-cf58-497c-816a-859ef703a64f", "value": "d86922868602b785f595f06a0fe875bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8ddfb1-ca7b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623391862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391862, "uuid": "8172571b-f160-4a47-9b64-24647203d0ef", "comment": "Malware payload (RedLineStealer)", "value": "678f949b944feed0bfc4d93c6c99647d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391862, "uuid": "95b0c9dd-2c58-4540-bd78-8439ec4a862c", "comment": "Malware payload (RedLineStealer)", "value": "a5004ff6ba57491d63f9d4037b08a86d2825bac37bf3246fa7467e0c7e553f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391862, "uuid": "69359b7b-e69c-44eb-b9b6-884c63485070", "comment": "Malware payload (RedLineStealer)", "value": "b110b968f3b98a63c9e18bb549c9a0d56473025b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391862, "uuid": "0de6c59e-1fcd-4c6d-b2ad-d40179775d59", "comment": "Malware payload (RedLineStealer)", "value": "1e84ce0beb238bfa9807563ca3a99b018c225c0721baf0b27307dfa5c214224ad6ac087b7f80054d41b6e0579407dd5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391862, "uuid": "bbc85328-cade-4fe0-898d-dec46a355b6a", "value": "5CF5331173C4C8FFE9419571BA8C2F7291ADCB98473148DB67B0C8599F2DCA0A22F667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391862, "uuid": "ec7a8905-d927-46bb-8aeb-2c6dfbb057b6", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391862, "uuid": "1bc0f612-b01a-4b6c-81c3-d9c8f34657ea", "value": "98304:xvCvLUBsgxDQDjzB11um5VIiAIFDMRkP1bmBRaYdHnr:xcLUCgxDID1uoODRkP1bmSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391862, "uuid": "5863a92b-15de-424a-9a69-934be5baa033", "value": 3442230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391862, "uuid": "0fd4864b-ce88-406f-bd08-cf8619317a7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391862, "uuid": "c3ce2472-5a42-4d2d-9a42-5f976cabfe08", "value": "678F949B944FEED0BFC4D93C6C99647D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26eb2175-cac4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623422938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422938, "uuid": "038f9d74-b6ba-4a50-8c47-d90235215ed4", "comment": "Malware payload (SnakeKeylogger)", "value": "f2bff0002fdf4b2eed5aec66ea398ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422938, "uuid": "28ff9b80-66ab-40da-8555-14939a5162f1", "comment": "Malware payload (SnakeKeylogger)", "value": "a5484dfe81c735b26ce2900628b289b97a105fe87af2dc847230cf81369e6160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422938, "uuid": "5989151d-3d93-4253-880d-a4d0015ae7af", "comment": "Malware payload (SnakeKeylogger)", "value": "4abb8193d9e8c8c00c62b21c248ae8e49a744127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422938, "uuid": "340443f5-e7b1-44bc-b53e-c58cebac323c", "comment": "Malware payload (SnakeKeylogger)", "value": "acb53fca284f7e00c3cc52b284ee068cf29e2e4c2d3913e703abc7385f6d6434757667ec31ee1a4932d80ac73468a12d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422938, "uuid": "975f0814-a2d7-45b7-8e8a-2097fb6517a6", "value": "6383DD34364C9F22E17EE3FDA600544153F5250BE316E9CB3EE645D286A2F984A77C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422938, "uuid": "d35df958-8802-4ca5-a435-7beae0e0c382", "value": "1536:MHLRTq9MXelFl5taG+Gy3coQk1yCGBSHuHszO3Z8YK2dwfjA9KlI40HuhYtf2PgT:Mok1d0GRXqatascOeL69JQrjAxL35E0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422938, "uuid": "912779ed-c3de-41f9-a684-9999a3d61033", "value": 83693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422938, "uuid": "260beb52-e548-4e22-b0c7-4262be4507a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422938, "uuid": "ca38e481-38a4-45de-9e94-5169d5cd9a46", "value": "f2bff0002fdf4b2eed5aec66ea398ac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b21b36e-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397121, "uuid": "790a44fd-e5ab-4df5-bcff-0011cb1f3f50", "comment": "Malware payload (Gafgyt)", "value": "1e12156318c4010c91d5aec67daf8ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397121, "uuid": "298c4143-7270-4c1c-9191-b9167df5e6e1", "comment": "Malware payload (Gafgyt)", "value": "a62b6f259fb44a560c999e23fa7cea0c9d69335050ffc4009142e4ae0fbb15d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397121, "uuid": "c057ac65-bc78-44c1-a12e-3870ab5ac333", "comment": "Malware payload (Gafgyt)", "value": "7b21be7e19adcbbecf547874c35dd8e39d9d8ba4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397121, "uuid": "44d64d8b-2f1a-48a0-9f50-2f7ec8dcf349", "comment": "Malware payload (Gafgyt)", "value": "c15f0ddab28fcbb00322fb200c51b7ca0fc7db5db23ea6fbcac6db13d413e5678ca3a55632bfc3cc0410bdc502bb1029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397121, "uuid": "bb3f2505-015c-4dc9-9a66-3c0dc0207003", "value": "E1C30805F8408727C7D22BBAF79E438D7B35669867D733015A396EB02FC1B982E39560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397121, "uuid": "31c36d7f-c363-4cb6-8461-a8d2952d9186", "value": "3072:AFD9QaltQ5noKX/4u4IIqaXwX9Wb5hy6cbpY912g70fQQ/h+fmADnm:9KCaXmWb5hy6cbw70fQQ/h+fmADnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397121, "uuid": "0e250bfe-0803-43ea-9765-c452ab6de28c", "value": 125379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397121, "uuid": "df6c04a0-4cd4-472b-9681-217b3d337f73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397121, "uuid": "1024bc59-9901-4c93-ad12-c942f5eff7c1", "value": "1e12156318c4010c91d5aec67daf8ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3463b5d8-cad0-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623428114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428114, "uuid": "61cd1d1e-3d38-4472-a11d-da870560bd04", "comment": "Malware payload (DanaBot)", "value": "ccc17596224c548da9634f62450b6728", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428114, "uuid": "f056e4b8-8bce-4bc2-835c-33de1cd43c3f", "comment": "Malware payload (DanaBot)", "value": "a6a41bf5e8bde56b9778f0919fb4709e023e82f23820b2ed8e00a724ea32c142", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428114, "uuid": "b380828b-17f8-4779-a0bb-6dd88ec66368", "comment": "Malware payload (DanaBot)", "value": "72b7fc30272363cf312aa4b08eb589bcd1d9bb22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428114, "uuid": "fd1283e4-eb7f-4426-9d23-39a0fb016427", "comment": "Malware payload (DanaBot)", "value": "69059ab641a67f300f9ba22b73f388685e80037db77f8f7379c966ecbab9b87240418ef647b22d7602b39bbd77393fb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428114, "uuid": "c1096f31-3fc7-4610-b040-fdcb056744e2", "value": "655633103AE1C435F27741F0A6B447B76E1DB9B2137981DB42ED25EA4A6CAF0EC31B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428114, "uuid": "19c80e22-e04c-4ff2-8f0d-607167cc4ae4", "value": "f6fd925686f2488c5f12dd7bfb580a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428114, "uuid": "69a00f64-bf1c-47b8-9e5f-56ab6263df63", "value": "196608:en9dD1x9ryGSgTskEQETnpSL7KX3XzJ/tKZ:eXlryGZUoOXzPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623428114, "uuid": "c31bff67-bc6a-42a9-b892-918b24ed65b9", "value": 6296064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623428114, "uuid": "fa25af97-98a0-4122-b094-fc99236b23e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428114, "uuid": "d9125799-1360-4ac1-bcee-2f63a3a81fc1", "value": "ccc17596224c548da9634f62450b6728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dcfc58-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427034, "uuid": "9edcaf53-6189-45b0-ace5-b4d45735b7dc", "comment": "Malware payload", "value": "be7b2cf5a33806db82c251647474b8db", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427034, "uuid": "6c0f6a7a-af0b-494c-b1ab-92dd77b949c4", "comment": "Malware payload", "value": "a6af3a849978f7373aaca416b8c993d43065fbb88e553dbed9c36df59c57bdbc", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427034, "uuid": "e002ff72-7533-4401-8228-7057f75b4d64", "comment": "Malware payload", "value": "81e6362829f871573e6a87848e6e039daf3f1945", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427034, "uuid": "10118ea8-68ea-4443-8ed4-d97b8572e92c", "comment": "Malware payload", "value": "ca577a651685d69d17cfe9a8e86b7a5baed3fe1443a12d455c05f9ec8b757237761c53e305eb05cc059d0303267214ea", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427034, "uuid": "c9986ceb-5d39-4a2d-94a1-0f465861bc01", "value": "CA21B15667D37D67CC540277DC9F6710E321AF85858EF513F76212150D6F2191F2114A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427034, "uuid": "895b7970-81e1-431d-8a61-3de76ca8e402", "value": "24:KolMlWqY3D5KjEoKGOrUlFSs0VzLCkIdZ4VZOI5WAkKoXhMNfE7:KolMEN3DMWrkFSsCzLDAI5WooXhMNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427034, "uuid": "d6a28b54-be99-4e67-a1a8-2bab17e94d28", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427034, "uuid": "28ef5eb4-7f33-499b-ab6f-5cc977270f43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427034, "uuid": "ea544620-8426-46cd-bb21-829422748416", "value": "be7b2cf5a33806db82c251647474b8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0b78a8-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423538, "uuid": "18a79970-6cf4-4b29-ac29-d15d5c987930", "comment": "Malware payload (Mirai)", "value": "9988a40ff8917a1b5d2d05bb6aa68005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423538, "uuid": "9fabfa99-c9c9-44f5-92e6-354bd028d2f4", "comment": "Malware payload (Mirai)", "value": "a76913d44a7faac6c90ff642f9e699243427b2d6a6404bb47e23a2610008fa07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423538, "uuid": "c62e6bb8-471c-4f88-8e79-1b38b065634c", "comment": "Malware payload (Mirai)", "value": "0ef3f312d82168de465996ba0b2bdb2869b7cb3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423538, "uuid": "4db0f253-8d22-4959-a933-a6ab4fa3a8db", "comment": "Malware payload (Mirai)", "value": "d49ed3b8a93777338fd6f6277cd89de3edc9c94816b16ef01a298c0fa46ba3622eacfd6376471a71d5b574e3c58183a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423538, "uuid": "010f1466-c204-43c8-9094-a86ddfac8d49", "value": "8303E19D6899CA99B06F51F50DEFAD6F222EC01920C5C1E7C7DCD22764A8FE58D18280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423538, "uuid": "97814718-8be6-4a84-85eb-0746efed840c", "value": "768:kMhiKrWyVyHzSW6Ewzmmdtsm9HWZyDKgvSloodOIBVEnbcuyD7UHQRj3:kMhB8zSlz3Gm92AK4SlokVEnouy8Hyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423538, "uuid": "94701fce-b6d8-4579-ab28-e1cfddc3685f", "value": 40196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423538, "uuid": "25d5a247-7bf0-4e50-bd1e-bdd01ba5d642", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423538, "uuid": "5c1d9390-66ed-43f0-89a3-502699e77d93", "value": "9988a40ff8917a1b5d2d05bb6aa68005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93960904-ca99-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1623404651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404651, "uuid": "2f2bca26-d15c-499a-91a1-729d524e27cb", "comment": "Malware payload (ParallaxRAT)", "value": "e92ac2a61e4bf3c3da68dfc9ac3fd984", "object_relation": "md5", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "ART BOOK PHOTO s.r.o.", "colour": "#9E3FDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404651, "uuid": "936c3e01-384c-4e5b-8dbf-978be197e153", "comment": "Malware payload (ParallaxRAT)", "value": "a7fab8c1fc7ffc5002452f5a783f7a43b263ad302fab8d9fdd412610122f77ce", "object_relation": "sha256", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "ART BOOK PHOTO s.r.o.", "colour": "#9E3FDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404651, "uuid": "0b62f0ff-9c93-49f8-9a1c-24cc2948eaeb", "comment": "Malware payload (ParallaxRAT)", "value": "96c339a1d4f63b4440563f398e5d49f935a9e8e8", "object_relation": "sha1", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "ART BOOK PHOTO s.r.o.", "colour": "#9E3FDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404651, "uuid": "85c8b4ad-87a6-4dfc-b40f-23c54e3109b9", "comment": "Malware payload (ParallaxRAT)", "value": "e76960650ac847dc7b3403604fcc17660b0ef2cc0058c10f5c3282f1b601e11f0a01e6326568222dde641dbeb24657cb", "object_relation": "sha3-384", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "ART BOOK PHOTO s.r.o.", "colour": "#9E3FDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404651, "uuid": "d2fe2855-c907-47f6-b7cf-f23c83eee7cd", "value": "E1A56B23F69058F2C1530E33B958F378F2AFE5B02A2D43C752949E1D2935592962DE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404651, "uuid": "3367ddfc-2009-424a-94ce-1e7a3e0c3638", "value": "5abfdc8b79e40a46a6a568a331f4e162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404651, "uuid": "3c65ed14-7ab3-4653-ad99-94a1a5c0e52a", "value": "49152:c8sCjX/UftsomEnDASTcGKwmghyBtTNVvfr/SAQXRKb7luc2nvK9OMy0:cijssoJnsSTSwThyBtTNRfr/SAQXRKbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623404651, "uuid": "cb2f51d4-f017-417a-a5bf-8932a4fb98bd", "value": 2164672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623404651, "uuid": "e5f528af-28ff-4749-b1af-46c7f2da182a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404651, "uuid": "de033d38-eb8a-40a2-81e8-bb9be851a84a", "value": "a7fab8c1fc7ffc5002452f5a783f7a43b263ad302fab8d9fdd412610122f77ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5ee505-ca87-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397093, "uuid": "2c7abaa4-d6a3-43a1-b25e-08aaa97f339b", "comment": "Malware payload (Gafgyt)", "value": "d474dfda285b287f4f8474479f465899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397093, "uuid": "8bee5a38-ac16-414c-9076-c9a458264ee5", "comment": "Malware payload (Gafgyt)", "value": "a98f0121ed69d9e8a58159cf7037d1132db7af469c5f61fcff2e519ed9f99957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397093, "uuid": "fe9e3337-ba16-43f2-982e-a969a86d5441", "comment": "Malware payload (Gafgyt)", "value": "439e5e5413ff3cbc9cf7368ed68a33f9a1ae1caf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397093, "uuid": "90c1e41a-48d6-4fc3-8114-dac0fb309ae5", "comment": "Malware payload (Gafgyt)", "value": "55a5aadd92c38ddf2a09b0e14a0f8a31e51dbea2e66a2a0d2a7da1cb4228421c888d02773cae33c03fa8d63ca2be30dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397093, "uuid": "654d2366-55f7-4abd-9528-9c1a17bab8fd", "value": "F4932C86E642CAB3C4430AF5126FAA5A0731FD2A4E3B8EA6F71C7DF49F125C431157A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397093, "uuid": "c16de241-08f8-4bff-9035-cec04f19df93", "value": "1536:Tzhq/31JOFJ7H4CDfzzW3c2vIKwijfMEIVjD5h8wNbwWshe0QzUzJYQ2Wk:s/6FJ7H4CD2s2vIKwijfMLf5h8LWUe0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397093, "uuid": "eeab32d3-a893-410e-9979-0d1388f30bca", "value": 91567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397093, "uuid": "60a560e9-2935-4b37-8c4c-6fcfdd3b6c49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397093, "uuid": "82a59489-1274-40a2-8fe0-8d2bef88718c", "value": "d474dfda285b287f4f8474479f465899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e08c8-ca5c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623378370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378370, "uuid": "3f438db1-8b9f-4b6f-8c88-69f25acbe7bd", "comment": "Malware payload (RedLineStealer)", "value": "2b862c6350557bc32519e55f14a1e3a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378370, "uuid": "649c6153-a0c9-4ffc-9cf1-d10ebc5826ef", "comment": "Malware payload (RedLineStealer)", "value": "a9bbb6b83cc3d2aa7d25422179a82d7ecb2c84f41b6ad1067aa46883446900d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378370, "uuid": "c3d1bc46-e3c8-4c7b-ad99-3f25675e3d4b", "comment": "Malware payload (RedLineStealer)", "value": "21b80c4e66a260cbf2d1b357e1300517f39d9619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623378370, "uuid": "5652f414-9f21-4af5-8a4c-e4a9ab02e9ba", "comment": "Malware payload (RedLineStealer)", "value": "10b8ccd068b3beed1892ef76a51bec83e8fca99852b79a7ddef9d5604670cbda0dab69e7bac47a1c78f625025b5b2fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378370, "uuid": "a542aaec-b645-4747-b868-9750e0c98eac", "value": "C7948D10BBA1C038F2F262F49DB592B8652A7EE16B2450CF52D52BED5B785E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378370, "uuid": "17baf95a-f187-4a49-9543-2a5a12b6b000", "value": "d6a36b884bfd01abb7a2c7a46733b09c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378370, "uuid": "8f6a9244-5779-4b1e-9670-a7f7ee3b80f7", "value": "12288:mZlF+gt4Nup7DuGP1gn7brXCadoFuLf3Exiv:mnFhuup7DfsPXCsoELfUxiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623378370, "uuid": "fff6a1a8-66ee-4c8a-ba72-8fa753a42312", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623378370, "uuid": "cc771025-7d80-4bc4-923d-653cda72639d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623378370, "uuid": "f5fb43aa-742b-4435-8292-a6b815222557", "value": "a9bbb6b83cc3d2aa7d25422179a82d7ecb2c84f41b6ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bbf952-ca6d-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623385839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385839, "uuid": "9622d5b3-e38f-4b46-a6ef-6288d4996ad5", "comment": "Malware payload (OskiStealer)", "value": "328733d92332e282737f4d92ca3b4a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385839, "uuid": "5866269f-64df-45ec-afcd-a0b901cf39fa", "comment": "Malware payload (OskiStealer)", "value": "a9e2f90e66d12cacb7a8b02ea3a352a1d0fd7b9e09e4a24dfaa53932fcfcff19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385839, "uuid": "e826c587-aba4-4820-ad46-27db1850e914", "comment": "Malware payload (OskiStealer)", "value": "80b6e47d3701b7f5173e87303f21fa3f9fdbf42a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623385839, "uuid": "3e989054-0d11-4a4c-a490-09307c97ca49", "comment": "Malware payload (OskiStealer)", "value": "0285ee39d1b9f83b0764c6587329bca7c401fa0bd45a8a5c3846d861e7b863f0a184ea6b621f0315b1d9bd8b1453a0ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385839, "uuid": "ea35dc85-231b-4181-ba3d-1de53f8c157b", "value": "B294EF883084E42AE3D536389FA1DA7693B8BE5E1E21456732F87F8F36FE0375104265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385839, "uuid": "a0f6b6ea-ea63-483e-a2ef-a01814dfda71", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385839, "uuid": "7beb230d-0ecf-4c3c-85e0-8b9a9ae7ebe5", "value": "6144:4svbNeGYZz0cfzdFJy6AMUF6CO5qZgf5TFUQAj3b:vbNOxFJvHUF6P6gBTFUJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623385839, "uuid": "927bc900-a640-4dc8-8beb-0af46ba69987", "value": 430503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623385839, "uuid": "0b4d99dc-046b-4789-94df-162ac4f36db5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623385839, "uuid": "2c1452fa-b60c-42e0-a1c9-43fb9ec5d5ee", "value": "New Order PO2193570O1.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51170f7-ca9a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623405191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405191, "uuid": "8cb9eccd-879b-44d3-b51b-d794019a63ea", "comment": "Malware payload (AgentTesla)", "value": "d8f1ccc5d3c456526a3627a244c9e651", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405191, "uuid": "4fe8e74c-2ea4-4315-a304-ca9c1b91826a", "comment": "Malware payload (AgentTesla)", "value": "ab1019f5857d3ec7e2e5507cf6f19dc8d4d402e3291c81aa190b5ae48bf1ea7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405191, "uuid": "a6a8cddc-b045-4e01-a5a2-8802cfb5049b", "comment": "Malware payload (AgentTesla)", "value": "07a3d1e05d8ac29331503341ae12dacbd48db829", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405191, "uuid": "89299acc-7892-4936-a82c-35d26d9d6638", "comment": "Malware payload (AgentTesla)", "value": "4847aae0cb5d930f19c5b0e869a350aa3dee3f70df643188cf39a4ca0113bb37ec9b680244f10fe9b00ce52bdf26bef0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405191, "uuid": "88c0c9b0-16ed-4b10-99cd-6c4ce8a44b71", "value": "72A4E0103BF89B05D0376BF56AE4A0499BBABA376521D14C0CD572CE4972F08DE91F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405191, "uuid": "f0c3e626-88c6-40f8-8610-a6cba75ec45f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405191, "uuid": "89b8e68b-25d9-4474-a1f2-169f189fd43d", "value": "12288:PvSFJUtNBsGeuI8lw8X5lTL6rZe3I0DLD4b5:PvSXqNyuIwdlAGI0Ds5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405191, "uuid": "223759d3-77a0-4418-a30d-879935e10a3c", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405191, "uuid": "e464db6a-4144-4393-87cd-e6464db3523f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405191, "uuid": "ffe355d5-b830-4955-bb85-8ccac364f70d", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6040be74-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623426899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426899, "uuid": "dd92b66e-7c2a-4d20-8147-2c75b5c25d8a", "comment": "Malware payload", "value": "11f723208b162d4f1f7a3601a11cdcb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426899, "uuid": "ec4dde43-b6db-41aa-aed1-a40a54253de6", "comment": "Malware payload", "value": "aba35998ae24d625353cf345099a388052c7275df706f72e4e709f6f3d04c149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426899, "uuid": "51e8bba7-2377-4fa3-bfbf-8a63fe3c99d2", "comment": "Malware payload", "value": "dcab087021b5a2e610359f5fefda069d42aa5279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426899, "uuid": "ad45b8fd-762c-405e-9855-001cbb763155", "comment": "Malware payload", "value": "85271276b6aad1942ced6e32e7357e0b96c2d53dbb4f0067702bd4c4b792e6cc3c8368d1e1af1a7863a1a7793f4b6bfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426899, "uuid": "0ced7ddf-b095-4ef3-aa92-8b2ead00cd59", "value": "EE03E1BC061B8BDDEA5F78B663660B9A19B10FF5F523DC43121574274D842EC7A22EB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426899, "uuid": "61326f69-358f-4d0a-91c3-8fa7e60e89fb", "value": "768:h9N+KujAM9D9xqGh4IjXaC9y958nUZjJgGlzDpxYshX3NRV:h9NFM9DiGhdjZ9ygSZVrYUNRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426899, "uuid": "8aa6e547-bfbc-42a1-b541-300f4d40d428", "value": 37996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426899, "uuid": "a7eee377-75df-42ae-8e98-c619cecd72bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426899, "uuid": "fa6f340c-b158-4013-9521-228863165499", "value": "11f723208b162d4f1f7a3601a11cdcb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d436ae06-ca90-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1623400894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400894, "uuid": "79328b60-69d6-4d06-b34f-23d9dfe1b10e", "comment": "Malware payload (ParallaxRAT)", "value": "a3d23470de672761f9ad85ce334f80d0", "object_relation": "md5", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade Hunters s. r. o.", "colour": "#5EF54B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400894, "uuid": "037545ab-7526-4fd2-b6e3-844ae19e20c5", "comment": "Malware payload (ParallaxRAT)", "value": "abba8d0990bb52ecc9c282ca8e98e83076fbd5d86afe2efecdbc236a5c610de8", "object_relation": "sha256", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade Hunters s. r. o.", "colour": "#5EF54B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400894, "uuid": "a3646d9d-e964-4811-95bd-f293a2946afb", "comment": "Malware payload (ParallaxRAT)", "value": "289e0615617087c425997f4da60c6ffb08d08e51", "object_relation": "sha1", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade Hunters s. r. o.", "colour": "#5EF54B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623400894, "uuid": "a8c480ad-a5a6-4f14-83c9-e36bbbf88657", "comment": "Malware payload (ParallaxRAT)", "value": "feafc1245fb716e4a0af8b66445fd17defc9fd3f8acf139787e07f47d721ae64c9974978fe53ae00e542b77ce77fc34e", "object_relation": "sha3-384", "Tag": [ { "name": "5.2.68.82", "colour": "#4523B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "parallspmcachire.nl", "colour": "#267323", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade Hunters s. r. o.", "colour": "#5EF54B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400894, "uuid": "4af9ec8a-9da9-4592-a7c6-b98add101809", "value": "5EB58C29367840BED0232331994CF339B1BDAD740A3A45DF7290BE18FA355929B195EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400894, "uuid": "2e6bb265-6aa2-4b2e-b712-f7f6ddc3b128", "value": "8107a2273696d2718d6def74d27d0c73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400894, "uuid": "0b58456c-58b4-4633-bca0-4d4f3d4b2e7a", "value": "49152:eardP/fj3aBlgjeyXgEHQyTejqPqGs3FFZ3y1zzITXx9u193Z1oN08:Xtfj3sl+7XgEwyTejqShVFZ3y1HITXxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623400894, "uuid": "55abc3cd-26c6-49a0-9c8f-f2aed17182b1", "value": 2374640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623400894, "uuid": "08efcf7f-6981-4168-83bf-bb3db34c7bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623400894, "uuid": "647792d3-022d-4ef3-b3ef-1ad35bdcbddd", "value": "Trade Hunters s. r. o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b23725c-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423347, "uuid": "88b69075-ab4b-4a7f-870e-688a281a7022", "comment": "Malware payload", "value": "350262a807a4b664f8986c95c7560c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423347, "uuid": "e822b3e4-0116-4884-b4d0-2ac9e4471ced", "comment": "Malware payload", "value": "ac3761ed30157fd22ea5f70e8283ed0574c112b59f97ce84ea38394f96c23172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423347, "uuid": "b967ece6-bfd6-4f3c-adb2-7ef95d08cfbe", "comment": "Malware payload", "value": "736f89c4d06f9649b3217798a2006fe2158ffc14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423347, "uuid": "a7eead59-7627-4abc-a5da-46cab4c351e3", "comment": "Malware payload", "value": "9edbf5b3373e96ae4a7a5a79623e9cef2c54ec0b579a15b827e8d0a64368a720dc15d2dcbbad61128960462d5f5fe541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423347, "uuid": "d77a5edd-011e-4b99-8421-710c4fc04f57", "value": "B5548D01B6A6C873E46301324868D771543EBC754B2596DB37842F2E9E703C2967AFAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423347, "uuid": "a00240c0-b3ae-4f04-b862-d3da3c61ae79", "value": "93868e8adfd82cbabbba6b46108a5510", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423347, "uuid": "9766ef79-bf3b-4aef-aee7-3aef70c5976c", "value": "6144:ON6SfpfEXWzaDkQ1SC1GTPcoizZV9UPDzAO9uh2Nxm:c6HWzgkQ1SC5z4zI2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423347, "uuid": "949bc00d-107d-4ee9-af3e-0cfae27a57d1", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423347, "uuid": "fad668e2-a652-4f0e-a4bf-8cd3caca39e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423347, "uuid": "81106234-ff04-4d56-8dad-5f383af34bc6", "value": "350262a807a4b664f8986c95c7560c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3af8bf-ca95-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623403003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403003, "uuid": "999b21bd-e6be-40bf-8603-17c36a3d9be9", "comment": "Malware payload (RemcosRAT)", "value": "5e9b04ee8281b04a6c1ba727692c9b9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403003, "uuid": "89472e80-62a9-4ccd-825c-446a3974d0ac", "comment": "Malware payload (RemcosRAT)", "value": "ac525cd0d590a1aa88554cb292245b53c65cdee7103647929a4c235694a4c782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403003, "uuid": "a771673a-38d1-4266-9af1-404016871b57", "comment": "Malware payload (RemcosRAT)", "value": "970269935a5348f6c18a9f4795a0bd645778827e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403003, "uuid": "66903afa-99c0-41c4-a641-8c9fa35327e8", "comment": "Malware payload (RemcosRAT)", "value": "e35adb124b8a27e088a4ec77b5171bd5965700d965bc1c777ee0f2a47ea98b44081d27778805c63d0c0e99c662f1bf57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403003, "uuid": "5d9abe9a-b0b2-451e-b51d-4ebb54c7b58f", "value": "5A75BE1022409B50D13987758C23D6704FB0AD0EEAD5CA4E7DEB7D9F38717B25A2E26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403003, "uuid": "723e16ea-f711-4ccf-aa49-23315abf0b9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403003, "uuid": "131c0bfa-b368-49ee-a1e6-1bbada3c1bb5", "value": "49152:LwBUwsEgwsVe5U/BldV71I3mIoEyXtzGoYCE:UsEgwsZ/BlDhI3poEsGoY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623403003, "uuid": "08c25a3e-b089-4280-a24b-ebdb5587454b", "value": 1595904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623403003, "uuid": "abe9f7e3-1579-4a6e-95ef-b430386d619e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403003, "uuid": "75c52206-b503-462e-b80b-669b7cf8e491", "value": "5e9b04ee8281b04a6c1ba727692c9b9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dab6f0-caca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425466, "uuid": "61c14353-67bb-4e96-9785-906782359975", "comment": "Malware payload", "value": "c7b4c10787557d6a292b9f7c4e4f4d41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425466, "uuid": "0b30f645-6e52-4685-8e28-1c3c43f5f88d", "comment": "Malware payload", "value": "ac89328dd25de69dd5b26731a2d6b29597c0e473eb5c17cee59846f8c1af5382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425466, "uuid": "f171800b-a60c-49bf-a1ed-abb28cd77fae", "comment": "Malware payload", "value": "4964f56b3fdd6b9797d4f97a0ee89b029c583b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425466, "uuid": "3b50dc54-67fa-4168-a1b5-49e49975a849", "comment": "Malware payload", "value": "32d5d303a7faf6179ce5d04ad99b3e143b9e8f381c3225c886d2ce1e3a526512e82b170ecb3a85c2733a8507e7c115aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425466, "uuid": "eee727d6-07cf-4c70-82a8-92fa80aa4f94", "value": "49130102F0C36EF1ADE11A34E83C1922291E2F98E57AB3852056C1CE5A533D7F3B9456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425466, "uuid": "3be5cf17-ac72-4642-b2e9-edc8385eaf6e", "value": "768:EApmvSxsAPGW7OPkmdnEmUCfOEWW+RhaRT9hff+o1q3U7ediNWdkgjB0:XsvdAb7wnEm/OEWWogT9hff+MYgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425466, "uuid": "d2244db0-82a7-4802-937f-bc68b96efb48", "value": 43784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425466, "uuid": "fc458761-8c69-4e96-962d-fe54c1d46038", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425466, "uuid": "e7b67544-c963-46c5-b68c-de6a74779603", "value": "c7b4c10787557d6a292b9f7c4e4f4d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b7b7e3-cad2-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623429074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623429074, "uuid": "f0e277f4-10bf-484e-a53c-31a7401797fe", "comment": "Malware payload (Quakbot)", "value": "4141a399ac724c8cd1e52812406ea2f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623429074, "uuid": "7d25e0e0-db70-4ec0-9929-5e7b5aa696d6", "comment": "Malware payload (Quakbot)", "value": "acdb281362397f530300939773350277d2dd828d2d6f96a98445ebf9c3f716a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623429074, "uuid": "7a99930f-b7c5-4b38-a1b6-0c4f6c50c48a", "comment": "Malware payload (Quakbot)", "value": "ce87d1506f096a36fb25fe7c9f196552fdbaa7ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623429074, "uuid": "f3321c22-b88f-48de-9752-b9abda767919", "comment": "Malware payload (Quakbot)", "value": "9351d769c74124016f27ae7a2212025b500333b2f620c9ee826f1328a0ac1ba6223e0015d08d5d78f1605945253c79b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623429074, "uuid": "57509395-bac0-4248-a938-8a30c65a3ecc", "value": "DDA428377BDEC412FB671FBEB1938A4405F2ED936522517E01E03A15F97AAB028A5730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623429074, "uuid": "c88779a1-4807-4d15-a966-ed06adb8a94c", "value": "885aea10fb548f7fc2826a504f768f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623429074, "uuid": "4a629995-8cfb-45c1-b80f-e265eff93a00", "value": "6144:l5NoCFH7OEn1J8JRO+njE2X2J/7vKsakTixuu8njF/EeBP:XKCFHyu1+lFGwuu8njF/Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623429074, "uuid": "4ccedc97-b8f4-439a-8d2d-68d0e35a7ffb", "value": 485024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623429074, "uuid": "f18bc94f-a699-4521-b646-bbfb67a0dba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623429074, "uuid": "1068696d-ee40-492a-9339-b67158341347", "value": "pt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a815165-cac4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623422917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422917, "uuid": "37284d39-8307-486a-adf8-8fa852d07022", "comment": "Malware payload", "value": "a8e9b1a99e54b13c5911773ad5d8d303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422917, "uuid": "6de99ec7-6206-44f6-9258-2ab31832bdfc", "comment": "Malware payload", "value": "ad7d85c64078132c44de7e086537044fcab08ac86844798ceba10a758c3af4af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422917, "uuid": "f6d1d295-41ef-4281-9287-e87c6ef8a778", "comment": "Malware payload", "value": "acd40adda0b33d8ba4d26645c3e832d60fee81f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422917, "uuid": "c1d983e9-a8ac-4783-b204-f02722b6f3a5", "comment": "Malware payload", "value": "b4e32d259d9e2c89308ccc69f5c31c9b8b3681b0c69e584791fe69435e3cc76f4b0bbfd73ed6a966705028567d08f58a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422917, "uuid": "7cd2d0a3-4a3d-4cd2-96f9-a4de9a27fc15", "value": "36B4CF4A6316C18BDA1845F54D372DB1AB6A4F2C241CE78C66F1F31A6B77A807C211FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422917, "uuid": "103d4327-745e-4fdc-b2f8-afa6b8f8071a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422917, "uuid": "c5559798-b9b7-44f0-862b-db0c700ee958", "value": "12288:S51QoQQQZNCAnWQUjwO8W82C0QV54OKM28zi:ZCAWfNJ8HNNKMRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422917, "uuid": "70e88027-46d7-46c1-973d-3787bde5a443", "value": 505616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422917, "uuid": "dca2cd9d-f765-4ace-94d2-6f9a91b3f7b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422917, "uuid": "5b45c1d8-d587-4230-a244-003113989f15", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57be1d0-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423606, "uuid": "de0aa0b8-0d14-406f-b5dc-4df6b95b9d74", "comment": "Malware payload", "value": "8fe82ba2a82cd7b8c741ea0e53243542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423606, "uuid": "ee3a59eb-7604-495f-b4d6-bee659292c94", "comment": "Malware payload", "value": "aecbac7cacd2ea021a169d3b31e402d87730109a894d0b01e2b3faf88673665d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423606, "uuid": "19bcd071-9c63-42d8-8b56-0bd63bb68371", "comment": "Malware payload", "value": "3fa79db852752a83f5a9c93716e3f3df495e253c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423606, "uuid": "36d7f03c-1120-4f8d-90e2-4ee3200c2e8b", "comment": "Malware payload", "value": "76e5f9cd7b127c114218aa1fa2965298d788eba8a5447d1e2eae742f318f238165236791a8f74c9d51b7139278b48342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423606, "uuid": "bdfaab33-d985-47b7-835f-5a0c25531770", "value": "25B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423606, "uuid": "b1f0ef5c-202b-4cad-a2d2-c893564b0aba", "value": "3072:Cr5W3CDJrG5h5dVEgwxhKdwwjF9GhsR1Ae:KQStG5h5dVLkKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423606, "uuid": "eed22c43-0ed5-4f09-8ef0-446f73245347", "value": 116519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423606, "uuid": "c725cd47-3486-4c46-b0d4-0d4223458219", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423606, "uuid": "fed1437b-3205-4255-83b6-ee581f77f422", "value": "8fe82ba2a82cd7b8c741ea0e53243542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4034cf4-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394425, "uuid": "fd053af3-bb18-4d8d-8366-cc9187e922b0", "comment": "Malware payload (Gafgyt)", "value": "ab7cc25df46d68282cf3f01763b7c5a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394425, "uuid": "80b0f136-2ba5-45ae-9d4a-a9bc8a44cdd2", "comment": "Malware payload (Gafgyt)", "value": "af44f68701e342c2c2d2dc8e2fcb23f0f8f7be178708c6232198a0058e03a21f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394425, "uuid": "1108fe9c-ef6f-4f7f-bf11-ccfb9a3c7c3a", "comment": "Malware payload (Gafgyt)", "value": "a77976c224972d4bb86fb0b4b2b7aaf44d14278d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394425, "uuid": "d9650d74-acc1-43a1-b2a8-58040d828450", "comment": "Malware payload (Gafgyt)", "value": "de2234a6c21f56fd6d1cfa29635657b5633fcc572f074e40f9c2f6b5bcce7eb97aaac6ff3de4f428b1e2595722662ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394425, "uuid": "e97a6519-1d8d-4868-aca2-199c8d36747c", "value": "A1B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394425, "uuid": "57caf9a9-67df-4a4e-8c27-f53cf61709ae", "value": "1536:ZLeTGkthhSMOCMQS+ZjN4pjuIxreg2O7t2eDo/LUmkiSFxfC7xbXe:Z5HC3S+dUremtTDCLUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394425, "uuid": "d52dac6b-359a-44c5-9575-27c53bd0e833", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394425, "uuid": "8fd6ae3d-084b-4d5b-bc65-0069ba431dce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394425, "uuid": "31a558ff-fb96-402e-b8e1-bccad17f7bbb", "value": "ab7cc25df46d68282cf3f01763b7c5a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7323b5-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423536, "uuid": "dcfb7bcb-9108-42c7-b064-3d57eef23415", "comment": "Malware payload (Mirai)", "value": "88850d0ad923824c9b906204bdbe1bec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423536, "uuid": "3fb65d1b-2d39-4bcc-a4f6-df7d48ef79d5", "comment": "Malware payload (Mirai)", "value": "b06972ca155935d285457de3d3ee896f8bebbeac57cd6da4bd8989965729d5fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423536, "uuid": "63710a04-0361-4db8-b636-5c03272455a9", "comment": "Malware payload (Mirai)", "value": "581ebc1143f0f109729a38c259ad04782a8559e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423536, "uuid": "9304ef95-50ce-4a2f-b26f-deaf9b64dc4f", "comment": "Malware payload (Mirai)", "value": "519c36b31754d08c67aea4d7aba6cc1c2a2a771c54ebd22d967aa9f88d188c25c44c8746f1efd62a5ef62da6e75c5872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423536, "uuid": "9f177a49-343f-4243-94b1-b3c147498f4a", "value": "73B35DF5A4019D7CF897DE7A44230E09B421A2114FE31F2BA667FC53BDB21B99902E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423536, "uuid": "c642cd9a-1435-4c91-87f1-e3b025914c4a", "value": "1536:eAuOG07SKa1Q/FFJplN5+M86vEWW6mEqA8xrmV5TO5FjPm5q2QbD7POaW5vFaMzU:eAuA7lN5+OsQN/J3t9k+hv8WqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423536, "uuid": "5a7139cc-281e-4449-a9ea-bc1a173144f7", "value": 110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423536, "uuid": "d8a677ce-2d8a-403e-945e-54639a58e013", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423536, "uuid": "f98b3eac-e258-4d56-a3a2-1ee73293d049", "value": "88850d0ad923824c9b906204bdbe1bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07862c8a-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397115, "uuid": "f5aa867a-c948-4abe-9f69-cb851ca10977", "comment": "Malware payload (Gafgyt)", "value": "fa4ae00b6caab8e65177aee6fa671c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397115, "uuid": "ed11cde6-fa72-4105-a478-827547aba6bc", "comment": "Malware payload (Gafgyt)", "value": "b1bdc94d490e6df68a5472beb7b49696b8410588f31b705ecc0169a717f10fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397115, "uuid": "c28491d4-de12-4a16-8f82-03d4e8b05c91", "comment": "Malware payload (Gafgyt)", "value": "87362f6773dd36fb4fb09d682867abb7e81fdba9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397115, "uuid": "30ffaba2-ab46-4700-ba8b-9bb4125e5d02", "comment": "Malware payload (Gafgyt)", "value": "7b9d2ec8688e30959672cb1793368380d2c86e73aefe474992b68b980d7715d45d70181a67452302f6ffbb6df5917145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397115, "uuid": "2af7736a-b34e-411f-96fa-c27db25f2bbe", "value": "B3934B82A641DAB3D1931AF512DB8B150232FA3F0A2B9EA6F35C3DF45F504C47226BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397115, "uuid": "11d8bb42-9b91-42e2-ae3f-3a97c0d9987d", "value": "1536:8n6PxYNeX+QcCAtUq1M8nIO7x5C5Pb46XezQUw3G5hTP3jbYS97she0QzUzJYQ2t:LPaYUUq1MYISx5Kb1Xesg5hTfAS97Uez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397115, "uuid": "570ee310-09a4-4d0e-9f31-34e055426c3f", "value": 91567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397115, "uuid": "726eb7e1-2028-4a0d-8536-a6eacda7d21b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397115, "uuid": "e320ede0-7e56-4cf8-a8b0-403822b2ee95", "value": "fa4ae00b6caab8e65177aee6fa671c66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2ef451-cac1-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623421980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421980, "uuid": "461ece32-5832-4057-bf51-57a615b0619a", "comment": "Malware payload (NanoCore)", "value": "568727e4104e3f3e56a1368af64e9248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421980, "uuid": "494049e6-0810-482d-afc2-e61556812f7a", "comment": "Malware payload (NanoCore)", "value": "b1cd32f68858de3be8e43093dcc24b32b2ce00890857362a652f3e74cebb791c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421980, "uuid": "fb9610a9-dcb5-4973-b727-e46ab4f1fb18", "comment": "Malware payload (NanoCore)", "value": "d693795cbc34b9e49b1ace9581771e24e2d09f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421980, "uuid": "e5a02b5f-0b58-4e35-8f3d-1842150c315a", "comment": "Malware payload (NanoCore)", "value": "982592b64bc65c4cd6f2b874ce4d22f94a2a8f37bc9d01416bc0e3eedc15388a0c1f658f48aa70f8484a8601c9071eb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421980, "uuid": "1711d729-574b-4146-a2b1-8628c08f377d", "value": "B7657B24F9EA5019B173EF664AF67CBA8A2FB6733B0A541D109C23660713D41DDE243E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421980, "uuid": "e8ea456e-2fe3-414f-b80a-d0b3b8c806c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421980, "uuid": "a30cb2e7-7671-4534-8a9a-a2e4f8b8f8c1", "value": "12288:GY7M3pV+bJAx980BoMM48zYWSqd98i/76FjtNAJwDLHaRPPMC2FQFjBqRxmygNcz:TgtehTZZEMSXA6aUcfsp8QgmD40X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623421980, "uuid": "d7c771c7-8d42-4ccd-92ed-b64f8c37597f", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623421980, "uuid": "2b4fb71a-a3f9-4626-b37d-bec4665d23b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421980, "uuid": "010b6511-357c-4e61-b8c5-b61de30b6001", "value": "PAYMENT-PO#987654567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f93938-cac1-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623421913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421913, "uuid": "55e45ab6-a7a4-44d5-b3a5-3c324c9c3aba", "comment": "Malware payload (NanoCore)", "value": "438425f009b373154e4e3629c3539581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421913, "uuid": "06793920-c13e-48e6-b522-03511635026b", "comment": "Malware payload (NanoCore)", "value": "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421913, "uuid": "44d5b126-6797-4247-9c87-00c582e9fd06", "comment": "Malware payload (NanoCore)", "value": "5f686134a72fe1260d504dedc88d8500c4f0c1f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623421913, "uuid": "393ac1bc-da55-4646-84ea-f2221f7c61cb", "comment": "Malware payload (NanoCore)", "value": "3da42df3c402bf0b21aa352677264c0cc325e8877fa204ea639a1daf9190abe7bf79b1724ad2eab422f3ff3c34bc6ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421913, "uuid": "096daf86-87e5-402b-b05c-13366eb5f9f3", "value": "53656B24F9EA5019B173EF694BF67CBA892FB273370A641D109C23660713E41DDE253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421913, "uuid": "385959e0-50c3-4b73-96b0-c9afd1012a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421913, "uuid": "c24a518e-afda-48ea-8ae7-fa5028c06454", "value": "12288:P6r9q+1i2mc3KEPdu4icYU/d+9x9/QV2HM5Jd+Zk3tsvON4Z1zOpz/YsQQyOTyMb:kKUw7Y1GOkqy0HPmH9pPQ4w5Q440X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623421913, "uuid": "d7dce0df-a005-405e-b586-a92594b14ff7", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623421913, "uuid": "3a983abe-e458-46c1-9df5-57a127e64d58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623421913, "uuid": "0fe1c42f-8069-4855-bd3c-c8a5996031cc", "value": "PAYMENT-PO#45678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c8f03f-caf8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623445249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445249, "uuid": "c25f572a-d411-45b0-a679-866a5a6ebd64", "comment": "Malware payload", "value": "4b840923bc07d993d8e203077436a88f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445249, "uuid": "a39392ae-bb16-4bb9-ba9f-36c561949cd2", "comment": "Malware payload", "value": "b3851e5c28e260637f2bb0d27bd956234053f958c19d044c30c87ff4b731caac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445249, "uuid": "3c149dc6-d3eb-45b9-801b-28d240379d01", "comment": "Malware payload", "value": "6b828bad52bf0a3cffb629c0108b5d20b56df6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623445249, "uuid": "bb49bb37-fa30-417e-9aaa-d26c69fbdf92", "comment": "Malware payload", "value": "b9651d301d75b50dbdb02ded5bbf29d809f9a87afcd007980c5928c93634f370a1edeec2fd7faa2f9cf389f7d4a186b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445249, "uuid": "aa25f058-231c-4fb4-91f1-294807fb0ffd", "value": "71B37D1D67E8CE65D9BD5BBBF83611101730F1422823DB5E8A84D4ED2E63BC18B167A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445249, "uuid": "a281c4e1-5bc5-4d0d-be63-60b62f4c89d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445249, "uuid": "f0d7abb7-8eaf-497e-ba60-5dd737bbecec", "value": "3072:ugZApdYrD28fbJB2yLtyTgbjjxK3QdjrxivW+DXnH4vymbd1v:u/pe1J0gbXtrxivW+D34vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623445249, "uuid": "3ee81301-841c-4cca-b830-1ca5cce8f12c", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623445249, "uuid": "b1b21445-7035-4c85-bce6-9555ae949ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623445249, "uuid": "90d1200d-396e-4011-b938-8808ed1024fc", "value": "lol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9d15f4-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427274, "uuid": "9002b828-baf4-4998-baff-8d55f16529b8", "comment": "Malware payload (Mirai)", "value": "924f77a274d47bf1d8b4d9c5814f9a30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427274, "uuid": "e84cd107-8736-49aa-a8d3-7450bd2f340b", "comment": "Malware payload (Mirai)", "value": "b3fb48c5a14c0b3778743a7585dd0a335db83727beb53e900130e0236c58f6ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427274, "uuid": "78e5175c-faf9-4a0b-84d0-5ee673cc067a", "comment": "Malware payload (Mirai)", "value": "873623aab21e628c92546a7086f36780a628540c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427274, "uuid": "c8ab87f3-71fa-4ab1-a94c-575f93a49fd6", "comment": "Malware payload (Mirai)", "value": "c0208bdbf1fa7d125da64a1281c57c2aa81ec0a41b455fea9125dbe08e79cb6e4a32c466d030172757cb4832b6283010", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427274, "uuid": "bd62044b-07ae-4808-9584-b65f50ef08d7", "value": "A0037BB3C46DAED4C1188638F9254BB81B53F115D75B2EFA5A8985A2C043EBCF6493F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427274, "uuid": "bb59ff08-aab8-4697-90a9-6ac4c8b73e87", "value": "768:/zafCPwtyVmlTZF2q2e1sv8qSh/qfC0noB1dCm:/zaKPwt4dSh/qfHoPdCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427274, "uuid": "abb4c74a-ef7e-49f6-be08-203689c310d6", "value": 37900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427274, "uuid": "5387dee8-7fe1-4287-91e0-4c9483b037b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427274, "uuid": "684eb502-c5b7-45dc-8579-bcef1ca02cfd", "value": "924f77a274d47bf1d8b4d9c5814f9a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81987ca-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623389788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389788, "uuid": "0b8a3120-52a3-436b-b8b3-022abf6f7973", "comment": "Malware payload (Formbook)", "value": "27211c2dc1809cc2ab4469ff246f9cb4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389788, "uuid": "99c1abfe-7821-41bc-bde4-e143ee59a84d", "comment": "Malware payload (Formbook)", "value": "b4b855d04e706c33129c2db1c80d8b05497fa56a2288ef2fb4e631fe42aa781f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389788, "uuid": "6fb978f7-ba85-403b-9efb-ed79dd2f8c22", "comment": "Malware payload (Formbook)", "value": "735918b9ed26c5eafa266305fcf677bd2ee5f0a2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389788, "uuid": "c4c5c011-909a-47ff-b1bd-92b7944c481e", "comment": "Malware payload (Formbook)", "value": "9b7c278095ca62faa6c151f9d98202db5b267d20275930fd0909989b128f3f4074f0cde12a896e1a278fcb6094659ab4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389788, "uuid": "232f8648-2a0f-45a9-b2e3-29c5502fecd8", "value": "1A553385DCC86B46CB9FE9310B17867D8027DC01F646D657B08EF6133234ABABA46F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389788, "uuid": "382a1800-42da-495c-83f8-d380dc9d83d3", "value": "24576:LS5w5NLTHyglJ6nYEuTBj2cAOrnbmKpcCd+p/5I541u4pHq0n:LS5wjTHplJfEuTJ+qbmKBd+dEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389788, "uuid": "86d89a57-009b-41c0-9e24-d7e59da47e92", "value": 1331416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389788, "uuid": "938d91de-d37b-498a-8d6c-785b9bb02fa9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389788, "uuid": "8a3142da-f037-45cc-9202-002fc4dddd80", "value": "Agency Appointment VSL Tbn-Port-Appointment Letter- 2100133.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534091b0-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427307, "uuid": "7faf117e-d75d-4b14-aae6-703ee7e9314a", "comment": "Malware payload", "value": "521a35e7c3424ab7692f8e682d7c477f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427307, "uuid": "40facb9b-a109-41be-a8b4-f6c649c552ad", "comment": "Malware payload", "value": "b4df35ccaf1fa1d3626734cad23658e8d14cd4522c0d3047ae1315a3b1955afd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427307, "uuid": "f7e56e9e-c276-4611-ae75-9068e44fd1ec", "comment": "Malware payload", "value": "c7d57952d0d5fde26d3f947e218b97720bddbe90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427307, "uuid": "3fea5307-b09b-46eb-884e-4069f7972c7e", "comment": "Malware payload", "value": "5dc4293751e7f116ce1fc6a6e3c5378aa6d3cb08673ab2b0f8ed1b52c5ff386860ea95e594944286ae4f8e87cc281154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427307, "uuid": "7b57cb08-0469-411d-929b-ec29c9cd1bdc", "value": "5EC32A97F800DF66F40AEA3605D70B25B630FB710E531A72A35739A69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427307, "uuid": "bc7b7738-4854-4cc1-a79b-aa88fef19010", "value": "3072:Cc9QXFndlLyqiMwtAR+dICycK3J3QPs28rmvI0PDGnSQNER:Cc9cXpyqiMwxycKJ3OQrmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427307, "uuid": "35384e59-f881-43ab-abe8-13bfa15432ea", "value": 118302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427307, "uuid": "88a0c8aa-4202-4090-9583-dc794bcb2ddb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427307, "uuid": "b1a7fa10-19a1-4750-8b6a-29fd21f52f30", "value": "521a35e7c3424ab7692f8e682d7c477f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51a7fd2-caf4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623443846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443846, "uuid": "a53d5438-a84d-474f-817a-ea4521e11ad5", "comment": "Malware payload", "value": "5a8cc73937466136dfeb990c3bd1ff14", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443846, "uuid": "002d1ed3-f06f-42fa-b99b-0ebcb92fe10f", "comment": "Malware payload", "value": "b6d9bbafa37e6386d20e0e3f58ab0fe5740fe88ca0cfdafa91d4488268650445", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443846, "uuid": "89e4644b-cb27-481d-b276-c0b7da976858", "comment": "Malware payload", "value": "0b69ee7c95a021af2bce072b0255907072de4ced", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623443846, "uuid": "7c6e03ca-96bd-4a3f-be8c-6c197add644f", "comment": "Malware payload", "value": "fee4707a5a6706f68cea59705a3be63ab046c7b964b8ab6f2f80b5d3da6fc78c2806e8730ef4085dab2050b75e98662c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443846, "uuid": "e4b51316-6da1-4d16-a5ec-8c5f3a5b776e", "value": "E5C20EE7B6D6AC45CE59037948A787A06717FC215BA7838B3389F7161FB2AC08D03617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443846, "uuid": "ee004fea-f24e-4780-94fc-32b1664d0f6e", "value": "768:nPpRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJS/B:Prk3hbdlylKsgqopeJBWhZFGkE+cL2Nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623443846, "uuid": "f765395b-e698-4012-b1e3-818466cc22c2", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623443846, "uuid": "1da07378-174c-4dcc-885f-9f8bc61e77ef", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623443846, "uuid": "8ae3a5b2-b176-4f23-8d8e-a22dc9e45e4e", "value": "SecuriteInfo.com.Trojan.Malware.121218.susgen.30313.6312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f4ea0c-cac4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623422876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422876, "uuid": "c066b40f-be59-4e25-bdb0-d129adec5d11", "comment": "Malware payload", "value": "4851e7c2b7701a6ebc793392fe8ad21e", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422876, "uuid": "2ec95946-6fd0-434c-88c8-f78a1cc73381", "comment": "Malware payload", "value": "b731a3e00ffad3116a3fa57992b948a94734278487405c877d9d902b1f3155dd", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422876, "uuid": "92655768-424f-4b2f-8a7e-76921ac414fc", "comment": "Malware payload", "value": "26bcc1d74b80eff381e7a815d39c4cef572fa373", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422876, "uuid": "96a229c5-156d-427f-9aa0-f4fc3fc17a75", "comment": "Malware payload", "value": "4c2b5e18aed84931240183da8659684fb136b402ce119ce5daf288dd277707dd3d474c2bba22290931a77b19baad2e7d", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422876, "uuid": "4cf89c3e-d702-460d-9f19-b1c4feacb66d", "value": "EF74233F950ECB8DB95B149C09B54622F18ED2AE015F4B425FABBD9DE3C40EA3C27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422876, "uuid": "b9d8a3e9-cc76-4f07-a3d5-f9c1e4d6c44b", "value": "6144:mkhFmsKxg7vXs+cZQFnSzjWOBPibD34FAb2ap0elra6BxbuOIpBA4OKa628zo:mkLKqvXJWQUjWOi4S2C06X74OK528zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422876, "uuid": "df527118-7efe-4e02-806e-f19ebb4e8f45", "value": 362188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422876, "uuid": "a0d1a6e1-dc1d-445b-9c4f-68f3d685e3c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422876, "uuid": "c4c2801b-d22c-447a-9c92-3b381c220041", "value": "Payment Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674a402a-caa7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623410590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410590, "uuid": "5f524a9c-4722-4ce4-99c5-2a2b94375b94", "comment": "Malware payload (AgentTesla)", "value": "37178995799dac98cf429b946925e324", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410590, "uuid": "16341fa3-f03f-4435-aae7-d4472b0495c9", "comment": "Malware payload (AgentTesla)", "value": "b86fbdeb14cd6cd5b5e144d029844e1c7d6e51c82b1bb7c3f0f07f8ff07258c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410590, "uuid": "c7536dc2-d101-48a4-ab62-dbec51f23b9c", "comment": "Malware payload (AgentTesla)", "value": "7653bcfc4a5dc75afa7efa2aa2531acd06b25679", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410590, "uuid": "4b599aae-bbd1-462b-a0d1-74331855eb69", "comment": "Malware payload (AgentTesla)", "value": "f54b0eecbd0fae40fd212257c679675dab6a233948859e7425171f262b6f3261f4cb5df33d8cf3735fad84e0d52b0337", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410590, "uuid": "76177b2a-76fa-443e-816f-5de123a4b555", "value": "F9D48CAC365079EFC82BCD76CAA81C64EA213477570BD207A00715EC9A2DA9BDF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410590, "uuid": "0958bf34-9ed2-4766-b24c-b0e58b859de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410590, "uuid": "679857fe-4ec6-4274-8e3f-86eb7f126804", "value": "12288:j/q6Tjxgijix2x6bg1ZXCtJ0TvbK3w9hhm45vnS8m2WhG4g7JLM+YtesminEY:eexvjYn81ZXoJMvby0hQ4JnjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410590, "uuid": "67f33fb1-501c-4aed-a2c9-33702271f602", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410590, "uuid": "73766dc8-e5b7-47b5-bae9-c87d04f75568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410590, "uuid": "fc419416-a1d2-439c-b81a-5e5866b48644", "value": "Faktura_21611447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1fc0cc-ca8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623399166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399166, "uuid": "4ecea70e-3c7f-4533-863e-fce02024e01e", "comment": "Malware payload (Gozi)", "value": "d5c0bac78e53b46b2fff5e470e98210c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399166, "uuid": "0b1108ab-50cc-4a4f-9584-fc766a279cb4", "comment": "Malware payload (Gozi)", "value": "b92289a53611d6f8c078e931c3c5c6ce577e05358bdf54389830e962090991b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399166, "uuid": "fbb5a3d3-93a9-4aef-b857-b8f178152901", "comment": "Malware payload (Gozi)", "value": "a00da4d379748f9e6f2de1006f10156aa8c36f39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399166, "uuid": "cef182b5-5566-4fc5-9a16-fbb1993f45fb", "comment": "Malware payload (Gozi)", "value": "945c31ebdc880e3e5e9b76b3926c76f6dc2723138fdec9e3be667dd974d67bda87511362582bff922f3de5cf4ce57409", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399166, "uuid": "fe997185-d83a-4322-a41d-33aab4909abb", "value": "9715C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399166, "uuid": "9d139043-9934-48fe-9829-666d5b2b413f", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399166, "uuid": "0ffbf127-5864-4a6a-b109-ec21b57638a0", "value": "24576:HQfpzjXPgf98CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgRJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623399166, "uuid": "5cb679c1-a4e2-4e7d-b637-b9a7923108ec", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623399166, "uuid": "5b99b7a7-cd46-4c0f-8ba9-a3c113a7f023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399166, "uuid": "46e691c9-cb1a-49b4-9f8c-1a09d9aeec51", "value": "d5c0bac78e53b46b2fff5e470e98210c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31581ef9-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427250, "uuid": "049da88c-8675-4841-900e-f813223c71fa", "comment": "Malware payload", "value": "98fefb7fce049aab6b5136b000363f10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427250, "uuid": "4defb167-ab77-488d-bb65-c49aa75b1fe9", "comment": "Malware payload", "value": "b9558401dc9fc3729854af7d9bb4d56f9c9c3c28baef29ff7c087f1c0b923076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427250, "uuid": "377c364d-cfe9-48cb-8b86-a6735d551da7", "comment": "Malware payload", "value": "f1e08c873bac868e5553261dae2768ea10cd6bf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427250, "uuid": "69571a2f-1ea6-45a5-81aa-0319d36c37a4", "comment": "Malware payload", "value": "9371a071cd8ae782fb0ec7741e5b9488c73c811297b049e3c712500db46f4bf29bb8fa5b6a851c849cd80b42d3a2b4e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427250, "uuid": "55ca61dd-b355-438f-b51f-5b2b4e1268ee", "value": "1113F170C2981A75CB7C5C35E24EDB45077239B0CCD6B0AD526193EDEACACE162F550B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427250, "uuid": "14996c28-7562-423c-8fe8-f54621d84a5e", "value": "768:OY8yIelGt84kOA61M1NFwFP/4wJwiGOnQTHHiCKm3UL8WIaZgxIfw:HIxkOAb1NYaiZnMnHIPI4dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427250, "uuid": "74892931-0035-4b25-a558-7aea2f5a240c", "value": 44364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427250, "uuid": "b7e0c824-92b8-4ebd-990f-9ae69226d91e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427250, "uuid": "20d1d449-2ca2-4aea-8539-3b3ad3762741", "value": "98fefb7fce049aab6b5136b000363f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1740e5-caa6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623410145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410145, "uuid": "d9cdb54d-4120-4316-92d5-13deaf34d3d4", "comment": "Malware payload (RedLineStealer)", "value": "aab7b335612bb27d5aa1ab2b00e1a452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410145, "uuid": "4b481c07-01d9-4f75-8d92-5b39ffebf7e2", "comment": "Malware payload (RedLineStealer)", "value": "b9e2a41e63b1886285d2617ad4f820db9ff5d1133b47e90b52368d3b87333684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410145, "uuid": "86038c34-252d-45de-91ce-823566c01f07", "comment": "Malware payload (RedLineStealer)", "value": "51e2d101c5b0d68cc206bfe9de9a4b7666cbd712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410145, "uuid": "9ea151d9-ce4a-4fd8-b16f-6f73acf97a8f", "comment": "Malware payload (RedLineStealer)", "value": "6521fdcbf347235dcaaa8486770aa8e3f5a6829dac0495cd1d3b0e5712704d3747c718b0446cb1cef7467c6ecb228bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410145, "uuid": "da1fe0be-ffbe-4adb-931c-b404bf6953ac", "value": "90849E10B790D034F1F336B45A7792BDA62D7DE1EB2450CB62D4AAEA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410145, "uuid": "03edebb7-27e9-44d5-9174-c35c8e03ccba", "value": "c79d21a18d2d983f887085ba949c12f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410145, "uuid": "d671b592-1144-40f2-9c5d-a26380849d24", "value": "6144:Asf5x6seMvL9UvBrk4OI12ssnRh7VL1Se9qcsUEnjitVneyRH:Asf5xRDj9srk4d12ssnRn7aTjKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410145, "uuid": "a01c3770-43c9-46af-921e-0f34091632f5", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410145, "uuid": "d6609d0d-3f87-4c1a-b29d-9dafe6f25e01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410145, "uuid": "26b2a573-6009-46ce-95a8-97e0056600a9", "value": "aab7b335612bb27d5aa1ab2b00e1a452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8851ded8-cab1-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1623414941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623414941, "uuid": "4d0e4bd2-5612-4771-ae81-0ab353c3fc59", "comment": "Malware payload (Adware.FileTour)", "value": "2c663b3f330f2adfda4339c8990f53c2", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623414941, "uuid": "c306412a-19ea-4519-aa1a-9f8f31cc8668", "comment": "Malware payload (Adware.FileTour)", "value": "b9f5bca9a22f08aad48674bc42e4eaf72ab8aa3d652ba7a10dc4686b5b183a33", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623414941, "uuid": "7186ae74-c324-4476-8b09-177da555c5eb", "comment": "Malware payload (Adware.FileTour)", "value": "6ad1c96ac41546be9c8dc7e9135ce461bc4af668", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623414941, "uuid": "0b55abe7-9925-41ba-a20d-ee7986d14064", "comment": "Malware payload (Adware.FileTour)", "value": "7f3a9cd2717c76a08eea5f190f61485722409219dabc77e9919330445b4c36059b089a106faeffa09bb379d0727a938e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623414941, "uuid": "1a8d81bf-cac7-44bb-aba6-eff037495993", "value": "DC841203D6E11938E073CEB05CA5D5614A3F7D256DBC200476DDAD9E9F7FA82922A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623414941, "uuid": "d1e7ac68-30b8-4a20-9bd5-294b624f3b4e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623414941, "uuid": "a4436574-8ad0-4af3-8401-add5964e365c", "value": "6144:x/QiQXCuoL8+Ee0CYDTAsdRfEMOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglMb:pQi3uoL8+iDNdRXlL//plmW9bTXeVhD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623414941, "uuid": "48f7b314-8dd5-43d9-9e64-6690a5adbd2a", "value": 390953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623414941, "uuid": "5616ffc0-ccf6-492a-849b-559ef5e9669f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623414941, "uuid": "727e10b1-04c1-4085-b8f4-13ad2d0f2c68", "value": "b9f5bca9a22f08aad48674bc42e4eaf72ab8aa3d652ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ee9068-ca9c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623405808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405808, "uuid": "47d5546c-5059-44b3-9aab-d9bdc2d332a2", "comment": "Malware payload (AgentTesla)", "value": "b7426971e2b7b5d5927c1c304e9d8261", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405808, "uuid": "37e62c6e-9006-4960-a4cb-0f3f56dee427", "comment": "Malware payload (AgentTesla)", "value": "bcaab30f076fa7b2f0c0cebb2ca58b092e15508d8a3501057e1bc7a8be4d7344", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405808, "uuid": "d4498506-dea9-4801-83d1-5ddd6c2b5f42", "comment": "Malware payload (AgentTesla)", "value": "84595c4d4ec1976a9f6b37ba6faaaac4815bfe1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405808, "uuid": "6206b15d-37a4-4ae0-84d8-ee1994504cc5", "comment": "Malware payload (AgentTesla)", "value": "36ba6862fdb396bab7f8f78e55d90013eb62e8e2cdc9788b45d4b41d2435f4bd97fa446d96e95ac35a8ef07a35388adb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405808, "uuid": "0708893b-c705-4b43-a40a-e6825befa8fb", "value": "53E49F413298DD86E0236FF218AED46057B97D5F9120C60D3B83BB5B95E3B022897B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405808, "uuid": "59185f99-75c1-494d-9081-af9277fb0e70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405808, "uuid": "f40628b2-0433-433b-bea2-075387492fa9", "value": "12288:mL5mNAQAH32+UYP/aBjJVwPM8oabeVSiyyjK:mL508X2blBlVwU8oaaVd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405808, "uuid": "a2c30999-6e65-4c14-af94-38022700c07e", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405808, "uuid": "e45e4e19-7d37-4fcb-b065-c03816d7ad71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405808, "uuid": "bd384e6f-f498-47f4-b71a-5da871ba7c10", "value": "Quotation HT210525 IV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423d3f88-cad0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623428137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428137, "uuid": "7fd17c51-e288-443e-9dd2-53062cfaeef1", "comment": "Malware payload (Mirai)", "value": "1fec175b2da1f07373af45876111565f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428137, "uuid": "5e30306d-0004-4e9f-9137-62e108eec47f", "comment": "Malware payload (Mirai)", "value": "bd7736e73ad6110ea6b8efc24904b6dffecf5db24d247908cc4b1118555d4da1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428137, "uuid": "e4236e33-0e30-4582-a12f-73fb8eb87570", "comment": "Malware payload (Mirai)", "value": "0f4968d81eb439c6bba615bace505df6c7a8f0bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428137, "uuid": "e7861538-9fb0-4fd4-a2f5-dec6d07ded83", "comment": "Malware payload (Mirai)", "value": "cf8d1f0de092d05f6e03119fa073673edf8676fa73bc0c46942df3b1254cb489e9558d9e6cea4647de0a23774ff3de86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428137, "uuid": "ea60686b-49b7-4ce6-acf3-d2c2a79f0db4", "value": "65330210B189E9B14DF25032EBF748432DA9A46CA17D3863990E043E85C37E75B9F9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428137, "uuid": "db77c2dd-0fe9-4fa8-b805-23fa73041f9c", "value": "1536://9W46rcVEOpue4IEfKcVaQLcowJjmf+LQ:/UCZphfkl80+LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623428137, "uuid": "22166e3c-ebaf-4ddd-9d20-bf0611324bee", "value": 50568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623428137, "uuid": "ec514fd7-b615-4dee-ae5a-1213d102687c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428137, "uuid": "23f0c444-77de-4128-a43b-9a292fdfc7d1", "value": "1fec175b2da1f07373af45876111565f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7fd862-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394412, "uuid": "faa394aa-7ebe-4700-ae37-c642ed74fddb", "comment": "Malware payload (Gafgyt)", "value": "ff33ff5972a043d30317d508010200fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394412, "uuid": "28d35166-4049-4e9b-a577-3baec5b3fdc7", "comment": "Malware payload (Gafgyt)", "value": "bd87026ee6c802106ad172449edaece7c30d45a8589160f67ef65adc485d163a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394412, "uuid": "cc0cf923-2ee5-4594-bb4e-af979e020110", "comment": "Malware payload (Gafgyt)", "value": "96c046c9636cec1fe133fb5a3faea6db7de08f61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394412, "uuid": "38aedcd2-bf2b-4449-9985-12a0efa06524", "comment": "Malware payload (Gafgyt)", "value": "7965dc93d305cf88811f3fe257eec4caaa5469db12e2503271de21bd5d76ea7883cb618b4909328005dee32363df9b77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394412, "uuid": "5cc51908-5137-49ef-bb2e-83dba7e4ad7d", "value": "38836B23A651C6BBC0875AF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394412, "uuid": "e077e9b9-00ea-449c-9e66-a8dc09a77912", "value": "1536:eB7cH1LhKlBqISVhuzdPQq0aJP9sWtjG7ew3nKuWgf6UmoIYuOVje+ZNne:eRMhKlcduzdPv0o+QK7eknKunVmrYuO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394412, "uuid": "d11334aa-6fae-43f8-8622-64b2535423b7", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394412, "uuid": "48ad1332-a578-4c4e-b9f2-78274cb18969", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394412, "uuid": "cfd889d2-a32b-4cde-98f9-d9d3f03c2b37", "value": "ff33ff5972a043d30317d508010200fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497a2f17-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427290, "uuid": "89893a7a-7be5-446a-b0be-456bc09251b2", "comment": "Malware payload", "value": "7eedf1843961cd72349694844ad24e66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427290, "uuid": "93f011d8-5ec6-4944-8188-4df003a63821", "comment": "Malware payload", "value": "be0f80d43bd6c7bda504817b07853e9898cff88d8411adc39be2a652a5105373", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427290, "uuid": "65cd9466-4abc-43c1-ae95-4ffca93a35f1", "comment": "Malware payload", "value": "c48d6847bfe6d9e7aeec21a292cbdff279886bd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427290, "uuid": "c262665d-acc6-40d8-99a5-796b54a57d8b", "comment": "Malware payload", "value": "03c47e37debd123125be0b08c2e5514bbf94cf1ed9c90fb8470caf9f736f04bb77b2813d4d92da7de0bf31ae37f2d382", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427290, "uuid": "8a517bdf-2d74-4783-8312-7fa1a5f9ca49", "value": "7E03F144C78B5758E08F47BA4CBC77128C21775E1488DDF6F69AB42A4A15B80EB88B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427290, "uuid": "0f8e9c6d-d55e-485c-9418-bde1ce958470", "value": "768:Czrsr+Jf71RrpJPBh1MVtq7QX/4xGt1nbcuyD7UryqDqyqdRkNDbd:ditBh1sqEXgY1nouy8mqXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427290, "uuid": "52a553cf-7376-494b-ae16-21398fcf1d94", "value": 41168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427290, "uuid": "1e7e2a5b-27bc-4ad3-9160-c54b3079dafd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427290, "uuid": "272ff4fd-21d2-4357-90d4-e78557d04433", "value": "7eedf1843961cd72349694844ad24e66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2545bbc2-ca7d-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623392440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392440, "uuid": "8a4240e3-bde8-4231-b44a-5a7c9428352a", "comment": "Malware payload (OskiStealer)", "value": "485609c090f936b274f0f53cb85cab12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392440, "uuid": "201634cc-9cf8-4fe7-8580-99ab47dd3995", "comment": "Malware payload (OskiStealer)", "value": "bf5b613e142655ffc08aa2890da9de4bd798c1de4d163f2ea8f2d830ddee8984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392440, "uuid": "36a466e1-52b0-414f-9a94-f60d3ff6b8e0", "comment": "Malware payload (OskiStealer)", "value": "bf14df7741ff532e09d45f7249609d9c53374fc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623392440, "uuid": "a28a8862-d8b6-4f06-84fe-57d78a1db7f1", "comment": "Malware payload (OskiStealer)", "value": "739b476d1438e2236301cc1b3bd0d14efbe8787331bb8e3f8bd8a5d139d74d249dcfe606db942bf8764646dcc8d3953f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392440, "uuid": "423acdca-9cf9-4617-87a6-0092060373ac", "value": "929405082F40D921D29526BE8BAACA77531C5D4C2763EA0963F03DBF36F92D3541B25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392440, "uuid": "e6483af8-67ac-4f2a-9223-bc5e395d74c5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392440, "uuid": "a72bef2a-fc76-45b6-9845-e137a7e821cb", "value": "6144:Esx1zaQEEdKV3a+c21HwU0JlGQcKIRu7oI77DxPKi9V+I:dJEEgV3dnwnenmoI7HNKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623392440, "uuid": "3a0c8163-733e-45df-b591-574e5467d07c", "value": 445994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623392440, "uuid": "a28cd34a-d9c7-4c99-b9bf-135990495378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623392440, "uuid": "87513522-2e57-4ad4-be0e-c0c19ee36b06", "value": "485609c090f936b274f0f53cb85cab12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f7fe04-ca79-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623390725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390725, "uuid": "a7645ed8-efa7-42b0-b9ee-bb8957219fe4", "comment": "Malware payload (SnakeKeylogger)", "value": "28b27ffa6363d008034f3056bdb34be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390725, "uuid": "bc2d7bb0-dd00-4c61-a4b2-6bec2f71de45", "comment": "Malware payload (SnakeKeylogger)", "value": "bfa0c6d6a166011476ffd4f4fa1c2c1669c273fa945f729267fa537ce7689b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390725, "uuid": "69998856-2523-4a49-b139-e37c3dd2fe9d", "comment": "Malware payload (SnakeKeylogger)", "value": "facb1cbe2f1a3bfc71eda19ebeaba2c1764de80a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390725, "uuid": "55bdf6a1-9793-4976-aa41-66c56c035949", "comment": "Malware payload (SnakeKeylogger)", "value": "b8d4ced85a4f095e021b7280230ecfc9af397a09c9f26828029060ca4bd57e8f105f36573aec9956ec422d466325d396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390725, "uuid": "be7a7f9f-9d5d-4873-9fbb-241af28de206", "value": "091558F591E013C7C7AEDEF25BD5F3808A6F5AA631318118A84C66EC27EE58D01CE617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390725, "uuid": "874b1799-2db8-46ad-ac8e-f5f1edd130da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390725, "uuid": "5fbb16a0-400e-4599-8628-003f5da06c95", "value": "12288:WeSmDJclm5uQc4h2DP14wTVCELcdQrGNyfVuwVfFn7R+ZM4e/ZUdtbP:WeZUQvaPHgqNfkwVNn7R+NeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390725, "uuid": "1c79fd00-d402-4e78-b43e-de34e428b7b5", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390725, "uuid": "e99c0b57-c64d-42c6-8a79-2127a429c528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390725, "uuid": "98c67e14-5639-477b-b5b7-483d42314b89", "value": "00010200390_0192021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607e8764-ca79-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1623390822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390822, "uuid": "13c64de3-1e7c-4db2-a7fe-8480c47cd800", "comment": "Malware payload (STRRAT)", "value": "8a089661207221a0ddfd1cd331ea61c7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390822, "uuid": "e957b3be-e18b-4e04-90f4-7e76eea5ee62", "comment": "Malware payload (STRRAT)", "value": "c087de89a3e2c83eb0e5b4bf11de01082518d2099667a63fb49df23206b132e3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390822, "uuid": "64e8681d-1926-44de-af34-35ce2d224c6c", "comment": "Malware payload (STRRAT)", "value": "de54a019be24d2cfdf43744beed12fdee1bb41a9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623390822, "uuid": "ec19e1f1-2451-4884-b08b-8e508b369fca", "comment": "Malware payload (STRRAT)", "value": "00364e659596a12307b3dd3fcaadb7b684473664561ce874eab264ed3ae8f78f344b42e3c2783760f3e72efda01ef7da", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390822, "uuid": "9c45fe40-fdc8-45c1-9e34-5b0b0f6c92ea", "value": "E7B3D0977E9F91A4D10B403389558362EB0C9395C649B46FA2FC08D60C76DBF4B0BA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390822, "uuid": "c15aca65-397e-4250-83e0-ae6542715b39", "value": "3072:hC3qIjEXBQhWmBnOCkjG3QwUp/HBKewGP:hCalWI+nbQJp/8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623390822, "uuid": "73f387ae-953b-42fa-8ac2-d526839dac5d", "value": 108901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623390822, "uuid": "112c8af0-7237-487c-9507-fca160ab4c06", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623390822, "uuid": "14ba4146-bec8-43bf-8393-5a30918ae7e0", "value": "Draft HUD.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884b6d6b-cab4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623416229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416229, "uuid": "4baeacdb-67fb-4ed3-88ba-2f2340ff04e8", "comment": "Malware payload (AgentTesla)", "value": "368a0ec11590e137b1cd5405cd0591db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416229, "uuid": "c9c5d8c9-0495-4712-a7c8-5cf2726487fa", "comment": "Malware payload (AgentTesla)", "value": "c0b43d27c73d2a64f25a1e095a10dcf339635d9c48c6d612b37eba084341e103", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416229, "uuid": "506f1dbc-b847-4167-87c1-7b1972532ad3", "comment": "Malware payload (AgentTesla)", "value": "48c11cb189d44ae0c30b32f0aba41d4c52568c44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416229, "uuid": "35648d94-7484-4810-8553-fa8537a8ad72", "comment": "Malware payload (AgentTesla)", "value": "888b78525a2317862c31792e78425bbe2c311fa2b53df69fb0769fe9800065be41369835f579b47d3fe4f41d52598ec6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416229, "uuid": "34673d27-699e-4daf-bb80-d3c2c1601aba", "value": "E6157AF1A5A147C3D39EEDF283C6B3848B2F9AA231365211A44C22FC67DD28D65CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416229, "uuid": "c46c25ff-a5a3-4433-967d-50ec114dcd51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416229, "uuid": "3bd00701-a4c3-46f2-8e73-96f41fb149f0", "value": "12288:p12L4ovYmfBgM/npoaxFKgasrOe+Gcr1xs+j4JQ0DXUYNZM4e/ZUdtbV:pMpX3asL/EzsC4jLUgNeBUdtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623416229, "uuid": "3ca43524-ec10-407c-a849-5d08530ab7b4", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623416229, "uuid": "43988672-4aed-4922-8beb-f39b7e0c9ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416229, "uuid": "5ad8817e-f559-4e5b-94f0-25c3b31de5a8", "value": "Following abusive email letter .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eafbb27-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423541, "uuid": "f071b0ca-5392-43f1-971e-b08dfbb6e157", "comment": "Malware payload (Mirai)", "value": "e7976f75d137c95be92160733ac12dab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423541, "uuid": "6d8972dd-467f-47f4-8500-592dcfaf37bc", "comment": "Malware payload (Mirai)", "value": "c0d17165a72ff848f003bad0abc470bf378686e77d74330886bcd077d46af6a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423541, "uuid": "861377de-6cbd-4526-b876-b1231e4eb606", "comment": "Malware payload (Mirai)", "value": "719ad4d07b57b679bf37e9e474bfbe26cf0e5a32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423541, "uuid": "ca1465a8-9612-434a-b19b-efd9ed04b9be", "comment": "Malware payload (Mirai)", "value": "66e9d0e3d20444812461403d065228dce9b9ab7a1fb68da90ce859d3aa6b0c6de8b6567313b6fe3e7927deec32acf888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423541, "uuid": "3d314ff2-fa3c-4b93-948a-54f42a5825a7", "value": "E913F11DF3C65CD6CCAC46BBC0A64F768EEAA1D1B4AE274423140CC6E76E43ABC1C655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423541, "uuid": "84d37ee8-1eeb-45f9-aa32-d6d0a7d171f3", "value": "768:g+crwUJjAZ68djDTcU6qdKz2sgGkEtcA/Od6atXobTBKKX0W3:g+cNQ6KcBqIzzzCEOdHePBvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423541, "uuid": "17d05280-e011-4bb5-a929-c4ea03813cb5", "value": 42932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423541, "uuid": "98fa63bc-cf65-4b0d-b4e2-8706abc97c58", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423541, "uuid": "5be208f8-2c6b-4a0c-9c3e-582ecae057d6", "value": "e7976f75d137c95be92160733ac12dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f37947-ca95-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623402984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402984, "uuid": "a1c59fde-e869-47b7-a817-d4466a8f2469", "comment": "Malware payload (RedLineStealer)", "value": "5d8c7ad6aa8144b4bc06f646f6f2ba94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402984, "uuid": "83e0fc4b-0e74-4519-8cb2-cd810d0fa837", "comment": "Malware payload (RedLineStealer)", "value": "c1eec495b627d628e570d949dcc165a3457ad38ad17965075ddd228c5955a21b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402984, "uuid": "88406638-02a9-4f5f-a6f0-cba8770a009c", "comment": "Malware payload (RedLineStealer)", "value": "641522fe7dd02343a8d99d8e161321ceb2725bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623402984, "uuid": "f15f5d47-910e-48c3-bb3e-866921be9cfb", "comment": "Malware payload (RedLineStealer)", "value": "8f980bb9a01edefcc21e31c7d8ac4e8fda1d22dd42ba3558f4eada91fcb4b066704ea532523252796fc4e2da56719342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402984, "uuid": "c1bd74b6-92cf-424d-bd4a-376c4c2a1d47", "value": "02F4DF00B291C039F6B326F459B99278952E7FB26B28A1CB53D52BFD46745E0EC31B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402984, "uuid": "e28692ef-f1f4-4458-bd5a-e944902ca2aa", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402984, "uuid": "0395e2ad-5e00-4518-94c9-2a8a8b9ff982", "value": "12288:6Qa5HHOa5VPN61XNXyQedRceoc35FjkBa5WzTmzB/iZseje2ecsW1aAZmJWL4UkL:6QwJF61XN9Wocc8svmzkocs+aCEHI2ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623402984, "uuid": "3b621cf1-ce3a-4a1e-b593-d1293c9689b8", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623402984, "uuid": "57d3d92c-5f6b-4e62-8619-bcab433db6a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623402984, "uuid": "6a3b6db6-5cdc-4c72-991c-e5590845215b", "value": "5d8c7ad6aa8144b4bc06f646f6f2ba94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f42259e-ca9b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623405503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405503, "uuid": "8a500db8-d809-4e59-aa82-2200cd1a1352", "comment": "Malware payload (SnakeKeylogger)", "value": "22e4595ab55d017aab28724a9bfcba56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405503, "uuid": "f7979c93-d45c-41eb-bd5e-2bb84eb9b3a3", "comment": "Malware payload (SnakeKeylogger)", "value": "c20124d6e5c7e26c5933ce574b3c02d112eab067b86323691ea8084b00bf78b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405503, "uuid": "3d7b0f60-522b-4004-8d1c-04039c7bf7f3", "comment": "Malware payload (SnakeKeylogger)", "value": "d3fa990401564810f941b1f793954ae5e58f054f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405503, "uuid": "d86b296a-d80d-408c-8fa7-c6b231ed7692", "comment": "Malware payload (SnakeKeylogger)", "value": "f4ed2a065ffa12412f0c60ec2596e3b7f668f5924d510aabc0dd39cd3c8e9d72e67c35eb560e07919541cbc4902fd696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405503, "uuid": "1f9a1412-e327-4c01-a99b-15f2b13a6d24", "value": "532504B2B1EC47CBC35EDDF187E9A3A28A1B4A6335715201B4DC22EC62ED19D54CE1C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405503, "uuid": "33e3e5a3-fa3f-478a-938e-b7b3077d77aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405503, "uuid": "254cdff2-4300-43e9-a979-fc97ecf66410", "value": "24576:YeJ+3i5q940XvOIq/hDVgu9XCvNeBUdt:YK++qe0mIq/zr9yvwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405503, "uuid": "8627738b-7ceb-4dce-a4d4-56ee3e68f092", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405503, "uuid": "ad24573f-d399-493c-8dbf-761f6de1cda5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405503, "uuid": "376bbd63-8286-4be7-bc5a-370c3a593190", "value": "Invoice_OS169ENG 000003893148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e6912f-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427338, "uuid": "6b953f7c-2d0d-40e2-b2f2-394a06c4f93a", "comment": "Malware payload", "value": "7852763afde73a4ee5c37360ae82e499", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427338, "uuid": "ab262f41-b8ff-4c77-bf84-225cf548cc1c", "comment": "Malware payload", "value": "c22292b2a99aa62865bdcb961be4ca9d4605c04359373af5122693265d7664fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427338, "uuid": "4fc46a7a-de2b-4bec-8d45-ae36225bd0f5", "comment": "Malware payload", "value": "340d12b6c5b5afd37b355b87e53edbd8c0942e98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427338, "uuid": "dd8d3b3f-0e02-4884-af0d-b47b076c6dcf", "comment": "Malware payload", "value": "1a0566deb71a655aea06b6420058a7110d2dfde1ebb1fb7b6283aaf6a17e9181ed5c4edf4e0daa58237499fa6f8de998", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427338, "uuid": "9008f094-5d99-406b-a924-66318e48baa8", "value": "F7C34CE5E4015F3DF8D799BD82270E0AD422925572A30F1BF5ABFC977C224896B0BD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427338, "uuid": "1cedc76a-867c-49c7-a26f-f8d9a306db7a", "value": "3072:lJN9Pthe1Ve1Rv4jpe5VcLCB3THYowDLTde:lJbthe1VmRv4jpe5Va0Yo0LTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427338, "uuid": "c7043b52-d0c4-40a2-aa14-28e45dd1cfc3", "value": 127288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427338, "uuid": "e88d3cc5-8685-4bf4-9533-f5fc1836557b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427338, "uuid": "69906204-046a-461a-910c-32457451ce87", "value": "7852763afde73a4ee5c37360ae82e499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69729cae-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426915, "uuid": "2bdfece3-5930-42e3-a741-9d20331da103", "comment": "Malware payload (Mirai)", "value": "90705d4aaddf85b11fad1465a15e595e", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426915, "uuid": "73863dc0-e6cc-4247-97c7-51e0cc837dbf", "comment": "Malware payload (Mirai)", "value": "c227d3062cb5d4b413582ad961e952c58e2757c40fac0b2df13cc46f16ed2055", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426915, "uuid": "148901c2-b832-496f-bcbd-f4f1e78af636", "comment": "Malware payload (Mirai)", "value": "57cf4504eff62c68b82b16fa95f27b91cb775472", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426915, "uuid": "c8a8e3f8-c8dc-4949-a48c-7b59f4875dfc", "comment": "Malware payload (Mirai)", "value": "60bfd106b079450510847267ae775d263ae6f4103e89199cd5248e571e3f29a4e549397e7bad9434fa5e1184585f7088", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426915, "uuid": "b64177dc-5504-4e42-a1f1-6a076883f019", "value": "79A2E031185AE523C1A04835D3F8DDC3766E1F3D91FAB232AB604DB8BFC125461BE496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426915, "uuid": "bbf967d7-7ba4-4f31-ae5a-69838b8acd02", "value": "384:+p5uzj97euZJwqXluERAryoccnPRyEzLXN4InStChymdGUop5h6:Dn4WXRJoccnPRlNOtCs3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426915, "uuid": "36c3b257-3787-4a45-9d8e-cee30a582f55", "value": 22468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426915, "uuid": "4db817a9-1303-40b2-a750-8d90dd5edb5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426915, "uuid": "79fad1ea-0227-4bf0-8d05-4c534dfe6276", "value": "90705d4aaddf85b11fad1465a15e595e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378ae793-cad0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623428119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428119, "uuid": "e8dad18c-6657-40eb-9720-41700e2a648d", "comment": "Malware payload (Mirai)", "value": "4929130875793b11948b1c4f3767565b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428119, "uuid": "61755b48-009a-4179-a2da-349499736347", "comment": "Malware payload (Mirai)", "value": "c270fa3fdc5bb456a2252a6d9408b6a4b32cc66460de5db6877f3377a5eb8869", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428119, "uuid": "a243a4db-ca04-4a23-88fa-4e7e26aa9879", "comment": "Malware payload (Mirai)", "value": "74db678f8b8c0f69eb27d0c37efdaf29c69e7bef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623428119, "uuid": "f6dc7993-1b64-4d8a-9f58-17cca2b3bcb6", "comment": "Malware payload (Mirai)", "value": "150cad639386c509d2c49a89f2718819467e81e41099cfa4c242498a1e95f0bc6db1c867a8c8e13c546f4833df2ba534", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428119, "uuid": "262a0ed3-6b9e-49d9-8423-eba3ba47ea4d", "value": "E223F18FD454BD0BCE0F4C79D2EE4F2BAC65314122CA576DB26A18CE935156E720E0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428119, "uuid": "29e7b455-5bdc-454c-be70-d10cb395fdff", "value": "768:s0mEWTH/QDlH/tWkzAgDb4aAJyYKTbd0HXgg53eMHhWCU6bsGMLilXnk3fJHPW9:s34RQksgfxAPJgg53eMPrQnLdhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623428119, "uuid": "5aecf570-43b3-4d03-9a03-5b54c501a04d", "value": 49284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623428119, "uuid": "dc163738-4d49-4902-ac01-62e0b3bb5b9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623428119, "uuid": "b18d160e-2643-40d6-b829-dcd0563782c8", "value": "4929130875793b11948b1c4f3767565b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cad4bf7-ca97-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623403647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403647, "uuid": "cb107c69-17a8-4f24-971f-879b82231603", "comment": "Malware payload (AgentTesla)", "value": "be2c7a5dad0f4b7e5d888bd0e7e7e5ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403647, "uuid": "411a44c5-9c85-4c8f-9078-57f3a85c4f6b", "comment": "Malware payload (AgentTesla)", "value": "c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403647, "uuid": "3486220c-a3c9-4a0c-a221-ae5f4dafa4fd", "comment": "Malware payload (AgentTesla)", "value": "515710161ed03ec60dd25568c4e6691db4ca2663", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403647, "uuid": "1aa160d6-56d7-4594-8dde-cc7389b112d9", "comment": "Malware payload (AgentTesla)", "value": "804f926622e51f8ad24ad30ff52400144cc9595ae2d972d0180b68c239e3808009442164ff5e4fdae655e6fbe1eee649", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403647, "uuid": "dc39ad17-662f-4d30-b98b-d3f758992720", "value": "86E49E413298D985E0232FF618AED46053B97D5F9131C60D2E82BB9F55F3B0228A7B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403647, "uuid": "e3d5558a-a539-49aa-81e6-0424fe39be45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403647, "uuid": "fbbe7cad-6935-438c-abd6-2be1df4fc308", "value": "12288:5L5uAPywRh1bBYDbeShMB4Y3doIw+Sl2emGLVzSiyyjK:5L55awfdamSe1yJRl2ertd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623403647, "uuid": "8f2f52a4-b89f-4497-a292-0ed193cc45ce", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623403647, "uuid": "e1bba047-6f46-4186-8113-78afef683176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403647, "uuid": "80984684-230c-4a38-aeb0-094c40e955d9", "value": "HT210525 IV Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54496f5d-ca9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623406263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406263, "uuid": "fc3c4cb3-71a4-46f7-a617-2462265335f6", "comment": "Malware payload (Formbook)", "value": "862b4c2abad2c07ac13d5e051c18ab86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406263, "uuid": "dac80d9b-ccd0-4242-8317-54023ecfaa0a", "comment": "Malware payload (Formbook)", "value": "c347c2d7579053d263f6ab6eddca7bd03691ebab93b30b5caba462caa7106beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406263, "uuid": "dd6fc8bc-6dc1-4db7-8610-302385adda4b", "comment": "Malware payload (Formbook)", "value": "c78f0a59312c7902e445c5a31d4896907e96475c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406263, "uuid": "28223b76-b438-46c7-8c79-11b18822ed2d", "comment": "Malware payload (Formbook)", "value": "4ace28bdd6bd2e5504263d581cafb569270218517b940167a493222ba1d41462f8d42a7537273d642144a1469b20d31a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406263, "uuid": "4fb03ac1-c021-45f8-8487-c5bd6d0dbbcf", "value": "1734126765D5D4FBC08A067118B7BB5AF7FBBA14132006275B140FAF7B69083AD070BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406263, "uuid": "fb2648e3-df49-492a-bf6e-9af1e338d971", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406263, "uuid": "f20ddd35-be6e-4fbb-9c3c-1f9d148527f7", "value": "6144:Ds9e9CRE9m5SmMZ0AQV3Xtx4abWIj9Jtbs:yemUlmMKAQp9tpjPtbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406263, "uuid": "76ef319b-b772-45ec-b4eb-ec2e78d02258", "value": 241748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406263, "uuid": "44b9a273-3c29-468d-a74e-1ec9c255785e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406263, "uuid": "4dd0fc54-3318-4f9e-b815-945654981072", "value": "2435.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caa5356-cab3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623415726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415726, "uuid": "fe4cb7f5-f8f1-4d99-a34e-177e81dc1297", "comment": "Malware payload (AgentTesla)", "value": "c376cef609a18260213571d06233ba20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415726, "uuid": "06e94f66-73fd-4b87-8cb6-845c4587de13", "comment": "Malware payload (AgentTesla)", "value": "c42b7b1630553baa3aeb65e40b04244910822c175e9b6cb3f7f365264171196b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415726, "uuid": "d7634be8-157b-4390-92d7-eea4926bac02", "comment": "Malware payload (AgentTesla)", "value": "72523a0124ddd34ce6fa21901b4648311ae04b72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623415726, "uuid": "cdc41343-9af0-4453-8617-7d6bce9a4804", "comment": "Malware payload (AgentTesla)", "value": "57ed527271d24410a05a4fcc6375704ba2aaa732a294ebe3d9c17937f3f74ff9bcbd8d185607d4c6b6034b3401ddc3d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415726, "uuid": "fbee2563-a5c0-440a-9207-86b0d7e3df4d", "value": "C454129AF8F1E823F9729B7005AB0BF9E7F79B17285112171B616EFB42761861133309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415726, "uuid": "1e466bbe-7f23-49a8-8867-a94cd94ad673", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415726, "uuid": "e06a23ee-e400-49f2-84cc-ad166bedaf1d", "value": "6144:Ds9aphdmtsKdoFHOxDW+s6IVlzINDQCzvDj:yaphUtToFHSTs6IVl4QqvDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623415726, "uuid": "21e12165-675d-4195-b818-0d0f4ece2f00", "value": 282745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623415726, "uuid": "e3b533c6-aa46-44d9-a730-0f404bb5b049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623415726, "uuid": "5349c884-1b1c-4403-86ed-d356c4125675", "value": "DHL Original Receipt_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c974cb-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427014, "uuid": "3dfb6048-4bda-4c84-89cb-d2d8800b6d79", "comment": "Malware payload", "value": "502831ea2a2e84b659bb36deab0d00ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427014, "uuid": "b4782b78-a7f3-4887-81ed-7b6a5dbefe24", "comment": "Malware payload", "value": "c47184e07df111fe5d0156444efc97751056d8b7961f985bb453b2e166a14f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427014, "uuid": "2c355f44-6c07-44cd-abd4-945ccec8e782", "comment": "Malware payload", "value": "03c190acffa25541cb6a7440c82bb2acd132baa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427014, "uuid": "0c06e961-a464-4969-ad1a-49487d00ebbb", "comment": "Malware payload", "value": "87745bba938a381dc96f62e089e51d253999655b17fc41ed6b380e6f933b00e7016e3b8822412d156cc24207a463b023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427014, "uuid": "ea203f4a-a5ae-4050-a3a9-c1b376328025", "value": "6B21FE00F2191863FAE13DB433372B40976A8F0327194908AB9FE79EE8BCC305A5D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427014, "uuid": "ff458015-6f11-4cdb-bcd8-a1345b7b5c2a", "value": "24:3eAxpWS9nSWZ6S4/KSwISBd6oTKP5tAFlsZqzktRKYvy53aaTo0YOvAkKoX9x6hB:u/gZVbXGA4Qz2RKYvy53lPooX7+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427014, "uuid": "6283db6f-a959-4954-9d20-00d20f4f4c52", "value": 1404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427014, "uuid": "d8e2c1d9-9034-406a-b090-c25dd062c266", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427014, "uuid": "82adf289-38ad-4ba3-bf7c-377095a56da1", "value": "502831ea2a2e84b659bb36deab0d00ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f6b91d-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426927, "uuid": "b69f3444-f7eb-4721-bb8b-2bb667e9f706", "comment": "Malware payload (Mirai)", "value": "8b2c9a5955fd91b9908d52783e3c0583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426927, "uuid": "7f070cdf-734f-484a-b9b9-9338f71debe4", "comment": "Malware payload (Mirai)", "value": "c4aaf444bbdd54cc2b5e896b76aaa8ff32f07af4601847f3346ee5a86cb96442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426927, "uuid": "d8e7bdc2-b3a3-4b6a-8136-dabc11427df2", "comment": "Malware payload (Mirai)", "value": "394655695a0d862abbc0b227133d850e8764a04f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426927, "uuid": "cede5707-f31a-4014-8c7f-6966b7cd07bc", "comment": "Malware payload (Mirai)", "value": "34c798f059e1b468d133f5a85ff5063df9cc799db6aee4e61193d863716a329ebaf84edc4e21bd19cd61245419c3ec5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426927, "uuid": "61b62db0-825b-4b57-a039-d4856dbf1fe1", "value": "B6B2D09FEA88B5CBCABF0C7DD1CD0562469A70D071D9575E834998CCF62EA0B30950BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426927, "uuid": "fdf6f5b1-722d-401e-a4a2-db21587a8cd0", "value": "384:VCcVOWiPJx8LSb80GV7zB+Ykw48CsYEtPMoXGD/LDwOb57G7/BVSRWGVCz0NvXJR:FLiD4SHGC8ouPenkO17QZV+WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426927, "uuid": "8cd2dc2d-3248-41db-9564-b61f793d79ca", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426927, "uuid": "2f0c21e8-150f-48e5-8ebf-3d6b9790334b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426927, "uuid": "9253c342-4958-4669-8ddc-5c565a6daa4f", "value": "8b2c9a5955fd91b9908d52783e3c0583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c146e2-caa4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623409213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409213, "uuid": "7506c5cb-1a71-4cb6-91c5-1f59f76bc9b3", "comment": "Malware payload (Loki)", "value": "ce8fe6b0f3b7b025c9961fb8ac0b67f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409213, "uuid": "f719aa19-b64f-4adf-8a4b-94c124942786", "comment": "Malware payload (Loki)", "value": "c4f4a191ff5bb4993d7db5068d031c59e60b2ffd75a30a8f5e305b709265b548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409213, "uuid": "522311e4-041a-4f50-b720-1092024debd2", "comment": "Malware payload (Loki)", "value": "315c35a1a5d9662a2e44b7526bc37c59a534271f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409213, "uuid": "921c396f-762b-4010-a98e-8055468756fe", "comment": "Malware payload (Loki)", "value": "bd90e9f0aef794f9df30b2a710f9e1d71a65b3262e2729876664bebcad81947c7804213507d1ef7c1fa7de773727aeef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409213, "uuid": "59adfa03-cb62-466a-84d2-3e27f0750aad", "value": "B465BE216600AB11D16947368C63D6708FB9AC0EAEE1C61F3DE73D9F3871BB2152D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409213, "uuid": "bceff149-6249-4873-981e-26f2b87f3947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409213, "uuid": "03a0b691-ee7d-44db-b5d0-d69aa261c9a5", "value": "24576:JpwNeBUdtesEgQsXe/z8YEoqSg5LlJfH6zMIDsxTt83blEP80G0ldFMuX8xZ8hlA:owBUesEgQsXe5U/BldOqP80GiL/0Z8zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409213, "uuid": "3d3e8afc-5935-425c-9855-d73b82c90cea", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409213, "uuid": "42ab3d4d-218f-4b78-aca9-1d3d62d51b50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409213, "uuid": "7625f1e3-a5cb-4ba1-8e66-d27eac221202", "value": "detalles del pago.pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f131a726-ca86-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623396648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396648, "uuid": "179b1209-26e7-4058-aa3d-01c832d7c515", "comment": "Malware payload (Gafgyt)", "value": "b9debb7aec4e35125bd23d83df965c23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396648, "uuid": "3b275a27-8505-49bc-8b98-08e32d9faefa", "comment": "Malware payload (Gafgyt)", "value": "c6490d4c958321df67090cf4efe0fddbbb2eb42798d206452c4a98275d9a3488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396648, "uuid": "43838869-3c72-42c4-b7d2-78f04d5237e0", "comment": "Malware payload (Gafgyt)", "value": "a6bbfc94044b3337d0bc6a044dbe737dacfd7226", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396648, "uuid": "96be5aae-ce3a-46e8-b593-f49270dde4da", "comment": "Malware payload (Gafgyt)", "value": "352fcc752bd262087c6b43228456233d5ed3b96437a6873ab1403c28c5d18b18279c15b2f080f55d584b7aa599a82764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396648, "uuid": "d9f97057-0268-4b84-8e83-423299e1f6f8", "value": "08D33A05E4508727C6D227BAF79E868E77336BE8A7C7331156246EB42FC279D1E39420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396648, "uuid": "0bd39003-a927-4470-9ab5-be18bd8199cc", "value": "3072:mTfmVSd1pReQiiNFmadvFWUsjO2Dsk45hfMq2YNZFmyrQsY67Y5/:YFmadvFIs35hfMqbFmyrQsY67Y5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623396648, "uuid": "94db959f-b5cf-4a54-9d61-7388919bbff3", "value": 138877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623396648, "uuid": "5020df0a-da65-4119-bbc2-92a9aa30af92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396648, "uuid": "8c032e11-1c43-4576-87ee-fba63a78f68e", "value": "b9debb7aec4e35125bd23d83df965c23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3b5b79-caa3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623408855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408855, "uuid": "668a147e-471a-4e9b-8089-34d6499a29a3", "comment": "Malware payload", "value": "b5113d839a4752d320b02ef4f5846523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408855, "uuid": "504720a2-77b4-43af-8c09-e6a58d91b254", "comment": "Malware payload", "value": "c6f00b83e8b9ef80ef51702bad5d85dc6802a6317f3d9563371f68aabdd608a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408855, "uuid": "9f4a8a28-b3ba-40e6-9490-df2a2868d544", "comment": "Malware payload", "value": "c43ff09500de883e27c39c593d8589413f0fca73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408855, "uuid": "56d0936b-da9a-4d50-8022-ca4aa3d71cb7", "comment": "Malware payload", "value": "188f222c68e977b55d27dafac3289eee02848b43db4665b3b28dd08b702fd1f19bcefe41ea5f8afdca90cb47f91bfe33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408855, "uuid": "637e7353-c101-4ff8-a0b0-6d48e4ae7a2a", "value": "6014AF2279C3C0F1E57554B5CB86C7E04B2DBB2102670BCB6BE55AB94F353A1863E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408855, "uuid": "c6696a04-b868-44a3-b549-a07e22216c70", "value": "3ca94f885beaa1f663e92508583ab6a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408855, "uuid": "f2440e0b-9cbd-43fe-b24a-3764ebd2609f", "value": "1536:1MUCUM/GCKI7+Ww2edp/DFjkJbl7Aqe50smwlE7h5hkVQWpHgu9ngroQsOViKbWq:1TMx00Aqe50KEd5hkVQyr9grv3Vtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623408855, "uuid": "658480b5-2475-4d89-90b4-670430050765", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623408855, "uuid": "36ae9435-a217-49c2-8df5-cf5819a7995f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408855, "uuid": "61d0440d-5cef-40ff-9314-36467a0ee8c3", "value": "b5113d839a4752d320b02ef4f5846523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1aae42-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427003, "uuid": "f9f05d0a-d13b-4516-9cf6-f189af753a82", "comment": "Malware payload (Mirai)", "value": "f192fa7d6488492559a4f0678735aead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427003, "uuid": "fd46f859-aaad-40e1-97ba-14762416ee7e", "comment": "Malware payload (Mirai)", "value": "c6f6775d1fa8e35c65558896be6bd9222962df4c27c8bed940dfd93273e8d728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427003, "uuid": "6cc75db9-1291-48c7-8efa-5cdbef4ad570", "comment": "Malware payload (Mirai)", "value": "ddf86f0bac4b79ae488480bc55da4c5374460eee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427003, "uuid": "b65b4c43-324d-4681-a809-a38ceac6b8c8", "comment": "Malware payload (Mirai)", "value": "3d6b1a277a5877ab3f1b39107fc64aab9c73b3380dea732bc403ab1e1208957c18a02fe49d2a363e6e894622def6e0aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427003, "uuid": "46b9614e-b54b-47bc-a4f4-5f51382fbf9d", "value": "B9A3A40D7E619F7DFBE982384BB79E22964433877AE1D484D15CEA012E7024E741FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427003, "uuid": "fe394c6c-f928-409c-b5b1-b3d000bbb718", "value": "1536:fqLtaZbEIuHbo8EoF34eEw0vplpiay5VXchN3Kp2Lo8YebnB/9P:f4aUbEw0B/ipXchN3Kp2Lo/erd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427003, "uuid": "d06a3736-6a83-49cc-bb73-06d058bb1499", "value": 104516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427003, "uuid": "8f9a5ff7-e7fe-463e-9eaf-2ac9b01a0f1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427003, "uuid": "e4252e3e-45f5-4cc8-bcdb-235e665b77c6", "value": "f192fa7d6488492559a4f0678735aead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2122a9c-caa6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623410259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410259, "uuid": "f36d6bd0-5961-441d-8f64-677adbb924d5", "comment": "Malware payload (AgentTesla)", "value": "deb5412f0b0201d045e2007503bbb283", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410259, "uuid": "cafecebb-7aad-403e-80c4-8c46ef46be17", "comment": "Malware payload (AgentTesla)", "value": "c770d9d870614a8a39844cd1f564bb823944f8d4d25f7d68f15b1401fb08e4e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410259, "uuid": "8198cb92-1745-4d50-ab68-3eae43671441", "comment": "Malware payload (AgentTesla)", "value": "4086c81e9c51db9e242c604bfa99ad217a45986d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410259, "uuid": "2c4b6d65-a82d-4dbd-aae2-75016806c901", "comment": "Malware payload (AgentTesla)", "value": "781a36e406a08ecd40221bcfd07d8cbb9375224bda023af5082ac528dd545fe872a4f6ddeffad5e6da9457f86b4d62c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410259, "uuid": "bf0a73cb-aeda-4f9b-b939-fc6b283f6bac", "value": "51A4F16270A0B091E6F175BD0FA7E1386337AE05A913061767C53FAB30FE28399197D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410259, "uuid": "6bebc651-d9cb-49a7-bfd9-6a1b3b7c32b6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410259, "uuid": "f148a87a-da37-4303-a425-811263ca87e2", "value": "6144:usUlNPJU0e7dkV3ZLFJVsA2mQ7fGUgYCrQOd:sPJU1763Z7VPw7+Ugfxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410259, "uuid": "e5fd0e19-47a8-4b00-8c64-796af9e62dc4", "value": 448961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410259, "uuid": "69c8d3dd-f4de-480f-8b32-aec8906ceee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410259, "uuid": "38991761-7e60-42a5-8f72-fb7ad731710d", "value": "Quote-TSL-1037174_4810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8c2ce6-ca9e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623406576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406576, "uuid": "a9207407-c3b7-4cf8-8287-8b6747c89710", "comment": "Malware payload (SnakeKeylogger)", "value": "d831cdf0f9291ef00b0fbd7e8fd0aa0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406576, "uuid": "62098a07-cceb-4bf7-9f2b-a9d0887127d8", "comment": "Malware payload (SnakeKeylogger)", "value": "ca75db42b76d59f2640030e585d1b46cc37355f6f54fa15b5d6940c7d5b501c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406576, "uuid": "6ef1cdbe-d5b7-41b8-b8b3-ea87fb687461", "comment": "Malware payload (SnakeKeylogger)", "value": "5b68efedcff98d7450209d86ffde2e7d87845735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406576, "uuid": "2b3bbdd6-1547-4b84-83ff-16467b62256e", "comment": "Malware payload (SnakeKeylogger)", "value": "a18b9c20783c140c41cda6418aaf277b8e9d49cab3197c3b1458bd2ee41989bcc488c1f497a3cec13c38b60733993214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406576, "uuid": "f07e1a0e-4efd-4c06-a1c5-9bcced18b4da", "value": "1344125373D4C8BFF48B2833187BAB6ED1719A152761644B1B18CF3FA920687651E2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406576, "uuid": "9e9a97d9-0755-41a7-8d78-9966af5f2af7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406576, "uuid": "282b21dd-2d13-42ef-b11f-16fd73d4b8d9", "value": "6144:Ds9fGZDzJVXCkE/eWK+Ux+H/ZcxvcOzYYX67N8iBYlbU3zkrl:yfGVSkkeWK+UQHRcx/PiKiBYhQul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406576, "uuid": "95164a07-b725-473f-87ac-9ea491515ddf", "value": 256592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406576, "uuid": "99702e05-c587-4a63-827c-17526458c755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406576, "uuid": "d1a535f2-c6a9-4513-b36f-6c46158539d2", "value": "Packing-List_00930039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c69ffe-ca5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623379387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379387, "uuid": "87d5c7b2-dd06-46f3-ad47-c27d77795567", "comment": "Malware payload (Loki)", "value": "810e9eebba5cce5bf0d44cbb5e3b5a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379387, "uuid": "f328f0bf-b1ff-488d-b651-2af737864dae", "comment": "Malware payload (Loki)", "value": "cabcc377f00b0aa676d3139e7f14fa7881c5f25875d5218e25645db7e129992c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379387, "uuid": "df2eeb07-7a1f-4fae-bc4a-579d0c4c15f0", "comment": "Malware payload (Loki)", "value": "bf031ef4b6b87f9e0cb2c540745614fb914475d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623379387, "uuid": "ce0d1aed-8e60-48ef-8f14-a71b20b00007", "comment": "Malware payload (Loki)", "value": "c5a3317734f609cde1e293c3a75315e005b3e7b24f0b8ef042376b7fac1d9359a7799d06d93a971b58994b45091d6afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379387, "uuid": "d75e4458-8394-441d-92dc-228d08d1dda6", "value": "DCB40200AAF78D40D189D9B3E6E7E5700B21DE416421C717A2DDBF073A77B86B9806F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379387, "uuid": "f932b726-f484-49f5-973d-f95246a358ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379387, "uuid": "c5f59dcb-2723-4d17-96dc-056afb98506c", "value": "6144:oU8d4gIc7Kfu110u7iltbtCevbjyImDJVgAVR2PEiexnBRuNS4AQKk:od4tWKG1Gu7iTQezjBwn2axnB2/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623379387, "uuid": "a432c8f7-ebe3-4502-ac0a-fddb56301b6b", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623379387, "uuid": "5641159a-1730-4b2c-85b2-1887fedb7db8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623379387, "uuid": "2f80f310-f29c-45cb-931a-148b3a4a492d", "value": "Standard Chartered Bank.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645c3acb-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623394264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394264, "uuid": "a43db34c-492d-43bb-8f3b-3310a3347436", "comment": "Malware payload (DanaBot)", "value": "c11d26380053f927fd86743d41c87305", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394264, "uuid": "277f1de0-d285-4b87-b885-18aba642ba8d", "comment": "Malware payload (DanaBot)", "value": "cd59f70eea8a47b46a830960b6dec4113835b44364d404ee4cd1b750964233c2", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394264, "uuid": "9f9b1b4b-0fb7-4d07-9a69-d7397d495ecd", "comment": "Malware payload (DanaBot)", "value": "b05be4d91579ae0377b3f30f39ab9e106d4fa789", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394264, "uuid": "ddf425ee-ba8a-4df4-a4dd-dc8b6763e121", "comment": "Malware payload (DanaBot)", "value": "718a393f23de8bf150015296ea3ed95332ccacddedeb392d66188cdf0af59c196ede14a57a467fcbf647c05adf0abc82", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394264, "uuid": "e479cbd8-f1fb-49b5-800e-20433dc2afc2", "value": "145633107501C034F6F766B549BA833A693EBBA07B5821DF43D92AED4A752E0EE31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394264, "uuid": "213f35f1-1772-4f4b-8bcb-d94e9888e326", "value": "42c24f8afa9a3219ec8f6552ac1f6be3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394264, "uuid": "5a08caeb-e1ac-473d-901a-96c9a6b58c15", "value": "196608:eT+6gTp9/ZontXU16aabFp+9Dre1k/jjmG:eG1rotX7TBYJe1k/vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394264, "uuid": "c7c10dba-b1f1-40a3-9dea-b25897198681", "value": 6341632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394264, "uuid": "21134bea-fff3-498f-ad82-a8b2df23ac9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394264, "uuid": "a1510942-97cf-4abd-af7b-5fb432765261", "value": "c11d26380053f927fd86743d41c87305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3986e1-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427327, "uuid": "f4ee90bf-bb35-47b8-b221-92ee38ec37f2", "comment": "Malware payload", "value": "f91a464669473af94e24f38ef4afe423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427327, "uuid": "c99527d0-639a-4b57-88c6-507cea9e6a36", "comment": "Malware payload", "value": "ce01b30a5c2407e1ccdc93a3d7a858e49a61b2d2dcc1cc1d04815f1849cb4a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427327, "uuid": "94922d60-db30-4181-a405-2d0a64f77ec9", "comment": "Malware payload", "value": "1c9410fbe903c61796e71c6b99700a964ba92e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427327, "uuid": "e0c87edc-2afb-4675-af3b-f670b1af8566", "comment": "Malware payload", "value": "8277de55f1d7bcf398065db7db9fd7b18bf0c1b6e5acf4eeccfcb3d862a3225f4b4287fb760b738b6bb80952a251a5f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427327, "uuid": "eb5dc5fd-be26-40f7-bfce-6c0a45b17cc5", "value": "EE13E1BB220F1A79C73AEC390E6F03417DF10E31E598DD16D1A290BE4D641DA9893ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427327, "uuid": "39682d1e-3fb8-4c79-a362-62e5ffe10add", "value": "768:K9F6YFBsLmLJ3f/UYEOIKH6JRPmTOeqQjA3Vi8Cb7HVEJgGlzDpxYs4DOF:K/fsLmJ/U7KHyPeqo8yTOVrYSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427327, "uuid": "eeb45387-36d1-4f34-ba41-76e6c194a08e", "value": 44636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427327, "uuid": "7f1f161c-3b93-4911-8026-5d018a2df4de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427327, "uuid": "16479c1f-11d1-436d-9bc6-340adbebf281", "value": "f91a464669473af94e24f38ef4afe423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d1c7ee-ca79-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623391066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391066, "uuid": "32ea6e6e-1a0d-463e-a299-3354b77f540e", "comment": "Malware payload (AgentTesla)", "value": "95a7490c9178c4adda884a3c1c101f21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391066, "uuid": "478064f1-2ceb-4b43-adad-08fb0b2e60c7", "comment": "Malware payload (AgentTesla)", "value": "ce6635b0dac51b6cd810ba3232f2cadae9257c36daef19159b305b96497781c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391066, "uuid": "7ac05bba-19fa-4236-87b2-42d5560765f5", "comment": "Malware payload (AgentTesla)", "value": "7ba5c10b9debca94cbd2e21e4baa8bb8e258d528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391066, "uuid": "34f4b152-d80e-48a6-85fa-5dbc6fbf0ea3", "comment": "Malware payload (AgentTesla)", "value": "bc314a915366ebc5944ca81d332bcec5d0eb853e200741d89749b3faac35a1ddffa5ddb86719989e974ba2533eaea0e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391066, "uuid": "adf5d6da-67be-49b9-b9d7-f38568dae6f2", "value": "CC15337DC57D87CBCD7065D8FE11CE9D12A9AFA4028AA18E9D77C009573F4BAFA21021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391066, "uuid": "3625f231-151e-4272-a961-2df66507fcb2", "value": "24576:XuyQV76sjRAy607SLykC8N92UjpElIIYzc+7eFK/i:/c6yCy6ZLyW2UdElszx7EK/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391066, "uuid": "445fd539-f5df-4235-9ef3-98de95a9681f", "value": 889123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391066, "uuid": "6d9e93f0-70b9-474e-ab22-1d7f1b6e746b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391066, "uuid": "5c4e652f-3b6d-424f-a0ef-07bb44972622", "value": "KCTC International Ltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e3195c-cab4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623416279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416279, "uuid": "10c9b464-8627-4284-8fc7-49b5bec891a1", "comment": "Malware payload (NanoCore)", "value": "425f6b1e9437b1f1db352d1393d236d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416279, "uuid": "6801539b-d05c-4877-b64d-c0d063a6875f", "comment": "Malware payload (NanoCore)", "value": "cfb1e4b65fc8e0d9ca698ab5e67fc77735880b8439a6f4ee4e48be06ca631dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416279, "uuid": "41d829e9-c950-45d1-8147-7d40ceab15cb", "comment": "Malware payload (NanoCore)", "value": "65cf68fdda68b0327d51b7e3989afaa2258d4c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623416279, "uuid": "304b8cac-e9a3-4bef-b40b-bbc3fa99eb16", "comment": "Malware payload (NanoCore)", "value": "10b4276d7ff08dd85af39abe8f8a268b32f329c91279c187265dc8440af874618d9dbfa1173492ff147f23b59fdd41c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416279, "uuid": "3fc62e54-27d8-4140-a2b5-d4dd1c506f10", "value": "BDB4E0007BFA5B12E4736FF95AB461504FB978266811E68D0CD232DE0A73F449E52F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416279, "uuid": "605ad187-1047-4917-8762-c499235ebc62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416279, "uuid": "6d2a314b-5ccf-4dab-b001-7d25b8786b1e", "value": "12288:SwbjmMziWZrnoSSmaLBWIRqzPc/yt7ZX9HqUSagcq:q6jd9IcUyt7ZX5DSjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623416279, "uuid": "88d984ce-f3e5-4a22-8f02-f566948dd969", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623416279, "uuid": "b8c61270-88af-4ab0-bfe8-098f24475845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623416279, "uuid": "ded5ca2e-4de7-4088-896f-b9a2b2d3d654", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c79b66c-cade-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623434194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623434194, "uuid": "85b5acea-29e2-4089-bdaa-8fc9cc285b7b", "comment": "Malware payload (NanoCore)", "value": "4f777ac67c52be4d6a8b6f125bc94661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623434194, "uuid": "506f1b99-c2c9-4efc-80f1-3aa2eee51aaf", "comment": "Malware payload (NanoCore)", "value": "d112e19d34e88c040a70367143569c965cb48dbb1fa36579838c51f8ca9ebe7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623434194, "uuid": "705038e8-386b-4773-95e5-c49ab77ec2f2", "comment": "Malware payload (NanoCore)", "value": "f4fe647fa467ba0d039f9ca61bc18583734f7b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623434194, "uuid": "c7064e2c-e864-4b03-a020-2e32101de5fa", "comment": "Malware payload (NanoCore)", "value": "7eb9af43bf2345d9840b7b35b8fd64d6538fa92b415ef70c949807981c28c9aa96ebd2cb8219d9a276c4e07d9c765347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623434194, "uuid": "90141cae-d536-415e-b65e-ae3ddc1467a3", "value": "4214CF6537E4492FE3DE8678702242029379C2E398D3F3EE28D461B69F667E44A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623434194, "uuid": "cd24bde3-0dfc-41e1-aedf-83f05696a3cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623434194, "uuid": "6c6f477f-c226-43c9-82aa-ba7f6adb9e99", "value": "6144:MLV6Bta6dtJmakIM5A6fA+eXcTTacsRy3Cj+R:MLV6BtpmkxuA+eXsaDCUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623434194, "uuid": "21acf1f3-84bd-4c6e-8cb5-86acbce07e44", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623434194, "uuid": "6f7fdba0-443f-44a8-95df-4ff1394460b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623434194, "uuid": "560d3772-e84f-46ec-b818-41cbf267d105", "value": "4F777AC67C52BE4D6A8B6F125BC94661.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29c7940-ca9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623406422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406422, "uuid": "fe0be303-3386-4c57-b877-06cbc100fb09", "comment": "Malware payload (Formbook)", "value": "f161fe51fee0cd2f542ea759241c88cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406422, "uuid": "51926403-bde5-4ff7-bd5f-3cca75f45079", "comment": "Malware payload (Formbook)", "value": "d2d2d97ab2f2c78a230c58a61296504419d0b545c6c6d76193b654dfe9937499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406422, "uuid": "95e7895b-2e5f-4708-8e9f-d7dd6d6413b0", "comment": "Malware payload (Formbook)", "value": "cd75d9c5a293151ad50dfa1d05edb5871fc08ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406422, "uuid": "d315ec7e-6090-4b24-9c2a-4d96ed0ac1d0", "comment": "Malware payload (Formbook)", "value": "fb17aabc50e4f0a5c8d76354ffd160a040926b9d79322f3564e6bbf84c8f507d679d76096aebe49f9c9846b44be184a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406422, "uuid": "250d8a3a-3312-47b3-a0b7-8da4715f93fa", "value": "6034120F31D5D473C65209330E77EFA3F3BBA7452225050FEB944ED319A66A7AD0A18A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406422, "uuid": "71f38b63-01bd-4701-a26a-0337a7f0da55", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406422, "uuid": "bf4b43df-b9b2-4f25-bef0-b33deb9c9259", "value": "6144:Ds9X42rPo+wjZXJIl/tDiOnQeahYOaqMn6YaFjYJ6VJAl:yv0+wjZXI/tDZnQeahYgMoacJAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406422, "uuid": "996b72d5-1c9a-4d05-9551-2af3004c6a71", "value": 245867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406422, "uuid": "76f46460-88e2-4233-bc38-927d73838a03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406422, "uuid": "8c13ceae-6bcd-4bb4-ab8e-034b4e1ec8b7", "value": "444890321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5352d1e-ca97-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623403956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403956, "uuid": "bf05ad42-1036-4ae5-a40b-9a3f33705250", "comment": "Malware payload (SnakeKeylogger)", "value": "78b77bb40dde1d7c2922ee8288365e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403956, "uuid": "3f4ea861-ed4c-4caa-b52d-0935294841e7", "comment": "Malware payload (SnakeKeylogger)", "value": "d5b6e38e9f49fc345baf7b20c2ba7dae8fb24b99f45f30499244e54a52e532b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403956, "uuid": "b51809c9-70e5-4f92-ab64-45d9f2771fff", "comment": "Malware payload (SnakeKeylogger)", "value": "a2476c79e3f07b1d71c17b62c338cbd65977e519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623403956, "uuid": "e9212a80-61da-47e8-b1f0-c8764db1125b", "comment": "Malware payload (SnakeKeylogger)", "value": "6019b6b53d807d23c36e57014539b3c7843e0a56334b10192df5711259c511caa8da8e7f556854fb96176227bea3c5e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403956, "uuid": "852ac343-f08f-4a27-a49f-b2191f928213", "value": "71E4392439FB501AB173EFAA9BE475EADA2FB7733B07646D1050038A4713A81DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403956, "uuid": "3c9b46df-d5fe-434b-af8b-4195dc0b16ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403956, "uuid": "11da06aa-76f1-4ff4-8872-167d5deef061", "value": "12288:a+eqjDo0waYq9FIdeYOdDGLiACTvDsFdPbnS7ZmW682aeK9THXc1tm2ZDyW6OUgE:djqq2FdahseeNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623403956, "uuid": "3016c188-169c-4837-8a8b-672b67e07e7e", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623403956, "uuid": "e4a5041c-827d-4472-a607-66668dcb97f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623403956, "uuid": "048fe867-a0c7-41fb-b10b-6f75d2da4682", "value": "Request Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7eb3e6-ca7b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623391835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391835, "uuid": "d16beb52-cded-499f-a1c8-d739b0268e7b", "comment": "Malware payload (AgentTesla)", "value": "8b6ba294f57fe1a327fac73cd213d683", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391835, "uuid": "c8b41009-8d9a-4b5c-ba05-fe60f8d89d3d", "comment": "Malware payload (AgentTesla)", "value": "d5d9f2e4f7f3ae11e332177c422321926ea8e52875c7967a74397e7378ff3aad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391835, "uuid": "9e347d01-3161-4566-80f9-a263259d853f", "comment": "Malware payload (AgentTesla)", "value": "9dbcdbc4730dd0ce822fc2b214fc3bf02ecc6390", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391835, "uuid": "3bd7d5ce-8286-40c6-ae41-6c0bf830e2ea", "comment": "Malware payload (AgentTesla)", "value": "b78c6831bfa9163cfc83740f5634a343298b95ad96e97ea231a042daf5e1d618634d77490d600d180830519e7e87f48d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391835, "uuid": "78d0d721-e470-4087-bb76-416755abd202", "value": "3E9423498320364199DD16C992CFDD783F13381F91EE67E7A9326FE97AB43647C40898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391835, "uuid": "4fa4013c-abb3-4227-9f9d-779faf860d81", "value": "12288:XCcgY09JtbKnvwc6sAANeJa7ENk2yGlTlg7:XotJtbKPSI7UpHTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391835, "uuid": "d0e384f6-9bf8-4a52-90d4-65d02bf71eef", "value": 427821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391835, "uuid": "0903ef71-21bc-41ed-8607-dfa973e005c6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391835, "uuid": "98687fe2-de04-4fc5-ac05-c9778f9af188", "value": "Request For Quotation And Starting A new Businesss Relationship With Producestrade.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4658fa8f-caa6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623410105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410105, "uuid": "8432ba51-cdcd-487f-9620-b4a511821830", "comment": "Malware payload (Formbook)", "value": "ee1f4a07b874aa6ba18d6aa0f83252d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410105, "uuid": "fcf129f0-bdc0-4049-b2a4-c5a99cdf973c", "comment": "Malware payload (Formbook)", "value": "d66268222a39fd97e792983a3bacdb1e81067b7a28848a87fe65a5dc91f7e82a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410105, "uuid": "2cd76255-ccaf-425c-9f52-da7f844c27d4", "comment": "Malware payload (Formbook)", "value": "d17b97dc47707b685bc8976d3cbc6cdbfbd5fcee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410105, "uuid": "49c6edd4-b7de-479d-8b93-c5c098e9145d", "comment": "Malware payload (Formbook)", "value": "a0e571bb796b415b9673bdff4af7a9641ce5708b14760db49acf8edc4bde32dcbd98a2f66c774a51acfa8cbc937b7cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410105, "uuid": "dfc330c4-79ea-496a-9ed1-9854098cf45a", "value": "0534121736E29C9BD80A1671AEF29738D7F3E2606606124B53F80F7715262E3D8257D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410105, "uuid": "74923bc8-015a-4b6b-a7e3-9d041d92a472", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410105, "uuid": "63c28301-4d4b-4067-a3e6-9d7031fd771d", "value": "6144:Ds9u96cRH4eb7DCIKDDsd5iCRFX7yYjjqe1/w:yprebPlWDmDFL5lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410105, "uuid": "d7827705-6fe7-4c58-a162-6f4ca569492c", "value": 245880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410105, "uuid": "b3bfbf90-cd6a-44b0-822e-6423c84c8bd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410105, "uuid": "ae0a33ec-0929-4d1d-a7af-e6612e86bad9", "value": "SX365783909782021.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ab6923-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423627, "uuid": "3025e08b-fd8d-43dd-b75a-55e3a7262d48", "comment": "Malware payload", "value": "570692801ccb0598fee97dc5b35ff58a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423627, "uuid": "325e94cf-fe02-4876-a048-a82ce1a2729e", "comment": "Malware payload", "value": "d69902667c69600746f9a036801b3866d84494d079ddd586543b35e3f1c58bdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423627, "uuid": "d06ffb3a-7986-4f9c-8694-981d402f0f81", "comment": "Malware payload", "value": "e4bc0c0fcac467e7c9be36db36e7e9e00831ad07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423627, "uuid": "7ee3a6be-8f14-490c-adb1-62a27d18a60b", "comment": "Malware payload", "value": "3d0f3ba5590b2df05f0a21bed59c87045728ff9514cd696fe1bf7b710fc209988415711bf1d7120d7b4af043a0ed65db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423627, "uuid": "39165921-47c5-43a2-a885-b97210b9d8f1", "value": "70A32905F8118757C1D327B6F78F47493B3267B997DB33026A347EB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423627, "uuid": "88c90db2-0651-494b-bc6f-243ed2399b69", "value": "3072:cA5hJoRb5hbRRK63a2bxj0+rQ0Knm4XATe:N5kRb5hVRKDqj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423627, "uuid": "f0f019df-77b6-4d68-9131-8ee9ce62875f", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423627, "uuid": "4e2c9ac8-e8dd-439e-947e-f3de969effbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423627, "uuid": "cfb54bda-fc1b-4cf8-b61d-7be76f2e873a", "value": "570692801ccb0598fee97dc5b35ff58a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d2ac99-caae-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623413492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413492, "uuid": "d42428fa-fd02-46c9-8c15-e8d7b3473c69", "comment": "Malware payload (Loki)", "value": "4ee27e2cd3b06f68d5c71509c15ecb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413492, "uuid": "8df3f630-594d-40e4-82a7-4ceae2f3627c", "comment": "Malware payload (Loki)", "value": "d6cd76e56facc07bed5280255bb645c1a6aabc711fc92379963fde57adfdf124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413492, "uuid": "47f3bc6c-8170-45c5-ad6f-d3792a460a55", "comment": "Malware payload (Loki)", "value": "35fc50e2497e26d3c093288a940bce0638047cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413492, "uuid": "cfb44fc0-7b60-4e3d-a688-4fddaaf76be3", "comment": "Malware payload (Loki)", "value": "396055d22b0607096de6837e291f25269505f8645279568ae819ba18bbd7db75126fb4246e1dac5f6ed72a7e3a190d08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413492, "uuid": "079e7e90-4e37-46fb-979d-395faf128232", "value": "5C1569F166E047C7D79EDDF287CAB3848B6F46A231318212A85C22FC62DD29D25CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413492, "uuid": "8dc87984-8c7e-4827-956b-d4f6b4e33c75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413492, "uuid": "61dd66c2-b4fc-4588-9eaf-934d7312fd2a", "value": "12288:RJQ9a6sCoJkSxGXThxGaAuub+dgvwrp/0UvWVWmQJNE9VUqOZBHZM4e/ZUdtb:RJksCIkI0AExnEQnE9GFZxNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623413492, "uuid": "76ced55e-895e-41fb-bab7-f681b7015667", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623413492, "uuid": "16f5042f-4442-469c-83ce-342ca10c50a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413492, "uuid": "12e7d536-f9c3-4aae-bd6d-ac68749496b2", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8335830-ca9c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623406001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406001, "uuid": "031632fc-1f40-4b4a-bcb8-16e0285d4953", "comment": "Malware payload", "value": "631585c813686625248d1108f84b8519", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406001, "uuid": "f0d0b213-8ec5-451a-997f-7d425d1c95fd", "comment": "Malware payload", "value": "d8567a9f7bc749ac4eda0741e4192ddae430457441e3b1b5bd40b5c8324d48a3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406001, "uuid": "5c4865b0-698d-4298-9940-48674d65aeb3", "comment": "Malware payload", "value": "221da82bef4d84c8f767f660a1a50b40a40fe166", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623406001, "uuid": "27301dca-b4da-4228-b3bc-4d9c334300c1", "comment": "Malware payload", "value": "1cfab2e33100efc9b88ce47c22d0778b8ecf744ee031126a04a503d018683a32c6d5068b07467d172ef24a3e0acbc233", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406001, "uuid": "4a4c859c-8357-44a8-b497-3b4d9ce65ebe", "value": "7A53F15BF67A3454C763ECBEA86804E8F80D71452C41BC5E2E64B14B8D89BCB13BF258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406001, "uuid": "ee91f0df-9da3-4aae-99d5-e80f8047f0c8", "value": "1536:2MTMXwc5jlMVGoIahaDHTU6hryF70liWWGH0AeWca:2MTi5j2sTU2yF70liWW20Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623406001, "uuid": "5de42ea0-3a51-4136-8645-2679d0650dbf", "value": 63444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623406001, "uuid": "84508465-280e-44bf-833d-e497dd8e4bea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623406001, "uuid": "16feac7f-9cad-4314-93c1-10df0289b6c8", "value": "pmnt_spec_031624191.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95031cdc-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423552, "uuid": "7f516fb8-d020-4946-80bc-ae4392663da6", "comment": "Malware payload", "value": "fa7296f33b3a4c3e375a6a6210cc03b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423552, "uuid": "6d3dd3bf-6152-421a-a2f6-1b777d0ed6de", "comment": "Malware payload", "value": "d862fcb7f75681b6891ffc5dbc91d133304bf3e24778d2806d860e6fab00e5d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423552, "uuid": "23108993-94e6-469a-98f6-fab91072bf44", "comment": "Malware payload", "value": "9dfc182f0d6f6c234317296c1386fe218e4a3f3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423552, "uuid": "c91e2ac6-9b79-4283-9588-0337230efe21", "comment": "Malware payload", "value": "60ba3a9604949590a067e17844132add44359bdb345946d028f35043bd10196a6f8f91ea8ee5a2e04220284884cda231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423552, "uuid": "a745dc6c-1955-4ad7-959b-987a86e22dd9", "value": "C8F23B13A4D080FDE487C274973FD51BDA32FCA85224761E5B957EA52F36E315B0A282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423552, "uuid": "02bd01a5-b48d-4c69-b5a0-bcba36902e9f", "value": "384:cDMaNhrw200SAP0jxtEcH4N/AiS05uDA6ZeNhxYipygPh9B41q/gSzFcWdIBESyN:cDdm20zAc7EQG8U6kP5d/gSu8SzkKxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423552, "uuid": "08c6eb26-ccce-4334-935b-437ab67e6d48", "value": 37648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423552, "uuid": "3c57a4ba-bff9-47fa-b7d1-7017eb17683e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423552, "uuid": "813c51f0-065a-4680-9059-66dd7cdbcb86", "value": "fa7296f33b3a4c3e375a6a6210cc03b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72b120e-ca76-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623389759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389759, "uuid": "7df48177-c4f9-4ea7-a4f2-007f83c73436", "comment": "Malware payload (Formbook)", "value": "e5aaa3f2879244a0b44b27ce151e0c29", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389759, "uuid": "578ea83b-50e7-4358-971e-34fd53266581", "comment": "Malware payload (Formbook)", "value": "d9aa9baf5698eebd324bf2d501d72a62ce6973eeb42a7dce961d0e65baaad67f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389759, "uuid": "9d59e831-7364-4b81-9f42-260fdb4e1c0f", "comment": "Malware payload (Formbook)", "value": "eb0608507f6aa9432f276ab6fcaeddc7439bf169", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623389759, "uuid": "25e87c67-62ee-40d8-a829-758558859547", "comment": "Malware payload (Formbook)", "value": "42a2e0eb4997e561c4093d44cf857605f2060ff32caab3bbbfdfd8d3761bf05f14c4684e7ea4bfb6b1466250edad80b5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389759, "uuid": "7a091c37-898b-4d67-ad36-5bdb3229828d", "value": "4E55232078CA6F2BF84E91B4559BCAF651B4BC09CE04E786FB0C377A34317661D8266D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389759, "uuid": "2238d56f-57b6-41ae-a0ad-001faad8df84", "value": "24576:8aqT3NL8qo597tcvl4LXOETHVhwfhV2PpqTOwyc/cxzHbk/u:Y2z97t/THVO/2huyfx38u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623389759, "uuid": "27f76bd9-26fd-4d06-b599-1a4dffc9aac9", "value": 1308600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623389759, "uuid": "241e1e85-2fa4-43cf-980b-71ebb70499e0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623389759, "uuid": "8f2256a3-cbee-4d03-9a26-5003184827ec", "value": "L2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54823fe9-ca9c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623405834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405834, "uuid": "1b30a369-01c0-4fb1-88c4-76a1023557d2", "comment": "Malware payload", "value": "1ac719c744d22f42e4978e7b55828435", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405834, "uuid": "0004bdf8-42fe-4306-8f96-f7393bbc3c09", "comment": "Malware payload", "value": "d9be275feff4b3383821b1483ba93424fb27aa40e138da41a91511193d9538cb", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405834, "uuid": "4c4b2166-ea23-4de6-bf68-bbdfae46edb7", "comment": "Malware payload", "value": "4ddc7358f615987bf92ed9192430693db65b097c", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623405834, "uuid": "992b990a-b721-465d-8414-c4f4af790bb0", "comment": "Malware payload", "value": "fd3e7fe986155d6c6e4da268f8409353d9208eaf78334cb28cb19daa9e0f759df02a57f27d273e7e5496f02311eb54f1", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "JSSLoader", "colour": "#84A318", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405834, "uuid": "09e263d2-812c-4e47-8f0a-6f8bcefcff12", "value": "C1A4128096988020DBDFDFF4D6C95932CB45AC5B2D38D1AD5B2791F122B52EFC0E6E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405834, "uuid": "47533b60-f2d5-48b4-a96f-cad47a280d80", "value": "12288:ag+iWCVTHlJFnI6TDEeTSH/NJDjXcXdeanuxZ2:4iVVTHxNcoSJDK1nuxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623405834, "uuid": "d8769f59-e021-4adf-bf89-0fce7ea4d592", "value": 468533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623405834, "uuid": "2106852d-f8d8-443a-b162-524a29ab14d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623405834, "uuid": "2dd867ae-7752-4a83-a689-c80510ddcda5", "value": "d9be275feff4b3383821b1483ba93424fb27aa40e138da41a91511193d9538cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d91a7fb-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427270, "uuid": "631f37a6-90db-49ba-9ec4-2dce5b22b41c", "comment": "Malware payload (Mirai)", "value": "d44fe31975925d51f24c7f5d933534e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427270, "uuid": "beed1c08-3a5e-47e0-bdbe-ec9d1983907e", "comment": "Malware payload (Mirai)", "value": "dae1f7cca0a081ce73f859fa63f4c29e21a03c371d7ae0788c49bdb6ea1b41e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427270, "uuid": "b6efb646-fde2-413c-9b8e-25678cb67bf2", "comment": "Malware payload (Mirai)", "value": "0476beedb1701763cee2c88681d2b58a188b69ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427270, "uuid": "171c2361-fdb6-47ca-8570-3b54b298b2ea", "comment": "Malware payload (Mirai)", "value": "0d933ab7340e0a75ca11bfdc50f2b2664490b283ac42644e9b7e9678caca5a47e0a3b0d088a222165c87dad0537828da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427270, "uuid": "7f4f9572-6e11-48ba-99e2-8a099644ba19", "value": "1F82C0206686ED20D7740C3FEE29D2867A4509F9C4BB31761526075C63CE85BB5FE2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427270, "uuid": "34c3146c-7dae-4031-8577-3703c76757fe", "value": "384:MalsnVtcymMJ3DfUiq6jsbNqR7PyhsB/uUDeIhymdGUop5hKIe:Hl4Vo2Uz+sbAehsVuYPs3UozYIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427270, "uuid": "c872f826-77ab-441c-9c21-d02eb519edf8", "value": 17620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427270, "uuid": "d12b39a4-a7e0-4019-930b-4b2bf97c44b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427270, "uuid": "93366fb2-0437-4cc2-9231-0ec59c088263", "value": "d44fe31975925d51f24c7f5d933534e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b3afcf-cad8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623431477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623431477, "uuid": "1f9afee0-a59c-4b0d-8577-2aa0b740cc36", "comment": "Malware payload (RedLineStealer)", "value": "c3ec09575c868da7d6ec756f3bb53eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623431477, "uuid": "c8338426-77df-4789-b340-63c8f70f47f3", "comment": "Malware payload (RedLineStealer)", "value": "db6ea7c28cf52dc010de1c2a01f77f784248df0f6936ded3c0d1272b178470ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623431477, "uuid": "16465399-97e7-45ea-8a62-90b9dbc0830b", "comment": "Malware payload (RedLineStealer)", "value": "81582f403a649200971ed1ac5d681928cd98f7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623431477, "uuid": "fbe4c4b8-c908-480b-b8cf-43611416935f", "comment": "Malware payload (RedLineStealer)", "value": "73b451038835d604bc5fdee2025a5dc84af51d632daff6e424799dc2d4a5a68d71a47dfd835c45f48de35397d112e730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623431477, "uuid": "e52a7859-5c48-450f-a2b1-4ede44000491", "value": "3794F84A7A85AA06C3AC157284DF70685370FD479B63E3263DAC73BC197336A89C61DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623431477, "uuid": "74a61d76-697a-4187-8a96-ef3a9179c805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623431477, "uuid": "daeebf41-2ece-4b6a-9382-57b669c778f0", "value": "6144:OUp4WnCIDnD7fehZ2guEgotEbkd123G3k93ogVd/5FCYYkyB:OUp40zkuEIogPrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623431477, "uuid": "5629cfb1-9748-4660-8a64-85c0f0268b33", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623431477, "uuid": "1a4e5624-a3c7-4371-918f-995fcd6ca86f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623431477, "uuid": "2d785f4c-341f-4df6-a38d-3d8eade497ab", "value": "August.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b4910a-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427284, "uuid": "41f98d38-c916-4ecc-ad37-39f23e545904", "comment": "Malware payload", "value": "1a19ec37d1acbade79bec6ef7e43e68b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427284, "uuid": "d201052e-0b1a-4d43-bb8a-cc5c9d187881", "comment": "Malware payload", "value": "dc0e0cea46759b19b074580dcc545bec7ea04931a5d0ce11f7c47ae4ab73bec0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427284, "uuid": "eba29466-e382-4204-9d43-bd66ecc4d868", "comment": "Malware payload", "value": "b5f8bba58b3352c9463e7b20c6b90027a848e62d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427284, "uuid": "d1005910-8957-4ba8-8334-f83c24868b96", "comment": "Malware payload", "value": "8288dda848a21d6d10c23125e9fc5f63220fa638a1a521898fcc4675f7b086a67e72be7f1ef5e9822f24454686ea0590", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427284, "uuid": "e021d2a0-fe4c-4073-b565-26edeb5361e8", "value": "4013F13DC8D0ACC3CE7FAE36546C27A36C4BA5C867A887CED7154650463D94EB28F820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427284, "uuid": "d0b9fd54-035c-4471-bb12-b21c2dc4a53d", "value": "768:RSsyr/7D90zAW8sXq99zumYAcvrxPcxbJMNumaevqDPo3SaWRst+YDIoLcIZ62CE:LyDy1a9FYAczxPsdMTaevqDStvlLcoCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427284, "uuid": "1e2b1658-5d7a-471f-8c86-df610d491229", "value": 45192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427284, "uuid": "807e587e-5290-4af9-a43c-c52f66087cdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427284, "uuid": "447c43c7-a6ef-41d0-b1b6-68f86abd720a", "value": "1a19ec37d1acbade79bec6ef7e43e68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b7362e-cac4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623422956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422956, "uuid": "e076a6bb-158e-4101-91bf-9d418bd906c8", "comment": "Malware payload", "value": "19d88091245e63bd2ee7072470f86f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422956, "uuid": "7ac03e3d-03e0-4238-be46-a6018086b452", "comment": "Malware payload", "value": "dc1a540149dffb968cc641f1770ffb45aaa29f23cd5e19483c474a71cc1737da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422956, "uuid": "4e601d82-3df7-44a8-a79b-d102db7fbe60", "comment": "Malware payload", "value": "ba5caef336c850805e6cbf4a4460e02543af64a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422956, "uuid": "bffa3f4a-c554-4f43-8eab-7ae8c9c2567b", "comment": "Malware payload", "value": "78b7b54c8490ea5a2cf62af47fa59dce3fc344440e0e7eea92b57230c2718db78cfef0cb6fe5ba43e607467de370b2f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422956, "uuid": "1dde0229-3eb8-4e76-b96c-fe231c4099da", "value": "B3854921F94DD700F19502368C5B95644FA8EF0F29D28B1E66DB326BE521332793EC9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422956, "uuid": "6a2a1145-c67b-46f9-8558-62511d49b7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422956, "uuid": "b5f989d7-9b7a-43c6-9d50-c7a832b39b6b", "value": "24576:fVdy7gGIS8Kr5kRNeBUdteYEjrsMoe/z8YEorg5LlJfHkRIrOENH+UF58zMIDsxc:fr3xwBUeYEjrsMoe5qBldsrG+Ukoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422956, "uuid": "1b428698-e4e4-41f9-8da8-ed8e8c2331c0", "value": 1753088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422956, "uuid": "405a04c4-4f94-466d-9fbe-3139c2032a2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422956, "uuid": "cf4169e4-648c-455a-83f3-29df423ec2c6", "value": "19d88091245e63bd2ee7072470f86f36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bde846-cacc-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623426695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426695, "uuid": "60b77825-c971-4fdf-acb4-3a6bcc56114f", "comment": "Malware payload (CryptBot)", "value": "a5822b37c457ca7297882416c5886950", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426695, "uuid": "65f7fa46-0e81-470f-9c06-a216ca1c8f9c", "comment": "Malware payload (CryptBot)", "value": "dc9a788eba514e94238688f1e3ee7bdf2f1b930b9ad5df576e23f23cd35deae1", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426695, "uuid": "fe96f7e7-3d5a-499e-84f6-5c5522041ec6", "comment": "Malware payload (CryptBot)", "value": "446aef17de81557319d4048889e6a4eff094ca88", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426695, "uuid": "6d067f54-3852-4bd3-8a21-fadd81610202", "comment": "Malware payload (CryptBot)", "value": "da9fe20cb36d3315c363ec16673934cf664f08246576d317e552c24a7afd4cf965987ffd3979f810c5ee00e5545ca701", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426695, "uuid": "590b4b55-78bf-4a84-98ae-dcc36f3d9021", "value": "5085231177D598BFF3F215375C846FE99374DA650B22898B0B840E0D6E66EC9C23E247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426695, "uuid": "867a7dac-3337-466d-8f4f-ced48caa8c64", "value": "9e33e06d1ed61830570000fb83db911b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426695, "uuid": "8b80eda3-5a2e-4521-89ce-638294745b25", "value": "49152:hdMFNyFOUHVc8FSS7Vpnw1nkmj+t47J3KO:hd+NyFfVc8FSiFw1kRtuJ3KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426695, "uuid": "010cddbd-7eca-4571-a3a1-343ab6d32269", "value": 1707293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426695, "uuid": "3e03a2c3-550e-44b1-ad09-1a5373786173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426695, "uuid": "420a9049-745d-4ccb-a1f8-fda2f1358155", "value": "a5822b37c457ca7297882416c5886950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5a03cf-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623394276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394276, "uuid": "c5291b1f-229f-47a2-9a86-a87697f6d4b6", "comment": "Malware payload", "value": "4648cc7de0140cd744b5dbd7b0d1b8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394276, "uuid": "9cd14aaf-244a-4dbd-a622-9943e227e2e8", "comment": "Malware payload", "value": "dd4e2d7144502ffe5929e14082d7020928c8e5f50384cf48de3a6df958d0d73d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394276, "uuid": "e7cd124b-a74f-4b74-a717-06c1adc42652", "comment": "Malware payload", "value": "7d808cb8714f9432da94e3b9899645946dd5ff9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394276, "uuid": "70e83740-1150-4715-8f01-a411cb4f4939", "comment": "Malware payload", "value": "697824bdac434aa668f1c394c5b9de115076259d628a6eb08510b24f60c4afda9598eb68954983247156678eaf5f42e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394276, "uuid": "c3b4461b-6eaa-4a8a-829a-eec207734f1a", "value": "2642FA35A96181B2E9693436C4783BB48E2EC61107B49FC7DB5C0D357F707C26A362AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394276, "uuid": "5c6298df-9ed3-478e-945b-0304b1a70a5d", "value": "192:uC026hreEb711xmluCzk827FQmS9jYkEUgg6l9GlrXKyxhyU:jwhreEP1XlCz1AF/SakEUeGlr3xhyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394276, "uuid": "80b01f13-a8a9-4dcd-a6dc-3e56749049c4", "value": 12394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394276, "uuid": "3aebac14-5383-4fd5-aeea-4d9609ca4c61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394276, "uuid": "6b697c74-6546-43ff-990c-a10a4c441085", "value": "4648cc7de0140cd744b5dbd7b0d1b8ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7ee91c-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623394417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394417, "uuid": "2d9adfb8-a510-4cfd-8b24-4767e5438826", "comment": "Malware payload (Gafgyt)", "value": "338622b29d955574a1bd73d9d9650dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394417, "uuid": "c9a7a490-6bae-4c1e-a95d-4fd034ee8799", "comment": "Malware payload (Gafgyt)", "value": "ddc81ce9be123ce5668487e509b9d2c5fd2c4418ab27746a6769171fb4983f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394417, "uuid": "bf8ff814-e08e-4e13-b188-495fe4bf63a5", "comment": "Malware payload (Gafgyt)", "value": "9d9750e645b82bec1f224bf53a974e1d9e48b690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394417, "uuid": "9f8b4ff5-72b8-4716-87d9-f6f03369a72b", "comment": "Malware payload (Gafgyt)", "value": "eb27366c62d3e776f4a1ab62ecc64c4302c5240a7d5f3ca381579d7935e7a9f296bd9d3dcd3642ddf496d658822b9975", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394417, "uuid": "6a9d4034-bc4c-4d18-8fc9-68a41aa7f0b6", "value": "F4B3842A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394417, "uuid": "40fac43b-259b-413d-a78b-6491457f2065", "value": "1536:27ju1Thpq+XvYC2rKy3eY5PGEEeRYYI+8vECRIKmbaUmkiSFxfC7xbXe:RvYJPGEu/+F8IKmuUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394417, "uuid": "986dcc73-a364-4803-8760-e8822c19d3aa", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394417, "uuid": "7a89c0be-127e-4b81-85e3-31adc31273b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394417, "uuid": "9d0469ed-3837-468a-b165-4de7521e14df", "value": "338622b29d955574a1bd73d9d9650dbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5ec032-cacb-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1623426064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426064, "uuid": "0426826b-cc88-407b-ae92-c756d52b6dc5", "comment": "Malware payload (QuasarRAT)", "value": "0349d15dd557355e2ebd5ce6e0032946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426064, "uuid": "5fe4a118-b523-4e5d-95fa-bcd970615fb5", "comment": "Malware payload (QuasarRAT)", "value": "df8d26f897c26aa4051e4ed01b4b747a3cd0db41d1818726ea63fabfef008a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426064, "uuid": "ae42d505-6612-4ed6-a777-a29944a6edfb", "comment": "Malware payload (QuasarRAT)", "value": "b239a332a29817afafa1a9ec31e7f0426e9f1048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426064, "uuid": "a80edc8f-e82d-468c-a79f-f89f3450d6d0", "comment": "Malware payload (QuasarRAT)", "value": "771fdc107e1405d9b42f5b8777479f94fb5090ba7467c8939bda362f2d79b106c1acede0ea251e569f9919b3edaa69a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426064, "uuid": "8b841d48-4d0f-406c-ab20-b401b5c335bc", "value": "9D55334AAAD8D0D9F789C5F2255AE9A3C1F86FA3AFCFCC7601CF924476D914613018D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426064, "uuid": "78d08a7f-f6a3-4e58-a01f-9fd85d2edd16", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426064, "uuid": "b77c33a5-767d-431f-a4b4-af58cd2873c9", "value": "24576:wyU7UvkIVMT5YeDDpAgRLKf6eg6ZkivFxgTSFaZ+QemQEU3FnK+O8:wfwvkxFDDpAgRxB+kUFa2FaZ+Q3Quq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426064, "uuid": "676bfe6d-a914-476f-80d9-24606e9113ac", "value": 1305616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426064, "uuid": "b058f540-2600-4cea-9f45-d98b325f99de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426064, "uuid": "2d16b88a-28ee-4959-bf10-5428c36cc626", "value": "svchost_PROTECTED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555ef17d-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427310, "uuid": "6371d02b-bd35-4142-8773-fd7f2389ba8c", "comment": "Malware payload (Mirai)", "value": "b67257c1593e166d82428c167fec3475", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427310, "uuid": "e95a39e6-05b5-431a-8d54-6390f313c777", "comment": "Malware payload (Mirai)", "value": "dff4f060583da45fee42a6ada0cedb83fbde6c1daed0d6737d4272379bfd1c96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427310, "uuid": "d0ea6534-d32b-4386-8531-63f2314e343e", "comment": "Malware payload (Mirai)", "value": "34074aa3ca72ac2991acdaa652dead724a14cc62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427310, "uuid": "7a269d3a-4997-4af4-a5c2-8e33f35fd896", "comment": "Malware payload (Mirai)", "value": "bd1be1fb34aabb21bb9e90701f9d9dbecbb9651eefbb231fcc5c382c729e85a14ba120d34b84cae08ae70ae5224391f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427310, "uuid": "e6779d38-f389-4f77-a909-e3b27fd9d84e", "value": "B7134A21B93A2E17C0D4E87A62F74769B2F5165F25A8CA5E3D730E4EFF20940A5036F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427310, "uuid": "6d69844f-3895-48b9-a90b-ec8ecdd1e074", "value": "768:6roDwQ+q9ygI98x6nbdWoaqLY8lHWO+6mtp:6rQwQ+Syt98snxWoaqF0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427310, "uuid": "466119ef-69ab-469c-8a2b-7ef401adb619", "value": 45476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427310, "uuid": "70a2b603-c283-4dca-8065-15d64ed5b0ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427310, "uuid": "da50b1d9-4c17-4737-8c0c-9498b2da4334", "value": "b67257c1593e166d82428c167fec3475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a6c805-cacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623425920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425920, "uuid": "e645cc20-499c-4378-b9fd-78a94886c6e4", "comment": "Malware payload (Loki)", "value": "f91a59d752971b133ff68b550ff847fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425920, "uuid": "2fb4aa7d-7289-4b74-ab59-4b389ae50be5", "comment": "Malware payload (Loki)", "value": "e0a6f7200b615f3fab572c73070defb075a6d3bad9d7ee50373ea65c8a54bc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425920, "uuid": "1e8125d3-ce27-40f9-a631-fcbe18a381db", "comment": "Malware payload (Loki)", "value": "5b827e4c8fbf851dde9b9fc486aadce5abfea236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425920, "uuid": "23bfc68a-f25c-471c-8911-7f39b0cc6bbe", "comment": "Malware payload (Loki)", "value": "f2ea835f7cc2699a1901f455fb3f2c90caad3589cc396746a780b3fa14c60a2c582ba9837328124d5ded9967c6eaa87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425920, "uuid": "8c4d0b33-7848-4178-b946-7b566f017137", "value": "3CE4E03156488A54E17F933590B1520443F4F807D722EA4CFEE858D92EB27C2E7AFA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425920, "uuid": "8ed94735-6db5-48a3-8b8f-93e573538784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425920, "uuid": "21ecdbc9-f970-45e9-b82e-67e9f7d418b4", "value": "12288:47hQ15tDPvH/iFi7KxZlMV40JZh7o/z45i0WbgfzaGvR574mUlbP2qhS:44V2xZUBw45zR2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425920, "uuid": "4792559c-007c-4d17-8109-5da8c8baf8e9", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425920, "uuid": "1767f5e8-75bf-44bd-adca-488405724522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425920, "uuid": "c3a693db-3fbc-433f-a5ad-d56a14f7efa5", "value": "f91a59d752971b133ff68b550ff847fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8410e76b-cabe-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623420517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623420517, "uuid": "ad9dce5c-bba4-4d6d-b2c3-6946578b735a", "comment": "Malware payload (NanoCore)", "value": "416ccd703aff8844f0454e112f663c06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623420517, "uuid": "16eba936-b066-4193-a6cd-0207a1b9b424", "comment": "Malware payload (NanoCore)", "value": "e1b2ca52707d724682e2c2618eb33899b019e8650e325e800e43e2042231f55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623420517, "uuid": "c2985a82-6525-4f7a-b205-03fa7646894d", "comment": "Malware payload (NanoCore)", "value": "1db05b7beda1a9e4fb0c4cd8e04c512c98efdf3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623420517, "uuid": "ac60ea9c-7a99-42dd-a9ce-4430b62d7f97", "comment": "Malware payload (NanoCore)", "value": "3d33a5bc2d17c1836e9af54bd79a9153f6eb00ab839f140e073d5b31355cd56d578385bcd8091cc3cd3241e90a1c447e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623420517, "uuid": "80e488dd-c64d-4b05-90a4-08c1807ab6d0", "value": "69F4DF3E7358BFA9C05F09768827884C53E39D236D31F3DE68E42EE47921A164A1F54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623420517, "uuid": "ccbf0a6c-c8e2-4935-ac41-5bbf93becb26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623420517, "uuid": "c1bdd6a6-4292-455c-b334-925caa7786d9", "value": "12288:RjMA4cScHfc4eucIV7B+Aci98+WrWwYPF+h3HjsrGAUyE:RjEkfDxcc7Bud6fPFUz4GlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623420517, "uuid": "c0f7b298-5dc9-4585-b5bf-83e06a5f6d3b", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623420517, "uuid": "5d8b57bf-cd38-4080-8f82-f2702c77435f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623420517, "uuid": "65413d16-064b-49e1-85e5-1e8904a7a918", "value": "OUTSTANDING INVOICE.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5925a753-caa7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623410566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410566, "uuid": "450899a1-2a23-4bdc-9a0b-8d3633bee43e", "comment": "Malware payload (AgentTesla)", "value": "8ea3cb0d331f0a8414e5b2ecfce3abf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410566, "uuid": "daefbb5a-c5f2-45c5-b2e9-377cba8db08b", "comment": "Malware payload (AgentTesla)", "value": "e2b3c7e7061e68aa31813371c589b7b0b11b12750fab1ce87f5ea7cca9740563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410566, "uuid": "dccd9334-3854-4cc6-81a6-b7959076f8d3", "comment": "Malware payload (AgentTesla)", "value": "4c690653287b4b783b46ec4991d71d81ca527dbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623410566, "uuid": "4a195fea-7cad-4fb9-880c-3f05919375fa", "comment": "Malware payload (AgentTesla)", "value": "f624abb2e5a4256b761cc2bcdbfd145ba05fe8e803d9a837b5627675ef461e626805794cfd95154e95cb36d91dbcc1e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410566, "uuid": "f4f705dd-9bc7-49f5-b1df-958916e3a657", "value": "70350898315075DFC463DDB38AA85C60EA60387B831FC20BA11316AE9A4DB87DF156F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410566, "uuid": "38216170-491d-4ae5-af67-1a830c333064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410566, "uuid": "c4a29625-fd71-47de-a1a3-102a4696258b", "value": "24576:+Dv3KLaq4zaohfxhbyoHsCCRKumxfrvvdH0:2v3e34O+5pxsxRKumxfrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623410566, "uuid": "0e2d5cbe-c464-4bfd-ad68-84b8af43d83f", "value": 1129472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623410566, "uuid": "a4bfc553-b822-44ae-8902-160ab4681eec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623410566, "uuid": "3267024b-edb6-4bd2-9aa0-9e5f717016c3", "value": "HT210525 IV Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983621b-ca88-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623397118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397118, "uuid": "281cf3ad-cfb2-400d-9c51-f53b9af515ad", "comment": "Malware payload (Gafgyt)", "value": "e2425fd1b408d2d7d21b853dae3dc473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397118, "uuid": "2287e942-24b0-437d-91cc-67f7843f0740", "comment": "Malware payload (Gafgyt)", "value": "e4dc7045d48895975ac08c8fb5bf5946fd689c63717345aba98d4458bb63b260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397118, "uuid": "bb1a14ae-7576-42be-8276-9e5839f76939", "comment": "Malware payload (Gafgyt)", "value": "6f5c41eddb00969dbd8393d85bed0b6aacaa37a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623397118, "uuid": "193e8ff9-e668-4a7c-b935-a218aa7b3b29", "comment": "Malware payload (Gafgyt)", "value": "ecd107e5443fec70e6e710513fe204c08893ac404c3c1cd4dd1010ef54f7d05d7cea7cf7ff12a0ff7ce75d95d5d5ab00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397118, "uuid": "4818510b-f850-4623-bb4a-9ad5632c5e0d", "value": "21D32A05D9408B23C6D2277AF7AF828E77236B6897CB33115628AEF42FC179D1E39550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397118, "uuid": "c552a563-1273-41fe-a9d8-cfdd7bbb9fec", "value": "3072:jGf9Lmdzp0eQAQ8AyEnaBmmWA2vvjhfB45hVLvFq8URiA7xErmy/QsYJ0Yj/:PQnaBmmqf65hVLvFqv7xOmy/QsYJ0Yj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623397118, "uuid": "692a71a8-8746-4bd6-b287-eb228d8e0105", "value": 130477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623397118, "uuid": "5f51b895-834a-4695-bfdc-698eff29fe5b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623397118, "uuid": "e830e12f-be37-4da7-905e-7176a317cf39", "value": "e2425fd1b408d2d7d21b853dae3dc473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664df25b-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426909, "uuid": "363287f8-5d02-4238-a2a0-6c0c63bbedc6", "comment": "Malware payload (Mirai)", "value": "d63358a99b41f42ab3888c86e3351101", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426909, "uuid": "4431d114-01c2-4c5f-878f-113c2c26b8d2", "comment": "Malware payload (Mirai)", "value": "e5570ada3094d11453e55feeb51f6e0f4f29e8d67abfb075ee470b4ae62c29d1", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426909, "uuid": "f2fd9535-e5b8-4afc-980a-4fbb46dd5df9", "comment": "Malware payload (Mirai)", "value": "4bfce2485e4de72a0c6ba9bb737ee0cd47b9e5b5", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426909, "uuid": "0c90b666-164f-4fb7-ad18-fc5dcf4b6d95", "comment": "Malware payload (Mirai)", "value": "3f84021fe98024b76a43eec282c6f11dfa73070613f21cc0c3fe6d74feec4c19a009f04ea72c70177d9c5f5ce7745603", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426909, "uuid": "4baa7be2-cebc-4d39-a759-e2be5c0078f8", "value": "9623F11BC31E50BAEB615023A2350A4F2C060FD8A5EF77B5151D584CA96B477CEEE1E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426909, "uuid": "f2fdcd8a-2a93-4205-95c2-d8c2e9000c93", "value": "768:cIw60PJ72Nf6AYgoib1ckFLJ/NXndACYOopQSn2xWUcui9q3UEL8TYAcSBj80cGV:cIwJws5goi35ZjSnyWwLjAtNMJ9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426909, "uuid": "fb0615fd-a2ac-4266-acf5-7dbad33c7eb8", "value": 46748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426909, "uuid": "82bdf690-c4cc-4b3b-9d12-dfababc662aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426909, "uuid": "f99d8307-aa91-418e-8ad6-1c6d784769d9", "value": "d63358a99b41f42ab3888c86e3351101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed33e93d-cae3-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623436585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623436585, "uuid": "ff459ee7-3725-49f7-bba4-2281c36b7df4", "comment": "Malware payload (BitRAT)", "value": "34ce7980061a2c31f2750844e5f72aa4", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623436585, "uuid": "758dfbcd-b367-42f3-ac09-5128ab216771", "comment": "Malware payload (BitRAT)", "value": "e5aea3844b9f8f3811b6c3e3ff58e84793806b58da0064743235b7c6e476e624", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623436585, "uuid": "9bb0fdbc-7dc7-4233-b01f-b7e696b2ef12", "comment": "Malware payload (BitRAT)", "value": "24c5be8edba96615b035519999615f48ed4e4f32", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623436585, "uuid": "59274bec-e8b3-4329-bad6-2fed98f315b2", "comment": "Malware payload (BitRAT)", "value": "acb726a1347965bd56d37f014d39a49184769dbae9cd72024c5b6177221c954ada3c1e9e7b1199406bcc324e70e1e984", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623436585, "uuid": "f0cc0806-a59b-40d7-a120-0c99fb31471c", "value": "7DB512027280CF61D55F10BAC8A792F45723BF02EC455BDBB6C9FF1A38B32AA5951583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623436585, "uuid": "9d76b7a6-f150-4ab6-ac8a-a3be93d38ca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623436585, "uuid": "32a26580-faab-4633-90de-8225fa12340c", "value": "49152:+x2/6j7qObdtbI6ry5tdB6h5uLX8F51qNsPSYiW:+x2U7qObdtEIqdBI5fnJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623436585, "uuid": "c71b6835-4373-43af-86ea-71cf701acf58", "value": 2395136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623436585, "uuid": "7a2f9d47-a2dd-4745-9c19-78eecb5cbe43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623436585, "uuid": "95f4503d-b50f-486f-b392-aa2194e4260d", "value": "34CE7980061A2C31F2750844E5F72AA4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e7d7ce-cac3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623422728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422728, "uuid": "f7783c0e-e699-4197-a60e-9b673c797109", "comment": "Malware payload", "value": "0dbb338250c1ff34f1f74333e964a7eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422728, "uuid": "0e716d4c-ce86-44b2-959d-5d724369cc29", "comment": "Malware payload", "value": "e72f7aca561f2ac82e724b952c0a214658a394300deb097ff9257ca03969614c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422728, "uuid": "4b468809-174a-434c-a48d-dbc6649f901d", "comment": "Malware payload", "value": "3d338ed384362876af4d1072fd3f026ab808bc2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623422728, "uuid": "fdff8799-de6f-41d4-b7d2-36ac227f4b42", "comment": "Malware payload", "value": "549614bda147f0cc17dd69c4925b113192dd58c34b0afd830e5f6c7c3db3826133e9f9e83c37bd02f1f61a59534cbbfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422728, "uuid": "13ec891e-4bdc-4c10-b796-b4d42e319f52", "value": "EBE52303B38B8571E0551931887A83569D167DA83FE623137E34FB4EDA7A3C28D36B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422728, "uuid": "12d71893-81f4-499a-a5f7-4fa6df28c503", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422728, "uuid": "0f0195d9-99c2-4d9a-a859-f6ade2b6bc18", "value": "49152:LP6+X1Va7AePTolRd2ldttJ+WOwctsLcKOJP7LbWkEQ6zC87QOZV2rJz:7tX1SAePHtr+PtfKKjLbWd3D1f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623422728, "uuid": "95d3589a-0b91-475d-973f-bad4a23b4167", "value": 3137384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623422728, "uuid": "8f3d762e-895b-4bdf-a1a7-7bf5cfead3e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623422728, "uuid": "821dd26b-fb61-4b62-921d-00714f30e022", "value": "WinRAR_184567342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b94fb99-caa2-11eb-875b-42010a9c0053", "comment": "Malware payload (RevengeRAT)", "timestamp": 1623408396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408396, "uuid": "3875fe88-9be7-41d6-ab58-600b6efbd5ab", "comment": "Malware payload (RevengeRAT)", "value": "768c83fe9d356c8da442fbe5f074346c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408396, "uuid": "d73c93b1-b26b-4a3c-8932-6529518427f4", "comment": "Malware payload (RevengeRAT)", "value": "e73eb2a521cdfef48d95c849c7308b9579da7d840d30693763894dfa2393de8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408396, "uuid": "b01cb346-b111-482f-ab99-389e02d176f9", "comment": "Malware payload (RevengeRAT)", "value": "244efb476d7e849220d8842df8d683f74e662178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408396, "uuid": "93309212-8b6a-4c3f-af5a-77c5d320f78c", "comment": "Malware payload (RevengeRAT)", "value": "e24496495d5d6867d40d226ac8e89ab7b8ff9393cd9170b3ee8449486dac81a751e4547594c431f403a44b1bb9cafd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408396, "uuid": "00db5365-3504-493e-a5c2-cfff8c0f5f9c", "value": "D09372C302D96D77CA6B3AFD176209C9E368DE131203D6499EF0BD66433E662B700796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408396, "uuid": "02e768b1-c35c-490b-935e-573e093897aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408396, "uuid": "0d14bfa9-7e19-4283-90e8-1cbaef6a40ba", "value": "1536:xHTfRCAsi13sTDfysEqKmIJezkINa/CXtXI4p1Sik0SHKeuOFidp:xoCs6hqKxJezkIIUVNAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623408396, "uuid": "66a4456c-1b76-4546-84c1-229bc67fdde5", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623408396, "uuid": "c1052d79-73a2-459b-8898-9d3f53ddded6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408396, "uuid": "020fa9eb-c5bf-4b32-baa1-5ba1dfd7beb5", "value": "768c83fe9d356c8da442fbe5f074346c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2804736-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427037, "uuid": "222373e3-40ae-49ed-9454-d4b3e88006ed", "comment": "Malware payload (Mirai)", "value": "8f6c723e4e7306f04d6cb3f224c73102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427037, "uuid": "76000717-1118-44e0-866f-910866beecbf", "comment": "Malware payload (Mirai)", "value": "e77d54aed0e7461f2f0b8f65b7ef4d24aade095a5b3861adfd04c4e15879cb48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427037, "uuid": "ccecd7ea-6249-4770-b8ed-4982f4eb8cf5", "comment": "Malware payload (Mirai)", "value": "f8d4942b9e1434ce0a858bf0cdd57c78bdc5223c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427037, "uuid": "653a9b6a-2194-4c86-b667-86b276f8eb42", "comment": "Malware payload (Mirai)", "value": "df6543f68fe0bcd8263f579e66ed2d6134ca5964f2bc4d3ae13c3df963d2581449c260f4b023a776f47cf01e45b08fc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427037, "uuid": "04c87b04-2c83-461c-b7ae-e56ac28543f2", "value": "94130100B56A1680CB872D243E51EFCF8BA0CBA5F6E5D9734940B32358919397796CFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427037, "uuid": "92991d6b-5dd0-4c81-917d-1aaa640d4d91", "value": "768:eqTQu8nHvzyDTfNRqfkxuIXhytSATaOXXEwk5Do4uVcqgw09DN:eq4HvuTfwxIxEf/XtCo4u+qgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427037, "uuid": "c1b84928-1d7d-4acb-a14d-59c79b6e5ea3", "value": 45332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427037, "uuid": "939bef02-2f2f-4c5a-94e5-984551c103dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427037, "uuid": "ed08296f-0b20-461c-9ce7-d1e872ddc122", "value": "8f6c723e4e7306f04d6cb3f224c73102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c69fe56-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427242, "uuid": "fd9e1a58-c4de-44c4-90ed-e2432844e38e", "comment": "Malware payload (Mirai)", "value": "d4d2468153d5c8ead4fa771e008ea041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427242, "uuid": "86b4e23e-d33a-4bd4-8102-06151725a7d4", "comment": "Malware payload (Mirai)", "value": "e77f59651fb4dc2fef0af1270e660e568e6951ae6caba9d176a0c2ed9773ecb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427242, "uuid": "04492845-59e9-45e6-9818-6c250ded0fce", "comment": "Malware payload (Mirai)", "value": "fd89a54e4e3ee2e9a91cfc8bb4aeb35c1734fd66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427242, "uuid": "831dc0b7-4cdd-4cd0-9378-5ead3064a6ab", "comment": "Malware payload (Mirai)", "value": "4790eea7ddc4492748c903f69838998f11f646d01d10633e566f03877ae8f72464cb90331d1b6c5c7b969dc9b1561f23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427242, "uuid": "cd738484-1a06-4325-8333-128a65ef0ed6", "value": "2F23F211C0850AD2CDDE1BB4BD24D34B1AE917A592E8636F09944470DBFA32B12B39F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427242, "uuid": "80d58bb1-7afa-4f1d-8cc3-fbdb610ba1bb", "value": "768:yYONJxD3QdLkLQHwv3P1vC+UzfncCdYVZEYVmR5nhCeoDeUFaTMcO+uGas3UozO:HqSwv396fLYVmrnH1UFw3aGXzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427242, "uuid": "ff6c7c30-f374-42d3-80c2-abc8b05de247", "value": 46276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427242, "uuid": "3ded4988-2eb5-4d7d-8ee5-df3bd816aa35", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427242, "uuid": "7471f17b-e18a-4202-a222-bd7036b7726a", "value": "d4d2468153d5c8ead4fa771e008ea041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81091eea-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423518, "uuid": "415ef0fd-5f1d-4a48-9ce2-e97f0ab7f59b", "comment": "Malware payload (Mirai)", "value": "235bc847449f1487ac35afa820a8d667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423518, "uuid": "530673c5-253f-4e48-84e3-fa245880299e", "comment": "Malware payload (Mirai)", "value": "e9c319c1b574af5f8474ee7070f0d1074e5bab1cef1f84e9f6489606de29da75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423518, "uuid": "b0ebab3c-a463-4996-b4f5-1631bba3e448", "comment": "Malware payload (Mirai)", "value": "6528000637f1ae55c34cc467054854dd969b81b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423518, "uuid": "3eb17762-48c9-4a2c-bc25-8779bb465a9b", "comment": "Malware payload (Mirai)", "value": "86575c6faf315cdb77b821cb27ad4cd89418dd234518b02be8d0dcaf5f4ad9e87b40a68d9d378216053afc0bc854e053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423518, "uuid": "db860c8c-9bcf-40d3-841d-90130d388ca1", "value": "2503F1A048CFE551A8285D37646893E61A1D79BC41FE391018DD0AD9EF4E02F1BFA74B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423518, "uuid": "896fc90b-4b33-4059-8d6e-08c60c7a2a26", "value": "768:FReV3oTTXpp92i+P6iexhTqU8PZeGcTmZMNOKlcrGoKREimibcs3Uozg:FRUwT5V+x9umZ/KlcrGPETkZzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423518, "uuid": "6083bf28-d9a9-4725-b9b6-2c0a5b2367c6", "value": 40104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423518, "uuid": "e16fa230-a75d-4f99-80f6-6c52e53dbed7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423518, "uuid": "2d4977e5-3b00-464d-9780-98acd76d03ab", "value": "235bc847449f1487ac35afa820a8d667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14943798-ca7a-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623391124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391124, "uuid": "b283a117-b643-4e78-8a06-2adffee3d9ba", "comment": "Malware payload (AsyncRAT)", "value": "c1ce041bbb815a3423082dd63e919323", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391124, "uuid": "054e365a-8d59-4432-be07-a03801909158", "comment": "Malware payload (AsyncRAT)", "value": "ea8699a799b58256cd673c2eeea8a5a69c23c1a9883bf9de0ebc61c194da12d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391124, "uuid": "7138fd37-d6d4-42c5-81ed-796d62b355a6", "comment": "Malware payload (AsyncRAT)", "value": "fb9f30eefbe2ee1e2ddf68137f0296db5097d5d0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623391124, "uuid": "9041ee73-0a23-475c-a4b9-4db801a3fb51", "comment": "Malware payload (AsyncRAT)", "value": "71a6c7eac9fb4511c22a9bee92a2e8cec1ff811f8578c687b6eca88e77300c28cae9d6d15993a8fa21ed16eb11a7c672", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391124, "uuid": "b2ea3e3c-52c7-42ff-8076-24cfaf372795", "value": "78D0A94EAC28C84483021FAE9009E8458EC60AB8F3746818A0A8DA28310E88387F9A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391124, "uuid": "a1851ef9-10c2-488b-8600-578c0f56c577", "value": "3:8XUwXgNFhYoL8BJHwTGFQHovscqsQHohCoNHRmMQSNKfcNLGOOucnlLOXesTxQX8:8s44LGFQovscSxoKiLGzuENrKxSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623391124, "uuid": "83ec58d8-91d5-4763-9a79-66e7888847fe", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623391124, "uuid": "7fa85168-955f-41c9-a7ed-a5abb4dff28f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623391124, "uuid": "b6bcb479-8344-451b-92cb-a940f6cdd8d5", "value": "Order-ID333744503639062.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854bbea6-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423525, "uuid": "32cdfd91-4090-43e5-a79b-0ea7a5fd121d", "comment": "Malware payload (Mirai)", "value": "0e7860cab242ff4611a3ab9030c611ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423525, "uuid": "e4968fe1-a850-489e-acb5-a4d2d80d5fde", "comment": "Malware payload (Mirai)", "value": "eadc6badf668c930b60e8bee0386389a3bac84b706969bf218ed271457129821", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423525, "uuid": "41d260df-a6c6-4e68-bd42-f9a7fdbe12a9", "comment": "Malware payload (Mirai)", "value": "8cfc5b02560c3bbbdb2a2f93ae045bb7f2c71ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423525, "uuid": "a34782fd-1939-48ee-bff9-cbce6ae7b2be", "comment": "Malware payload (Mirai)", "value": "2dc916072d4f0532429ebdb1922ea38dc912f52c1b99c2d737c951f55d43f1a67be16609a677205a0328b753d3a72b97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423525, "uuid": "74d94019-a705-4dc2-b341-a1d8036d2e56", "value": "1103E004D1C9AD92FE9F9DA03C98C59263B30DE1F7961B114A2347233A1771AAF5CD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423525, "uuid": "3b3f55d0-13a0-498c-8d17-c82b5dc98ad4", "value": "768:Z2L8YZP4u5vPNLgL8uGzdWBg3tP1ep/9Es6eqOVight+Vv5S8w4uVcqgw09l:ZQ8YCubLgQ6iPQpOLfGigP+Ndw4u+qgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423525, "uuid": "a18ad495-c307-474a-ae2c-571d0a5b5409", "value": 38964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423525, "uuid": "aa8891a9-8e9b-4f95-9404-7463d0e6f167", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423525, "uuid": "eb270623-ab92-463a-93ab-fbdcb679d0d8", "value": "0e7860cab242ff4611a3ab9030c611ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbcbcd7-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423513, "uuid": "24a0dbba-efd2-4d5f-90ca-80f51031a1df", "comment": "Malware payload", "value": "401e767298c8513851026f47391340a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423513, "uuid": "4d699ca3-2359-4441-9674-8d3283a2a4aa", "comment": "Malware payload", "value": "ef41c5d742f2b4350271af1d0839ffbe69494f711c91cb90990605486f0699c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423513, "uuid": "ad4df034-6afc-40b5-b503-814005be2261", "comment": "Malware payload", "value": "036de2cc5addc0656e90e993d4f70ee06121c5a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423513, "uuid": "85972d85-4056-4fe1-9e80-a6ecfb4133f9", "comment": "Malware payload", "value": "21bff9371065b8d242e5acc137de84cdb4e6264c15dc2ed87da5cf4a5583a794ee8ce860c34d86aff8b71f6d8bce7b57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423513, "uuid": "108177a7-eb80-4b91-aefc-e83bbda88dbd", "value": "AEB2D14662A36A6DE5922336F517609B7B1DB908FBC7DA564F2B20D42CC26B0980CFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423513, "uuid": "f76c48c7-e998-442e-9288-b6781c2afa95", "value": "768:RT1USUjqIjnGLLFSQPLSXAE4/eRQH8iN7wj:RZp23nGsQDyH4mRk8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423513, "uuid": "7adab399-3bc8-44df-85c2-4b892ead3f97", "value": 25296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423513, "uuid": "0eae5377-6677-4c54-84a8-89d5a8d5aed6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423513, "uuid": "eb4bfc40-3aa3-40c9-b4a4-9471f1a18ee0", "value": "401e767298c8513851026f47391340a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cb6d9e-cab9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623418528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418528, "uuid": "247ed9de-a2b7-4519-9795-9a9eddc20efd", "comment": "Malware payload (SnakeKeylogger)", "value": "192e491f14f6a40d05c2d320dd26ef00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418528, "uuid": "5f255a33-df33-4dd6-8242-47e170beb651", "comment": "Malware payload (SnakeKeylogger)", "value": "ef638b5966dae5fe82ccda9566899a4580c0f774da5384c8532df5917304ca12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418528, "uuid": "4507bd3c-6d21-4085-9387-e83f75aa843c", "comment": "Malware payload (SnakeKeylogger)", "value": "ec1476fd9f9fc2f448657e4c94c48938807cd41a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623418528, "uuid": "89115cab-c79e-4d8b-b332-506f00021848", "comment": "Malware payload (SnakeKeylogger)", "value": "2858fc106d02b40989c925458d6abc4eebedcf63b803d9b85cfc4be0dee031f135193e4f74f5b496171d1d3942321b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418528, "uuid": "7e8a13fc-4e48-41a3-bcbf-04e83b9d121e", "value": "2565BD1166409B10D12987748C23D6704FB0BD0EEAD6C60E7DE77D9F3871BB26A2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418528, "uuid": "9c70e004-21de-47e9-835e-02bdbd6d18b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418528, "uuid": "7c9734c3-0700-43dd-a844-f528e6f9385c", "value": "24576:LO+38LW1NeBUdtQqA0Qqee/z8YEo+UMpOgA15L2MhnRFg5LlJfHwzMIDsxTt8w6R:P1wBUQqA0Qqee5oFpU1N2UnkBldwI6y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623418528, "uuid": "022f0f6a-239c-45f0-b023-88a8cd78dc0f", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623418528, "uuid": "69b1bf65-aa22-47f3-a998-7788eb766074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623418528, "uuid": "31251723-81ff-4861-8e68-996c40f49021", "value": "Scan 202111_0976833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc18b8f-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427323, "uuid": "cc7a799b-da13-49eb-943a-b65665a15e05", "comment": "Malware payload", "value": "9b0cc67c8c56a5e9009db2e2f5af737b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427323, "uuid": "95887556-3faa-4a30-8156-b5888eade210", "comment": "Malware payload", "value": "ef8108ec38d7d56c77963aa49a74572956b2fe397342d09c9e171ba47de4caff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427323, "uuid": "19dc2d62-0d14-4042-8b7a-60e0190e6aa2", "comment": "Malware payload", "value": "de14b523b12f615232b9e6718d0dff409df15851", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427323, "uuid": "86d3761a-f468-4f1a-9c58-f5dba30bb756", "comment": "Malware payload", "value": "2f01caae6de1126a13243afedc056774988665f2338143b5c82d24b324db072eebcfa9b1bb6eb0062b9f96555ebf87bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427323, "uuid": "ea20a479-7a30-4082-946d-2dc8843afb04", "value": "5613F16180CA49E4DFB00CBD8EAB33436314AEBFE58B3474D76805F0AAD2952B5FD542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427323, "uuid": "5ed53c02-c088-4f38-93a3-281aa5269df2", "value": "768:WEM9v69OVm48IpBpbRGr2518cchV/svYIbuowsnIk5s3pk3UI/ZyAx0Bgg8edxXY:WEci0c+Pb0g1AhopnIk5Wg0AxOrbdxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427323, "uuid": "3ad5db67-7d56-491c-b536-b4b2203f2e30", "value": 42088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427323, "uuid": "d3490ce6-6861-41ec-94f2-5230c1e2ab6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427323, "uuid": "70a8661b-cc2f-490c-8275-fca9a61f722c", "value": "9b0cc67c8c56a5e9009db2e2f5af737b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bdb66d-caa3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623408849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408849, "uuid": "8dc8735c-f40b-4fbf-8e3d-db4bb6f93245", "comment": "Malware payload", "value": "4621903e4e72e97ee577868ba20a2819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408849, "uuid": "3a912d9d-7a97-4969-9698-aa28336d9634", "comment": "Malware payload", "value": "f003b48eb9a2cc5d37f92b37ae68b69b258d6abfbbc447937cafb6983b7c717c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408849, "uuid": "80779cb3-9f81-42d3-a4b9-e7722938ccf4", "comment": "Malware payload", "value": "fa029bcc8809f88fa145f5427f3a0434e655fc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623408849, "uuid": "054b4b09-3e7d-42ab-b14c-6a4d37f34894", "comment": "Malware payload", "value": "d0de21eabd6e238b2a72cb4ad5d4719e4e74d372012d3b1bef2ccad495d1ea7e30028a786b67c39eaf9417a61e9472af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408849, "uuid": "aa05042d-98b9-443c-989b-07ce7ce0091f", "value": "4EB339B2FE89ED93E62553398AF5E319037DFAD11B828B1B1D21883957035D1BFC2606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408849, "uuid": "0b9038fc-f8e1-4748-933b-ef380d62b53b", "value": "6f08ea3715a07f096742cbfd20217fed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408849, "uuid": "50ca4d18-8bb3-40f6-b373-ca1fe71c7981", "value": "1536:/6KebM4WkbTuoXIbuMphWE6wULumuUOMu3yMXImbWTFGNxUssi:yKebljuoXupywwuQOINalF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623408849, "uuid": "22511a4f-e48e-41f0-b771-3b60ba4f2a90", "value": 109769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623408849, "uuid": "cc04ead9-19fe-4939-864d-fb091d20de6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623408849, "uuid": "4cb187c1-a672-4d30-bfb1-f47dd96c4a7d", "value": "4621903e4e72e97ee577868ba20a2819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb7d29b-cace-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623427299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427299, "uuid": "f4307425-0f8d-4b16-a1f2-6b43d88a6d8d", "comment": "Malware payload", "value": "c28830360cbcc1009a8cc20243ede6eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427299, "uuid": "9349126e-1d7d-4100-9804-7a701f3d5a95", "comment": "Malware payload", "value": "f15c1080fc76f552fb19e912ccc1554fe03a8492527e60b1329a2415beeefd36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427299, "uuid": "7662a9b8-01ad-4784-8868-408b82e41638", "comment": "Malware payload", "value": "cbbddadf3fdefdcce90fc0385a1d12c29946fffd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427299, "uuid": "5141130a-a224-4668-b95e-a7b4b633e4da", "comment": "Malware payload", "value": "98d7fc1049c9f7df099556a3e29adc83b46652f8a94c7adffda1059facbf917cd1b69df57ae06cecf6b87f8f424a666f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427299, "uuid": "57925f68-5b78-4406-9134-8398c84b3c02", "value": "2CB33A0798615F77C045ADB529AB5530072BBA120F4F1F9AB57CAAB4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427299, "uuid": "ec02251b-d483-4171-9a7c-7e4d16962950", "value": "3072:moNToIWzKoFIon14v5hLwDecr68LkY0Px9gQNfR:TNUz2Ej4v5hLwDecrfLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427299, "uuid": "c6e44a2e-3a6d-4595-ad77-aa88e46ff7e6", "value": 108419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427299, "uuid": "004d5c6a-e0db-43a1-956c-802058361818", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427299, "uuid": "cb4340a2-d1a4-40c9-b4e5-908397951aff", "value": "c28830360cbcc1009a8cc20243ede6eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b775bf-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423315, "uuid": "f6c4a83d-3775-462a-b203-a9156f36b546", "comment": "Malware payload", "value": "7a383f57f7d2190d9af3e57d67cfb004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423315, "uuid": "c6a47485-f4f6-4925-a7a8-d59d790a5c1c", "comment": "Malware payload", "value": "f18e085889d9d7324c57ecb800563ba2e808c0ef8ad52b7b1f1f3afa169bf836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423315, "uuid": "8cd7f109-ec19-4a0a-8e11-05196b90644a", "comment": "Malware payload", "value": "2e783c279542ea1708854413a0cd725184f8fa78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423315, "uuid": "607a091a-2df9-4310-af6e-27a61c4e311f", "comment": "Malware payload", "value": "00f37eedfceb3ab320c47689d45568f9d31af9cbfe78f11fab11e40cec4952eb049222b44e970f71d85773b826f62b20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423315, "uuid": "07af2476-9059-4709-aae5-b4fe991fb029", "value": "53763375BEFDAAB9D27108361DE1D3B83A57BE52832D85C226E04867FE20481D37D1C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423315, "uuid": "14f3d612-f18c-47e9-9bbf-0255dc93f264", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423315, "uuid": "e005741f-ca84-4db4-97e9-c088bca72941", "value": "196608:vNLptmMAAoPyqO+L//02LCDMnruqDAZIwIPXn6T:vRSz//CAnrupIw2XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423315, "uuid": "d0ced084-0abc-47b4-bb8e-25072a407e54", "value": 7280774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423315, "uuid": "ea7b6619-1731-4f23-91ec-a103b20bc95f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423315, "uuid": "8010272e-24c1-45e9-9dc7-8846d48209b3", "value": "7a383f57f7d2190d9af3e57d67cfb004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453388f0-cacb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623425995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425995, "uuid": "7297d164-9cac-41b3-ad1b-6ddbe2fb0d8d", "comment": "Malware payload", "value": "5301560e2eb60d50cff0c190573bc9cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425995, "uuid": "ff601dc0-00e5-4e91-b3c3-856f2ea67770", "comment": "Malware payload", "value": "f28cbe9c9858d745bda5bead234e503eaa576458150a98088ed8761077738cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425995, "uuid": "f4adf71f-54fd-4c24-bbbd-c3cccef230a1", "comment": "Malware payload", "value": "dd84f571542089bdd1df9f2ad726246d7355c27c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623425995, "uuid": "1767810f-1349-457d-b8d9-fc7a12ec78cc", "comment": "Malware payload", "value": "537de8d4b748cf50d5cbc23c9a244a0fd6e78a91dbde97a6da826f1320701c2df837917d79333519b20834292d437b01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425995, "uuid": "904e7648-3a80-45a4-a112-10d64536bb5b", "value": "D4F2E1A08B494C63D8CE0DB5C53AC514513EB9F9BD8F77482A5D233DAF821832EE6651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425995, "uuid": "5424c9c9-0b52-4d59-9e9c-bdad0c64b961", "value": "768:FblSnlo8SuLltghIsCF4J+vFBwHulTKvW3UO1EfxF3:FblSFXrgIsCvdBwA31EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623425995, "uuid": "c9bd83e8-a661-43cf-81c2-196bc7767a7f", "value": 35648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623425995, "uuid": "0db97c93-d070-4b7a-94ce-9b4fab006f52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623425995, "uuid": "e6449663-d6dd-4ea2-a0be-d375b82a323c", "value": "5301560e2eb60d50cff0c190573bc9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b61b5c-ca99-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623404808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404808, "uuid": "6b4d11c9-86b6-4b71-89c7-3b8918dbff1c", "comment": "Malware payload (Loki)", "value": "4b75cc4f9ee692314ca67d15fdc7a792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404808, "uuid": "90a79ce4-d85f-4c01-94c4-5b372904edd5", "comment": "Malware payload (Loki)", "value": "f2e456f7cc5ba2ae9b7f59a553c0afb09c93ec2461adaa5fe8108e102a678953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404808, "uuid": "24f5c266-5bef-4a9c-9b29-b513643f5af7", "comment": "Malware payload (Loki)", "value": "e1f9d069de9e8d19f6e531f2d810a4c6b8d6ac54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404808, "uuid": "ca7f341a-8a0c-45bd-b1ea-2da9cd78d75d", "comment": "Malware payload (Loki)", "value": "36e82b240e0b9f01585b6105031b20dea04f514bf0a6e404349ee497895690929d1fba7bdcfd8af9b559f7cdb478361d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404808, "uuid": "e8667a33-1729-4ff8-879a-a2dd11d43932", "value": "F7B46AAC36507ADFC81BCD76CAA82C64EA20346B570BD207A00719ED9E1DA97DF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404808, "uuid": "e2a5977d-aab9-4af4-8760-7971ee2b074e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404808, "uuid": "bc62ff28-aa0f-4276-8678-9d10fc33406c", "value": "12288:Zgmyb+ZDmeybvqRnPOgIzB335fAEJKYzSKtXZ5Koqwurr1+3cN9YqA5iv7kY:+myb+ZDm/bvSGgIJ35tAYzbXZyuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623404808, "uuid": "122ff9cf-f3fe-46e2-aaff-a3657cdea3dd", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623404808, "uuid": "e07cdab1-fc9c-4e1d-a912-14e1dc218538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404808, "uuid": "d4290155-447c-48de-9ea6-d323147367e1", "value": "Quotation-2021061000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff3a751-cac7-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623424590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424590, "uuid": "409646a2-22db-4f2f-87da-9f9128a9f63f", "comment": "Malware payload (RemcosRAT)", "value": "03c31e45cda3afb1aa217181678450fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424590, "uuid": "c147c313-a336-42d8-a0f3-a19b8eb09308", "comment": "Malware payload (RemcosRAT)", "value": "f362d72dfa134dc22f857bd942295b66980fb940c0451e9b3e7cbf1fc1ea21f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424590, "uuid": "c1ad2f9c-e3e6-418b-9a20-b3c16996ac54", "comment": "Malware payload (RemcosRAT)", "value": "26a7edf731f612d8ad771334bf544bfde5199079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623424590, "uuid": "a01e6cab-8a6a-4dd1-ac83-7915a834b491", "comment": "Malware payload (RemcosRAT)", "value": "8c9010bc6c245fac57de623890f4fd012044c9a9b8edd11a08e1e9689e074a47678bae99569e59e0f0d02935d1b4ef21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424590, "uuid": "19bf6611-e6a0-4332-9196-5052490bb0ab", "value": "B94404C7B88FB1EED64C8AB051319E75BC71AD7379631816B2C0A62E9B73352205B1F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424590, "uuid": "83a38ad1-e152-4292-9fba-2d374665ccfd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424590, "uuid": "14ec8c48-beb0-4c20-9aac-855f0ac1d748", "value": "3072:2QIURTXJMTPDMsBFj0P97xxp5LbMswvG9GRFz7qKyCVr4AwB:2siTgsfARx1oswu9GRR7qoB4AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623424590, "uuid": "df222134-9d1c-48d3-8f83-83bbc405213f", "value": 257151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623424590, "uuid": "ade4c472-6f6c-428a-b1a8-6bbf9f433079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623424590, "uuid": "2c62dbfd-f668-412d-b4d1-335647e76ef3", "value": "PROPERTY PICTURES 093728282929.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a11946-caa4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623409324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409324, "uuid": "790fa6cf-72c6-4f75-96e0-8e53540ab69f", "comment": "Malware payload (AgentTesla)", "value": "4feedf906175f2357dcc2abbfcdb5ec0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409324, "uuid": "5ad350e0-aaab-413f-ba7b-e9fac98ae188", "comment": "Malware payload (AgentTesla)", "value": "f4888e1ee79c601d42020575ce5b79958c4c62e308d970f4a4f4c17b51ebc6e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409324, "uuid": "b239b626-2288-40a7-85c4-c88b95300652", "comment": "Malware payload (AgentTesla)", "value": "77678c78e2d226fe55be6927436899129e47967e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409324, "uuid": "034ff9a5-9e32-409c-9192-138d9657d364", "comment": "Malware payload (AgentTesla)", "value": "1ca893bef1826a0ccb3fd297c1aad73adaebdb77a190de6c6a7a30f57aab5cd782fff745fe3261e641f77079cb580aae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409324, "uuid": "fe80004d-3651-4b6d-817a-fe254c4a5596", "value": "80A4E0103BFD5B01E0776BF52AA4A45A9BBA7A237621C15C5C8431CE4932F44EE61F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409324, "uuid": "73e39303-284b-4b3b-8a01-e24d3b07c904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409324, "uuid": "2c0eac01-5fb6-4f00-9081-784011ffd8e7", "value": "12288:AL5Mzm8gHdafEpNqBDfC4JoTmKU2pC5j9:AL5o0a6NKDfjoFvC5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409324, "uuid": "d0f5417b-76cd-431c-93d5-a73de3247880", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409324, "uuid": "586516b7-3e7c-461c-a92e-b595fd3ee24a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409324, "uuid": "f171e2e9-cafa-4794-9b0d-10ff3d9e652a", "value": "shipping document -813-25319 192-463-56-265-3327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c233686-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427295, "uuid": "202ad2c5-7648-406d-940a-12949ae607ae", "comment": "Malware payload (Mirai)", "value": "da1a0e1d962f58c5901ba27c5e36cce4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427295, "uuid": "2c97be0f-34cf-42ab-a61c-8d73a9c60eca", "comment": "Malware payload (Mirai)", "value": "f633a0780796e0ef2223e426a33f52880ed4324123227f88581b08d250c1d971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427295, "uuid": "ddf4e4c7-f5ec-475e-aa91-f3f039ba4b40", "comment": "Malware payload (Mirai)", "value": "2391ad7614531710e24f8d6bf7ae36e67d83a2bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427295, "uuid": "454c89be-28db-4095-bfdc-704fe83a4d0f", "comment": "Malware payload (Mirai)", "value": "9574190c7f33e953da9094e1a955e7250649078036b0ab3fe0dbbe867a660e884b7fbc306064fb694c45e191f509cfba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427295, "uuid": "139fb1d2-cb5c-45ff-93a7-d6763d7d2918", "value": "CB1319DAB801AD7CF85FE7BE84234909F771674551830B3727ABFDA36C321548922E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427295, "uuid": "600e96b3-a5cd-4ba0-b503-bc7b947031ea", "value": "768:VRAeZkjgA+/QkBoQB/P/Xl/apuKWeijpis/JT0z5Se8kM:VaUkjgA+/QOomP/Xl/aIKpois/Jwz5JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427295, "uuid": "f28bff62-afc7-46d5-b75a-a8cd1423fc2d", "value": 42868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427295, "uuid": "c2b475f5-28dc-45c1-8492-c3002e3b35d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427295, "uuid": "264af8d4-25d1-434f-8bc7-02532623fc55", "value": "da1a0e1d962f58c5901ba27c5e36cce4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e112c5-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427288, "uuid": "16f9360e-2bad-4606-82e4-7fb08a94c06b", "comment": "Malware payload (Mirai)", "value": "3002bc4b0ec88e02c51221b4583bc527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427288, "uuid": "d76d5b0b-88fb-49c6-b427-8a0d95e40508", "comment": "Malware payload (Mirai)", "value": "f6eae9ce9b8d230c8dc9bbaa075ad63a55de04eab1eede65c8163ac828c8dad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427288, "uuid": "e22a99b3-438f-4a5f-9bff-ea2b12a0bf26", "comment": "Malware payload (Mirai)", "value": "9d6055ad7937a318e9689961b69a19b7ebaa6c7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427288, "uuid": "b32c4d17-a616-43b0-8714-c7df467ae604", "comment": "Malware payload (Mirai)", "value": "57cbc70d5f1d8dcda0c2a79cc76a817d9f4a6e1c0437cb158b310bd43cf296d7312b1fd86f53c233edcd2ef445bb645e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427288, "uuid": "c5026fb3-9733-4c8f-86f6-9628cd0a18f8", "value": "BFA2C00DDB1144AAFA6F907E5EAA0BA44C700FA7BD56EC137788DA03CC564747C42EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427288, "uuid": "cc9e3d01-0281-42e5-b901-8b7d0b3ef72d", "value": "384:Ap2inTAqXoJQrTlzAUNFzf8ToHg3yZl88u/1xyMpykfji4dvTOxJ0BapJgGlzDpH:ApRTA9JqZsUNFz0qUE83x5pyOdqxJzpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427288, "uuid": "12d002f2-2634-45a6-ae20-c25d281e10bf", "value": 21596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427288, "uuid": "45a4d94e-d9a9-43ae-9a48-9752f0fadf2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427288, "uuid": "7055f885-8ab1-4c56-a336-e5219fcca60e", "value": "3002bc4b0ec88e02c51221b4583bc527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89425259-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623423532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423532, "uuid": "5a376017-4a49-4442-879e-f9af38354578", "comment": "Malware payload (Mirai)", "value": "3cc737906b150e09f63a4ae0f6225174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423532, "uuid": "e19b4c79-ab06-4ac8-b8a1-1b7f12b3de3b", "comment": "Malware payload (Mirai)", "value": "f729b3e1dd1a9b69a5f408f422554efa6a73d4a2bb2d4ee434f95f2ae49c4268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423532, "uuid": "6508188c-0232-4458-ac7b-292fc3e5fda8", "comment": "Malware payload (Mirai)", "value": "009edd275d96b27db715787439899fdc372a1d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423532, "uuid": "8d54c30b-2bc8-439b-bd97-ca7dbdea2be0", "comment": "Malware payload (Mirai)", "value": "3f272cf086a3335cd548bc23853c35f2adf866b086c95f30590eaf56e38833e8ab213796e3da5cb825328e441909c3f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423532, "uuid": "9c1f4483-98b6-4af8-81af-67c2ff277c30", "value": "A113E16C960051BBD15990FDAEF44741AF284CB32563EC4A1034A963EE49AF8B4E3FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423532, "uuid": "220524cf-7178-41f7-a07a-6bb5921ee948", "value": "768:zJCcEYiQGVXTl59M4Nmxix2X4WvECTvHSdYk/ho66NLftgJgGlzDpbuR1JV:oc/rGx3+sKp8CTvWextgVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423532, "uuid": "2ae93fa5-55c4-4a81-8c26-b7ec2f091d35", "value": 42020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423532, "uuid": "4d490b59-2045-4844-ac7d-750922c202f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423532, "uuid": "837cad0b-e113-4537-a03c-6e45c12fbac9", "value": "3cc737906b150e09f63a4ae0f6225174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b860e0c4-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427047, "uuid": "bcf0fbb6-041c-417f-9bb9-d32f150e8a2d", "comment": "Malware payload (Mirai)", "value": "6bb23d674c8081347953cd895218057d", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427047, "uuid": "4121a668-8537-479c-ba26-f47b9db9d7c5", "comment": "Malware payload (Mirai)", "value": "f75b49984b557bcd5d34f4a04c4763e935ebd7c043a130afd04bdf572253adc3", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427047, "uuid": "7a0eec4f-bd28-4c38-a41d-60b49f34bca1", "comment": "Malware payload (Mirai)", "value": "e78af9b371627cadd5163dcd655e9f8eeede3b57", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427047, "uuid": "20962278-a140-40cc-b23f-0cbdc1cd5db8", "comment": "Malware payload (Mirai)", "value": "adce7dac48ae239bad79e7f46edb88948fe755bc8ef02d28b7448dc64d9a1b503f10727ad3236ea523ec28a4ccd48757", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427047, "uuid": "71f0babf-4527-4149-bba9-5447d15fd2be", "value": "8A33F26543CEEB914C31593DDEF1400375778474A0BA3895E640886F2EC56EE2BBE9CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427047, "uuid": "9beeefd7-ca0c-4920-aca7-51c7a13994a6", "value": "768:A7AGRnW46e6cVM9Opuraed8Bl8SYKxRxj7cdfd/IRHpNj34eJ9q3UELTQ7:A/9W46rcVEOpue4Q8OzfcdfKzNjALW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427047, "uuid": "decbb07f-4d01-44bc-988e-5b1777e49239", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427047, "uuid": "33380800-930d-4819-b8ff-d1e76ff1a471", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427047, "uuid": "05cce05e-d481-4f82-aed3-486537b19325", "value": "6bb23d674c8081347953cd895218057d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc98b73-ca81-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623394226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394226, "uuid": "d0cff7f1-3bc6-419c-ba07-5e01f1d28554", "comment": "Malware payload (RedLineStealer)", "value": "7c43f9321e43eaf3edff6ddc34fe3038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394226, "uuid": "7fe994c4-f5ab-4b8d-8004-2081f78662d8", "comment": "Malware payload (RedLineStealer)", "value": "f81b0ee364ffb419c8af7bdaf03670bb7fa7dec30aa1d6f486e7a8157768eed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394226, "uuid": "77e0f926-175b-4ece-b455-531f9d6b84db", "comment": "Malware payload (RedLineStealer)", "value": "4a31366cb0ae0f67aaef3cc38c328d4ccc8b3dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623394226, "uuid": "602ec726-66cc-480e-9027-2872ef4ff312", "comment": "Malware payload (RedLineStealer)", "value": "656a1dc628c6facf1d56e845d9227d856fc66297ac7258f347b0979a1e3168ad43a52f36abfa6e0058a57f489b28a0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394226, "uuid": "9d246a4b-d88f-442b-81b6-ea844fc9faa8", "value": "5EF4D010F2A1C0B5F2F352FC85B59A7495BA7EB16B2861CF02C51BEE56B55E0AC30B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394226, "uuid": "1e5b5267-edde-4ed4-8889-9eff27a86542", "value": "42c24f8afa9a3219ec8f6552ac1f6be3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394226, "uuid": "fe9b4ee8-5bb3-48a3-9926-bd74e873f056", "value": "12288:DsAcRQFtme22/LiiJZ84m8cCgEiF+lgc8RNIJBwbKZCFNWdOM4rUCh9Gzc:DsrRre22pJZ8lal0gBw2wFcOLwCPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623394226, "uuid": "fbb41350-f395-4ffb-873f-35e3908ba15a", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623394226, "uuid": "aa85a17f-f5fe-45b3-8eac-042db2dbf488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623394226, "uuid": "442b8025-a205-49f2-b390-5028d471963f", "value": "7c43f9321e43eaf3edff6ddc34fe3038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778ffce9-caae-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1623413624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413624, "uuid": "4356b61b-bd05-41dc-8a23-7001b7aa0529", "comment": "Malware payload (BazaLoader)", "value": "07d84514c97d69c219ab4cb234dda769", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413624, "uuid": "08db80c9-8465-4225-9508-7d52b21e066b", "comment": "Malware payload (BazaLoader)", "value": "f82563bd3ce4a095edf113a008b70ca63d9297dbf644a059641b6adbfe8dffec", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413624, "uuid": "2f7a987f-5499-4027-97e9-d95563aa84be", "comment": "Malware payload (BazaLoader)", "value": "fb3f95fed24303ecb31c2fcf524bf704af3f3de3", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623413624, "uuid": "0a1c2641-88a1-488e-afa9-53fa5abf618b", "comment": "Malware payload (BazaLoader)", "value": "9c148d6e3951371e0b058544cde30864eab57ec58bf29ee4987e00a822b3009715f12fd8fceb78e47e1f30192c99fe1a", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413624, "uuid": "db45dd93-c1f4-42ef-9a07-b7f1b548f3e3", "value": "A4148D07B29100F5DC3FC5748D534612BAB278224760DE7F0790476AEE7E7919E2AB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413624, "uuid": "1afcf33f-33f3-4481-9876-2b2e0eb450b9", "value": "721151f7d0f0e7bbf8c6ee7d99876ecc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413624, "uuid": "460fb6bf-df74-4e49-a073-c5458df22cb3", "value": "3072:5HG9o35+MQiRMgSI4N+K/F7ioMXYrMbR4bmnk0ibCHUkhJ/IL:5mq3k8RMIch7ioSnk7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623413624, "uuid": "a73c4da4-a20b-4f22-931e-10068f85bc10", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623413624, "uuid": "d0afa5b3-d55e-4cbd-b870-51e0ee711cb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623413624, "uuid": "73721449-fff6-4969-89e6-d89c67e256f5", "value": "f82563bd3ce4a095edf113a008b70ca63d9297dbf644a059641b6adbfe8dffec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5136b155-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427303, "uuid": "e9270648-262a-4033-b66c-58ae305bc925", "comment": "Malware payload (Mirai)", "value": "cb9fb12d36f485f0873054dcbbd0c146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427303, "uuid": "e9843b2c-1518-476d-a153-ee448cb9a13e", "comment": "Malware payload (Mirai)", "value": "f866e9a824b4e721ed09aa6e19500a1ad11f347440c5e890c6b714937036dd20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427303, "uuid": "c1194c80-1fdd-49d7-9041-055045716990", "comment": "Malware payload (Mirai)", "value": "dacd43c169e100557890062c7605895e42f4bfe9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427303, "uuid": "c82e463b-267c-442f-8265-6bd08ab44e18", "comment": "Malware payload (Mirai)", "value": "3ba82872dac916e1555a25e5f6cd50c35ff2656bc1c20f497dfd9c929c27cb0dd00855c5f963333636bb8be0384cc24e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427303, "uuid": "e643b59d-2c70-4f06-a9d1-0ff6b56f2952", "value": "97B2E120DD5A7C30D57068B1CAB9C2837E1463A8D9EE703727A48E6485E7A87B36D1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427303, "uuid": "db84f54e-3bfe-4c8d-b85a-f0e5dab7c472", "value": "768:MnJpsVxvBFlrXAeRikB0UTaDFSYtS9q3UELZV:MUVxvBrAe07Y8HL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427303, "uuid": "e61ee69b-1269-4450-8e71-768166ddcf17", "value": 25008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427303, "uuid": "9f289f44-98e3-41b3-9cf0-f8dee771a988", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427303, "uuid": "64f6f888-3514-498f-ba4d-bab163b4bc65", "value": "cb9fb12d36f485f0873054dcbbd0c146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8987cf40-ca87-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623396904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396904, "uuid": "6606cd58-a6aa-4ba4-9dc7-1b81fa042731", "comment": "Malware payload (Gafgyt)", "value": "14c775af3878942d7c65438a8723a120", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396904, "uuid": "abea1377-d0bd-4dbe-ab7e-de39f866e6c7", "comment": "Malware payload (Gafgyt)", "value": "f8c2634db3f82e7b506c30dbac51421402f614c8d5a58d8f412aa5e1ee69c66d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396904, "uuid": "4a7be8f6-83ed-442b-a271-abbd08560940", "comment": "Malware payload (Gafgyt)", "value": "af7540e193865fb4b4409bd171d6c7037739af54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623396904, "uuid": "29ae3657-0eff-4d91-ac15-5ab6e38cc066", "comment": "Malware payload (Gafgyt)", "value": "2fe59855eb9ea0316f20dffffd6d9c7cc1b43072e168c10c603329fbfdbb51071919ac2b4c2b51e6f33c8afa3d1eda48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396904, "uuid": "9055faf9-b998-4be6-9dfb-659f0738d91b", "value": "08B30893F801DE62F40E9A3605D74725B270FBA60F431A7263573AA69E362D53437F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396904, "uuid": "54dbd36a-c051-4172-9d35-ada98cfddd11", "value": "3072:TvjDQ49PTdDI/gvbBfy/V0J3mxiVmFZ09DRAoQfgm:TvjD99PTds/gFy/aJ3msVmFZ09DRAoQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623396904, "uuid": "31bdd440-dbf7-40d2-b926-62ba8308c0a1", "value": 110076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623396904, "uuid": "cf00e34a-b528-45c6-9a9b-27212f3d6f67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623396904, "uuid": "b1053928-97b5-46f5-baed-df606c64c7ac", "value": "14c775af3878942d7c65438a8723a120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dc0d92-ca60-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623380015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380015, "uuid": "942d7633-b9ff-4f28-a633-9fe507beaeb5", "comment": "Malware payload (Loki)", "value": "3a99e7eef8446fa24717026efa1ef161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380015, "uuid": "8f45755f-0694-45f5-916c-3dbc78e58782", "comment": "Malware payload (Loki)", "value": "f97691877cb494702c1876a40dbcc840b6ab6df9bd062eb1cafa8d23fd674d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380015, "uuid": "a1f11bb3-8aa8-46d4-a95e-8d3c779395e0", "comment": "Malware payload (Loki)", "value": "a09abbcb98ec6a85ce39e4cb8124cfbbe51b1810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623380015, "uuid": "e7a2454a-8e4d-4bc4-a095-8037862c9295", "comment": "Malware payload (Loki)", "value": "b479dd8a9037da33bca3c0fc24e10d4508049f8ec59b3885c4f83eec32cd75c24534f793828dd6ec336f0413655d5fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380015, "uuid": "8ff8f5d0-4216-4464-a852-ae5500c45d23", "value": "04156AF565E147C7D39EDDF283CAB3848B6F56A231728202A94C22FC62DD19D24CE587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380015, "uuid": "0d68c887-b94c-4d74-a4c1-36ff9f2c4978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380015, "uuid": "49a2e2dc-f9fb-458c-aac1-ea3dc0bc6e72", "value": "24576:RvvOtkoIYpIOJ31shkMaqIqc/FNeBUdt:1vOtZIK31shkMkdwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623380015, "uuid": "cc11f3f7-cae5-4c0c-9748-5c575685f7fa", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623380015, "uuid": "9dd0f411-f57b-4f79-9a4e-1570f1a70683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623380015, "uuid": "9c73a966-1e50-429b-b690-a9780b2876b6", "value": "\ubc1c\uc8fc\ubd84(\uc2e0\uaddc)_101115_[\uc0c8\ub108]_210611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d039d1dd-ca8c-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623399170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399170, "uuid": "01696869-d360-4bab-bc95-6cb391dada1b", "comment": "Malware payload (DanaBot)", "value": "422d86725c78c459b4858787ec6816cc", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399170, "uuid": "fa972054-edac-4b47-a12b-3f8d8e30a365", "comment": "Malware payload (DanaBot)", "value": "fa02e3ce72acc362ffe44170bfc8f7dcf95057870310e37d15959999b8e9abf6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399170, "uuid": "ca86ad19-4648-4ce3-95f1-c5cddc0929e8", "comment": "Malware payload (DanaBot)", "value": "f6cd2041d6f446916580bfa11da9c87ed5bdac94", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399170, "uuid": "5ae547cd-83f3-4e1d-9ae2-86589584d59c", "comment": "Malware payload (DanaBot)", "value": "ee753d97281c38842ab007f83867bc58733042db340b21cd1e80ce39e6bb9ba82425cfa7a8ff27cc8290d6e58143e647", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399170, "uuid": "1f47c4e7-d3d7-4e3c-aec7-15c96c71dea3", "value": "75563310A611C03CF5F729F91A7642BA592EBBE2976481DF53D82AFE0B341D0AD32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399170, "uuid": "72b99470-3e7c-4caf-bead-58b1fa79e1a8", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399170, "uuid": "69a89ea9-628a-4ff7-a7ab-e7c103827673", "value": "98304:H5Cq5lnIeORvxNPQcmqe6UxlL6e50Cz73FmZ2Mg8UBGckFhY/gJdd90:ZCQmvxOnqe6kL5j7FmZ236NUcdda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623399170, "uuid": "0b18bf8d-3074-47dd-bf2e-50053e413187", "value": 6364672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623399170, "uuid": "5a6664d7-3a41-411b-b915-3425726cbcb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399170, "uuid": "e7dcb8b2-b963-4350-8dbc-a467045a72f0", "value": "422d86725c78c459b4858787ec6816cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4058f23-ca8c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623399122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399122, "uuid": "e904f21a-d5a8-4de9-80e3-cfef69b6878c", "comment": "Malware payload (GuLoader)", "value": "540cc24e4c71be55d565594145466d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399122, "uuid": "e1ddba7d-b550-49dd-b4a4-79696ef09214", "comment": "Malware payload (GuLoader)", "value": "fa92eea26935ac1ff010fe8797da8a848b4a4b80e3d2c173a68d1000eb7184c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399122, "uuid": "67fa2ccb-7181-4694-833e-902357692f01", "comment": "Malware payload (GuLoader)", "value": "4205fac0d5c08ef589aceee7c5fccd8154d7e98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623399122, "uuid": "380234a7-6a7f-4df4-b28a-f42ade6bb175", "comment": "Malware payload (GuLoader)", "value": "6c90b21e0dfcb45609f3ec22594536eee7102b2c9c126fbd99721120ecd555ae0827c183a4fb22b1e96601772d6cf120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399122, "uuid": "9fc881c1-f635-49cb-92b5-472281f386df", "value": "57141B16E353A426D661C0B1FC09D1FEB4146F362CAB8D47B6F4BB266470DE368F8606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399122, "uuid": "1a7072c2-2ab8-463d-b5bc-af3f79d437dd", "value": "51114cc98630aad2088aa48f6e7a2e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399122, "uuid": "ac5b0d94-3d5d-48fd-b713-f8d112fe47c5", "value": "3072:9u6O8d0+zf1HtTVAbW1TgowrC51rjSK7MZNfpf78C91WmRUpIno4H7IzjsgIX2hC:5a+ztXyo6w1XSK7MZNfpf78C91WmRUpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623399122, "uuid": "cfc4c9e0-8ea1-4b16-9369-fcc6855f2683", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623399122, "uuid": "5c417efe-807d-4b85-bd2d-213078b2cb5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623399122, "uuid": "0a067f31-d371-4908-a8e5-9e7042c4bf95", "value": "540cc24e4c71be55d565594145466d99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f536000-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623426924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426924, "uuid": "34ee5447-2e0a-4b43-87d0-6c22ba7374c5", "comment": "Malware payload (Mirai)", "value": "6ba50fa1ff0bfdd952b9a98b06a5c24d", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426924, "uuid": "1eb44fbd-2e92-4481-93b0-2b667bb2a0f8", "comment": "Malware payload (Mirai)", "value": "fb3f4e453bd3fbed0a30df90cc99edddb951d2741be0754cba111f295c916480", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426924, "uuid": "83487dda-632f-4175-b420-4f02c6f06f03", "comment": "Malware payload (Mirai)", "value": "f54906f1ac3278e9c800cd98cadef3b440330504", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623426924, "uuid": "d706aded-f374-42fc-be87-61e2e461ab48", "comment": "Malware payload (Mirai)", "value": "47763b6e65dfda6a935bc04909bff6476d1e7555e9374c3685a2a84534c6c409d0c2f92f8a72c1797fa3be893b0ce1d2", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426924, "uuid": "5593cbe1-d8f2-4166-8d7b-29afc59c4c67", "value": "D9A2E12C66B17C51EE304E7BEE7B865A0B5B2BBEE57533300800D5B49A4E543B5B8323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426924, "uuid": "2b14ef43-7a3b-43b1-a1ea-d4458db802c7", "value": "384:cxUjQBuSsS1Rg/+NF+3S2ftAysoMTXGNo+StEvcmTLDT9KeYLuFQhymdGUop5h7:bjQBuRPmFiSg58TXGNOtEvB5fes3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623426924, "uuid": "cfe69b32-793f-45d6-80dc-846cacac6672", "value": 22460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623426924, "uuid": "2755b69f-4b62-42e4-931e-05ef7e8a34dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623426924, "uuid": "f4d0b3b5-7083-4fbe-9c21-e5b4d473e7c3", "value": "6ba50fa1ff0bfdd952b9a98b06a5c24d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5410f595-ca98-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623404115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404115, "uuid": "f6530302-03c2-447d-b4b0-30e8711365ee", "comment": "Malware payload (Formbook)", "value": "98901aff995d92677cf637b241ae9a9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404115, "uuid": "642e61fb-a699-473a-875e-8121e0111590", "comment": "Malware payload (Formbook)", "value": "fb6e849cd3af7e8b0c8143397e62a595a42abbfbbac81f2cdd0b2cb4d18ea543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404115, "uuid": "0affdc25-baee-42a5-809a-f859eb373c8c", "comment": "Malware payload (Formbook)", "value": "6dac1968c4a9ae4bf26f7fd38efb721fcf7d05dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623404115, "uuid": "14b47eaf-c2fc-4aee-92db-c9efdbd55327", "comment": "Malware payload (Formbook)", "value": "730237c185e6f6b12a6deba80e5ca54e863451528d73773f894202311cdf8dcd743adbdff98061ded8399405e0c836aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404115, "uuid": "688adcab-c968-4de9-a777-49e2eb766f4a", "value": "ED3412BB75C0987BD677F5315573B3B6AB7633205632009F9B640FAF01A32C3A45828A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404115, "uuid": "8a21f847-b6dc-46f0-a64f-9ec75216890d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404115, "uuid": "2c2a9c70-18d7-408b-97ba-12427676e599", "value": "6144:Ds9q5ND7xrAX/6ccjpGYZ/T12D2TLV47VVgLP3CATNTLzcocuk:ySD9rAXCccjN/T1TRXbtcuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623404115, "uuid": "b65799db-c1b2-4305-873d-eb47d847434a", "value": 246224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623404115, "uuid": "2bc934d0-8f88-4f60-9ccf-37bd344f12a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623404115, "uuid": "6527369d-3ccf-4fa3-8c23-d291c8d6ac73", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff4c061-caa4-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1623409504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409504, "uuid": "bf12b804-f558-4d28-8a99-61aa6ccc41fc", "comment": "Malware payload (CobaltStrike)", "value": "be04a2c7784cc2a0fc9dd34a363a63ec", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409504, "uuid": "e3070d5b-c0e5-4ade-8443-cd29a8b81296", "comment": "Malware payload (CobaltStrike)", "value": "fcbf15a8c932aa749809057c1f96d82e94eeb180436aec89db035b7a0ec3b147", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409504, "uuid": "7bc2747c-a4e2-430c-862e-2bc96849f9bd", "comment": "Malware payload (CobaltStrike)", "value": "874a47356d764fac316286728cf40588efad7a95", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623409504, "uuid": "e14baebe-7303-47a7-9ef9-efc2128e6cff", "comment": "Malware payload (CobaltStrike)", "value": "d6c4e2aec62da247099ed5797245cb7f6ebe55ad322134734ecdd6745822428588f28da17c79a7ccd73f5c58ea961860", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409504, "uuid": "3d1a00bf-3084-4696-9129-4983b824e037", "value": "C9557D51FCEF60F1E95252730CB792EF2334A10D1732ADC3D948AA7AA9639D11A32375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409504, "uuid": "4442a81b-bf7e-47bc-8a9c-555d37e99982", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409504, "uuid": "ae6ee2d4-622d-4dbf-9ec8-aaa191668b64", "value": "24576:JVWiaUKHOnrhxPryS5+NbQuT9aSrBRJzEj1DSC4:J5PKhPT9aSrVzUAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623409504, "uuid": "ea2dbe13-902b-4714-b90d-e0233b04fb44", "value": 1323520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623409504, "uuid": "75082e83-6eda-4a33-9d73-ef0eb49bfcd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623409504, "uuid": "3008d356-840a-45d5-8a11-dc6ee3e4506b", "value": "fcbf15a8c932aa749809057c1f96d82e94eeb180436aec89db035b7a0ec3b147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753900f3-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423498, "uuid": "864c7260-532c-410c-ab77-e496a545235e", "comment": "Malware payload", "value": "3697e6beaadd3c80156ac8f688e6deee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423498, "uuid": "10d71a01-2e9a-4f1c-980a-3bfd3d919577", "comment": "Malware payload", "value": "fccd50869ae6912cfe6133d4de86ffa78f02886d77c45919080f2d28d7fe818c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423498, "uuid": "3c3d892b-3914-4b1d-8e9a-b80411746142", "comment": "Malware payload", "value": "7ef94beaad7978c8122cbe4fdb76528cc1145551", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423498, "uuid": "58a295e7-3c43-4741-a8d0-cce80431154e", "comment": "Malware payload", "value": "2e3ca3f1d88b315b5215eb3c002c8c5797b1c588945b821ce40d8444317d369cd468e0624724e56e49f4a3ed54d70327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423498, "uuid": "11c92b50-fb75-43d0-b801-21448895d089", "value": "5DF2E110EEE1BCB0C6E03C374DE94E807F8B9F79C5EE741210979264DBA354AA78D54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423498, "uuid": "400894cb-7e51-44cb-9ad0-788f4e4bfdd8", "value": "768:NlNH9qzzMt761+NRsy1Sn79c6p3/f14AJFL+9q3UE7GCGbR4GX1b:NvdQm768NSfp3KAXLj7GCGbR/Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423498, "uuid": "aa0478f6-0b85-408a-9fcc-7055bcac2de6", "value": 34760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423498, "uuid": "bd490c4d-ac43-4063-882a-8330738c93b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423498, "uuid": "3d358e97-3787-4cc6-8ed4-8891ffe0b3f9", "value": "3697e6beaadd3c80156ac8f688e6deee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9621ae40-cac5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623423554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423554, "uuid": "e9cbdbf2-6264-4a13-b5cb-90b8e25b6f12", "comment": "Malware payload", "value": "bd8d118001fdb3ed92eed4b90a37215e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423554, "uuid": "1293979f-45a7-4682-a9a3-7355375772ab", "comment": "Malware payload", "value": "fd190aae8249fb8540dbebd7ccc0c09ef8bd3ff4dabbee8b90ca8413cb6edbbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423554, "uuid": "28d9b1d6-6845-4d12-b022-bdb6614ca6fc", "comment": "Malware payload", "value": "b2a8bd8e6207ac2a720079d21f2f8e1db6ae3c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623423554, "uuid": "815157e3-820a-4b9b-8bae-6c7c494a3988", "comment": "Malware payload", "value": "d183c615229425bb0230bab708573cd8e65bc3d17edbcb8e4cd0b2da34f014f596d84ac249ca51aca4a4c6bb7d2ff575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423554, "uuid": "f64e2b1f-32a5-431d-a56a-f696e30916e1", "value": "8882D030CDF13757F9649172D6163A1F7219AC880D3342659B8E3329A64D6BBB00DEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423554, "uuid": "ca9700ad-3978-4663-b3e3-6e924a55a0da", "value": "384:3LRv21TXvdN5Bl7q3I92Zcv/DiZs7Z3zn2XfdT6:lvKvdNv0I92evGZ43rcx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623423554, "uuid": "2508bf7d-be26-468d-83cf-b205ce4cd1ae", "value": 18548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623423554, "uuid": "a26b11d1-013d-4225-b4be-dffc83c8060b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623423554, "uuid": "76e42ae4-9472-4e75-8322-324b9bf33c0b", "value": "bd8d118001fdb3ed92eed4b90a37215e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc6d489-cae1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623435646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435646, "uuid": "df6f0028-b1ba-4631-8760-c73000acc88a", "comment": "Malware payload", "value": "0d36f4f5a1f7bc7d89fbda02be7c2336", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435646, "uuid": "022b1a03-fff1-4a4e-9681-9bf7ed3cbb41", "comment": "Malware payload", "value": "fd740b70649f06269bf8fe2d0d4fdd87d99606a7a666c4f6a2fc89bee70b6649", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435646, "uuid": "7085ad28-314c-43e8-a6ae-a6a008066978", "comment": "Malware payload", "value": "4c8eedc9e39ff04d9f7e38838dd6aeb375c3eb3b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623435646, "uuid": "64643688-0a18-4ee9-b197-a09cf33d9e53", "comment": "Malware payload", "value": "47d75b5f8fbae976bd8322d81909dbaf1b67a0585006bf24b011e2931e9d6df266b33548d97ef89345372078f160a8a7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435646, "uuid": "7375ec98-ac7d-44dd-b1e3-5f32744885a9", "value": "22E2D0BFC059F059E5BA9A3A5045E1F4FA5041C163A3988C2517F6ED8B024EF834EE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435646, "uuid": "7044d441-abca-4a3c-9c3c-3472d728fd71", "value": "768:VTIcZUfspiR03I6RkaEdssHq4terj+Wg/YibVWOihWejiV2E6PNj:3Ufs54GzEdsswdyYiwOIWeG18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623435646, "uuid": "d0284925-f602-4437-a330-a57ba017782e", "value": 33373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623435646, "uuid": "90491ccb-29c5-411b-b07a-4826005a38c8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623435646, "uuid": "2c48ba14-7fd2-4ccf-afd6-ab78322c02cf", "value": "uAT87WmEo3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50bcf67-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427041, "uuid": "2d93601a-4e82-48aa-b778-69c139d0b007", "comment": "Malware payload (Mirai)", "value": "840576485f82a6fd5ac4deb49a1e2768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427041, "uuid": "ffd62319-f662-425a-804d-16886102760e", "comment": "Malware payload (Mirai)", "value": "fdacdb1eada31b76cb24ca4d492e847e981b0569cae84ee0cd3932c0ee281e11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427041, "uuid": "dae5bf30-7953-4be2-ad66-d3aaea42a8b1", "comment": "Malware payload (Mirai)", "value": "653e99d5695b497c30a42c779ed273423484545b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427041, "uuid": "f1b0f884-622f-43d7-9e1b-f52e60cdd256", "comment": "Malware payload (Mirai)", "value": "24f3cc3ca7f9762b9068fa422e2eeeefe717d4cf53c28f757817f02b6e99b342bc35b11bcb47ea8b9b4ca41fa6c545ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427041, "uuid": "bae08e4d-ea08-4b1d-92e5-6df3be69d0e0", "value": "B023F1A9E65105FEC15D10BDEBF0971A0F920BA4A703AF84754E9B86AC16BA13C57FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427041, "uuid": "4c5b2279-d7d0-4b65-8aa0-e5440d1988f4", "value": "768:8S53ybaKm3DPbKRj78c4ShLkO6f/a9PWUSF1/EPOr5LeftuUSbOb0izPIbvmQUKO:5dXTPbYf8c453aZWUY1/EP+5LeftuURX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427041, "uuid": "59e5b23c-bf5f-4f63-b3e4-71bf926a8ec3", "value": 48288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427041, "uuid": "505531f8-5f2a-45b3-a837-17f4932f1391", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427041, "uuid": "b8f41fa5-45c9-4280-8ef5-e69a811dbb84", "value": "840576485f82a6fd5ac4deb49a1e2768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa01883-cace-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427266, "uuid": "57da8081-cff5-4978-b16b-63175bad3e58", "comment": "Malware payload (Mirai)", "value": "bbf5699c985e0333ca1e6d687ac10391", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427266, "uuid": "667eaae7-8e1d-4a0c-a26f-9fd08cc622ca", "comment": "Malware payload (Mirai)", "value": "fe5eaaed479ce0a0fb1db9e0d612a1ad91f953477cd814a6d89cd8d49e023757", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427266, "uuid": "b72ebb38-27b8-4ee5-937c-ef83011d4eee", "comment": "Malware payload (Mirai)", "value": "8b88765bce2ea6bd53a634dccdee7ec3ea7a8763", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427266, "uuid": "37ba73ff-b9ae-4de3-a18f-9099d7bd1d4b", "comment": "Malware payload (Mirai)", "value": "24a0e05ce98051b5a6033e680a075ae35bac157b5463f0b0af6c51c27ef068e7a9319d1ca297303a2c3849c47e80c196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427266, "uuid": "07ad548f-a12d-4831-ad71-850ef0be2071", "value": "2B92D07953CE0F3EDA5532FA42DC34AC38239CD6CB8A063B999674A653D3186342572D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427266, "uuid": "acb63a1f-ada9-46a7-9b16-5fa4f7702e1a", "value": "384:M0YEiiiJNy7q7yNo6ugzAfQpEMk4X+F3QJNJgY7oruyurrIv1RP:657FtgzAYHki+FugP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427266, "uuid": "922dabaa-a2cf-4715-b219-6ccc2747bd7a", "value": 19608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427266, "uuid": "a16b87e2-aa90-4304-a85e-a4674d70b6ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427266, "uuid": "17cc844f-8757-442b-b875-9cd4d00e956c", "value": "bbf5699c985e0333ca1e6d687ac10391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4cd75c-cacd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623427054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427054, "uuid": "8960cac9-7918-4ffe-b3dd-3773f7e24602", "comment": "Malware payload (Mirai)", "value": "cbaf39529f71bf70581be175d10ecb26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427054, "uuid": "3e2adafb-e874-46c6-873a-c51deb4c53af", "comment": "Malware payload (Mirai)", "value": "ffb7ba461797409eca33e3ad7fa328b9e1ea574530d85f00c055d8846bcac499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427054, "uuid": "11bda431-5f1e-4b51-b1ed-f901281e397d", "comment": "Malware payload (Mirai)", "value": "1c1675efe977fb9f20d6939330f9f310b3e60e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623427054, "uuid": "54bcce28-1e57-4ed6-a85b-6a080c58eb53", "comment": "Malware payload (Mirai)", "value": "fb5dce8ab15fa6b676b2bf8edf04c27d88f3fe77c41f338f9c63b12525b032e1c67f16528c8c9aaf6200960225e58ed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427054, "uuid": "1d297bd7-4799-4d84-8a6b-e74856d2774c", "value": "7823F18FE9A43849C84FDDB721ED0F669CEC61C03397568696BA14CD271245FA9890EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427054, "uuid": "0295212c-e020-40b3-9bcc-927b7eeeb53c", "value": "1536:u34RQksgfJmpfH6WhRUyCanYLU4fPb4++X1V1p:uoRTsSvORUyCanYL4+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623427054, "uuid": "1e449db5-bd61-4376-ac53-78769b4e4a4a", "value": 49268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623427054, "uuid": "2ce01521-52bb-4e48-9038-eab1461df874", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623427054, "uuid": "4be569a5-2743-4ca6-b91f-423bda2211e2", "value": "cbaf39529f71bf70581be175d10ecb26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }