{ "Event": { "published": true, "date": "2023-06-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-22", "timestamp": 1687478581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1dfaa5a3-c2cc-4818-832a-149be3a4355f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e6badb-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422557, "uuid": "812c506e-0c44-4620-bd5d-17c9f2cbefc4", "comment": "Malware payload (Mirai)", "value": "19d1deea485742d1e1753b4472163622", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422557, "uuid": "99ef3ed4-5a44-44b9-b36a-5854c40fa426", "comment": "Malware payload (Mirai)", "value": "0112075ffecda6cdfdcd100b49c2a6275d9846a548bfd3b3e7a3a931b7559fb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422557, "uuid": "3d370da0-e3ba-4bbc-9397-5dd8c34a655b", "comment": "Malware payload (Mirai)", "value": "f721b201720c4a809f2b474f82ef3cc11cafbb72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422557, "uuid": "865208f5-ffe6-40e8-baa7-812471fa769e", "comment": "Malware payload (Mirai)", "value": "49302159676e3d21dc09eeb69b7ebd3e867edf8ecc45662b4d7e23f5eb3d9c5da508698dcb5348dce04388b3069ed53f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422557, "uuid": "65f6184c-be3e-450c-9d5f-429c736d674e", "value": "T1A3732756BCD28A2AC6D023BABA6E609E3321B3E8D2CF7217DC144F5476C951E4D73B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422557, "uuid": "75475753-c1a9-4456-ac68-14a42008fafe", "value": "1536:cmClaYbHGyZ9jw5CjRSVmZf5oYIDAVffjSztupHj2Rj:cmQaYGXSBAejsGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422557, "uuid": "2bf6ad0f-4339-4bd3-8d2c-c84e5711fdd1", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422557, "uuid": "52c43f4c-f17e-405b-90c2-a7241b84e092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422557, "uuid": "c2d27590-5642-4a01-9944-c8ccec2e8060", "value": "19d1deea485742d1e1753b4472163622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdbbace-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687420864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420864, "uuid": "48c7b9c7-7d59-4a0e-b9c9-70fa68f180b4", "comment": "Malware payload (GCleaner)", "value": "204e590e00ffeb5da25aebb597052cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420864, "uuid": "b35bd0bd-239d-4220-bb0f-4de89f80d5f1", "comment": "Malware payload (GCleaner)", "value": "012943bdcc859b44a4b5f1b72431e9f7e1a3802419ce28b401825144e338a93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420864, "uuid": "07b04d24-a949-4fec-a2fd-5330a6c6bbad", "comment": "Malware payload (GCleaner)", "value": "a80d8e67ada0b2c3e64d7ed1b17febc483f98e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420864, "uuid": "54b672dd-d07a-4194-aed2-08c6431b040b", "comment": "Malware payload (GCleaner)", "value": "35a7bed92abff24890501baab601dd62cff44fec78e5aae36e3f3c4e8bd869e63d9e511cda13642cbb228fb5b3c4a169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420864, "uuid": "42da8689-6519-4f49-b080-6e005e310fac", "value": "T17A74390382E03D95E9658F738E2FC7E8720EF7508F097B65222C9A5B24B91B2D177752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420864, "uuid": "962875a2-b921-4fe3-bd73-4cbe0600c593", "value": "2e2bff69e94ccbf1f33f60d20c98521f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420864, "uuid": "f0b123b7-2bec-4fe8-9ad5-baa91d97ac6e", "value": "6144:hR9qBtblx4IKC72nwZVhGpbjbqeJbWJt6XWpR:3IBtBxLK7nw63bqeJbCgXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420864, "uuid": "8b638b97-5206-4f56-9e8a-1f7850a09941", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420864, "uuid": "9ee2ec5d-5fc3-4b38-82ec-cfb6147c669d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420864, "uuid": "251542bf-4570-4620-a42f-dd5508ed80c4", "value": "204e590e00ffeb5da25aebb597052cb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4266bb-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687423435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423435, "uuid": "4e18e1fb-1071-4f6f-888c-7b575bb41e1d", "comment": "Malware payload (RemcosRAT)", "value": "84357e51f150e2c152b439fc689599e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423435, "uuid": "47cd5784-7ca5-470e-8736-1ce33342b985", "comment": "Malware payload (RemcosRAT)", "value": "01a051c70476ff3fae38ab673bfeb567f80ebc9c5e8cc0fec03091b8c5d00bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423435, "uuid": "8a4dd41b-edb2-4b6b-94bd-f43df3267266", "comment": "Malware payload (RemcosRAT)", "value": "9acdc4fc2b9de5d49b848fcda4bf646be10942c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423435, "uuid": "ce7ca801-7cac-49a5-84d0-ed647bb88bf6", "comment": "Malware payload (RemcosRAT)", "value": "7185d8af172d38468c4acd52ddf57cd59b15e26ff80a9c9cc3030fa2989d120a78270815bc3f6b9b641fddf7c68daa08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423435, "uuid": "8378346b-ce12-4a88-a04e-6db9b6ab3d12", "value": "T19FB4235B2D2090E7ED7549301DBD57AA4D76822568AEC6CBB7006FCCB3538E2C948BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423435, "uuid": "08cd28ef-c327-4b87-b1d8-30743dff0d4a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423435, "uuid": "9432a242-07d4-4e36-92b9-87367e172bc8", "value": "12288:nYVRkujIsT9SN77LYRtO5dgMI3pgHkjP/8kPfc/kLC86O:nYVrIsBSNUm5dC3njX8kPU//vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423435, "uuid": "cf32183f-0a5e-4a33-98eb-e28167ac6a01", "value": 533654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423435, "uuid": "6f7500d8-a85a-4690-82fc-a98e5d32818d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423435, "uuid": "61c36de8-5d5f-4707-952b-dc4e49d7768c", "value": "Original Shipping Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3375a4-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420997, "uuid": "1e02b075-0662-4ec9-9d97-02ca1e5451ac", "comment": "Malware payload", "value": "b5b899b0b2f554d8e7891d02adb6e332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420997, "uuid": "cc8da4e8-bb3b-4e79-8a24-d5c952b100b6", "comment": "Malware payload", "value": "028ffd5d14f8bde6523fa0a797f0f761a85b6dbe3a083e4b80f5601e3124dbdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420997, "uuid": "7d070c3f-38ab-4937-8e66-4b9e67881962", "comment": "Malware payload", "value": "400e59667fe84d0554f9589c7db291f22c9ad1f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420997, "uuid": "2cdd5fdb-7928-4169-afc6-9e6a212eb088", "comment": "Malware payload", "value": "6a204b33e90f9c69c2b47bde17b902338440d8fa8ec1bb5e15d7a1bcb327b5c972b4c68cdb8cd54acfc775716c922d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420997, "uuid": "4425aeac-093f-4862-a1a4-37bc9886f12e", "value": "T12FF40281B4C4B238D8361531EC567A837EBCF8A14E70989F3F94770E8A765E0B9B451E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420997, "uuid": "7bea3bb8-8ae3-49b9-a0b3-bcbafa4119b9", "value": "12288:NO5jkR8v7fWlu+T/BkiU5ggIaN2ggM3DBAEeVkp5ViuIdvLK8A21FXMqLT+a8z:PR47fIu+UP4ADKEeVkpOPZDRZLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420997, "uuid": "259db7a1-cc16-4ac6-9da6-c5ba6e2dc5a9", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420997, "uuid": "096fd1c2-4cd8-4e24-bec7-de7e98ab935f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420997, "uuid": "6e5f5afc-ff2c-43ab-99ed-3e78a6744ff3", "value": "b5b899b0b2f554d8e7891d02adb6e332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43daf63d-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687413274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413274, "uuid": "4025c973-b563-43c4-989e-5bef5c79103e", "comment": "Malware payload (SnakeKeylogger)", "value": "1cdf55ae4891092976bd94ef128b552f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413274, "uuid": "b820ea67-2d64-4d7f-a60f-f81e41cef3f9", "comment": "Malware payload (SnakeKeylogger)", "value": "0505a83f8b89555c287f424a587c15079ba811c88018e320be74bcc7e4049524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413274, "uuid": "13ca3402-7bb7-46d4-a23c-b5760aaf3f5f", "comment": "Malware payload (SnakeKeylogger)", "value": "0b8753f4efd725200873cf11cb8119e64471c874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413274, "uuid": "c13c1e7b-6b4c-4cff-84c9-248b970b4570", "comment": "Malware payload (SnakeKeylogger)", "value": "2d8a7a9b3ceebfa67477f3299f4df25e0cdca739de4261180fc5129f3c033e1913dad0d02fbc2c3da059280b0d5feff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413274, "uuid": "3ed98a5f-07b8-4d6f-9d9f-4c5ad56cf6cf", "value": "T1A9F4D0907BED0F54E9BEA7F5893462700772BE2E242DD28D1D92B0DE5971F800A52F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413274, "uuid": "26bb295f-a063-4566-8981-11b4898aa7a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413274, "uuid": "9c9d5a97-1291-4c8b-ac99-a03179b7c471", "value": "12288:hFi7UP1J2pdvDhH62MmgPFvXFUMScFtDLMVG6hh8Zezo0g7p/mu7/iJKuYXuZZ:hg7U8dvDcAwVXFrFtUdh8Se7KZYXuZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413274, "uuid": "9e210ca2-0f29-4de9-bcff-3c27f70ca41d", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413274, "uuid": "a4975d18-29d8-4ece-b8fd-3e8bfbd6533e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413274, "uuid": "adb76e6e-e279-45a5-afaa-f1a7a393f810", "value": "AWB728590890733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0fa05a-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687455323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455323, "uuid": "4fa4ed96-0431-4fce-ba74-7b3e3d0047f2", "comment": "Malware payload (RedLineStealer)", "value": "326d5dd91343696d86efb1781d4ae6ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455323, "uuid": "5f340ff7-e1e9-4fe8-a43f-8021a9b0627f", "comment": "Malware payload (RedLineStealer)", "value": "054f9326f802b5d899324d452292f32e9c16a68a759e8437e170ef0ebec48401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455323, "uuid": "ff04b7c9-b64d-4dde-a89f-0f599c94d59b", "comment": "Malware payload (RedLineStealer)", "value": "8c00cf3533de57a026b70396d7cc9071876c94b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455323, "uuid": "3df105b9-4390-4a6d-8d55-60e47b6dd187", "comment": "Malware payload (RedLineStealer)", "value": "ff9c733c5d8e51b458f8d4af3e77e930181bf3472ce7bfae2c928c3e7e5fdf3e1633c0aed49ad4b3017d7377c7e64551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455323, "uuid": "11a3a4e1-199e-4fc9-b871-fb02a113e312", "value": "T1D2B4F1DA26804573CE33CDB1D8AFE9E61E7A71200BB18BC7020D49FA4E425D5B61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455323, "uuid": "7a81d0b3-3ade-495a-b22c-9d762b2b6e94", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455323, "uuid": "f9cd6368-3701-4a42-9b7d-037882cc7c97", "value": "12288:9UJaRTey5sqbWFQgiEkC3ZDH/RgBDQJQmZ:9UJSTey5sNiEx3R/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455323, "uuid": "49855396-4b85-45a6-bfc3-081aa5b88eb6", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455323, "uuid": "63317dfc-6caa-4f9c-9446-807f4e6e4f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455323, "uuid": "4a5010b2-ca9c-44c2-a5f6-96ea04aa5716", "value": "054f9326f802b5d899324d452292f32e9c16a68a759e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a969f9-10a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687400876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400876, "uuid": "788f1d26-9d60-4e84-9dfd-54b087aef6fb", "comment": "Malware payload (AgentTesla)", "value": "344b39f7523e98c66605cb8c6154f099", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400876, "uuid": "682a1ef1-084a-49da-9213-2905fdc07b1c", "comment": "Malware payload (AgentTesla)", "value": "057b5a69c942a24a0fc9818ea3d08c6479ef6af994938f9023b50b952f8186b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400876, "uuid": "5649b26c-95af-4877-a0ff-4d0c97ae7f66", "comment": "Malware payload (AgentTesla)", "value": "127c707fd091e5468b51a95487c7a1689bb10bec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400876, "uuid": "3dbef43f-f3f8-4917-958f-1dd23ea4dbee", "comment": "Malware payload (AgentTesla)", "value": "9fa3f850cc91fa11fce16342573cf14e1d0ffa00f30758917af9f1405b364bab17191f3ded97f6a6d6ea6e9872f2ddc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400876, "uuid": "f31f7bcc-c923-496b-a984-ab8f9f3862ec", "value": "T11DD41249BA2B0760DBA54BF0186616718B7F9E9E3032E70B8ECB70D69725F0B5841F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400876, "uuid": "e026ef69-1080-4a8e-8f3e-9132e7399ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400876, "uuid": "c1e4fd95-f40f-42a8-8c31-142932a4b827", "value": "12288:jpdvDhH62MmgPFKLjebz6G16zuD2HRhHTkcWVaH2DWI331u9ZJL7/NA:tdvDcAwYjWn1Iu8Af0HKWIn49ZJLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687400876, "uuid": "ddd9d6ab-8b63-4e36-9747-3b972bcec72b", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687400876, "uuid": "21430872-5423-4851-9d56-4a02ce6607bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400876, "uuid": "3a944c48-8bfa-449f-8511-03374afd9f3f", "value": "SecuriteInfo.com.Variant.Strictor.279944.20742.18527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2973452e-10f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687436852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436852, "uuid": "508ff0ef-d1ba-4d7b-a2ed-e59fe8d36426", "comment": "Malware payload (Guildma)", "value": "3a46c5552bb9d29f9e7f184eb18bf918", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436852, "uuid": "ebf7c344-016f-4b13-b641-8a3de5d6bdbb", "comment": "Malware payload (Guildma)", "value": "075320954a8b5e1c58da12682d58e53e4b839a10878abe07f81c77d1eaf37dbf", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436852, "uuid": "66505f89-bb8b-4c36-b5b1-17e165feb0f5", "comment": "Malware payload (Guildma)", "value": "40ef4dc061f90b9b04498a14a32c38fb3db793d2", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436852, "uuid": "fb3abe85-a510-4b2d-84a4-72723859ea53", "comment": "Malware payload (Guildma)", "value": "e83a15d3e699c6425d298ad37e1e7243f1b40442839511672ec36b03554fc5ce6e7f8b26c9658ad89ea296f4e143fe8a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436852, "uuid": "c9c46e9f-0c22-43de-8d35-5dd7d902e6e0", "value": "T1991100A553680EBED47603B1CC35BD0CC8B69C724F4FA07EC9177980C5215D11FC0606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436852, "uuid": "4e66dbc6-db09-453d-8d98-ef7a009299bd", "value": "12:8rflM8OByN6/J6MgaZvreaTASq9VIB9VUaVuRj9VIz87KZIxi7SzrJdUTY/k+jFq:8FN4JZpbTfn+a8640u9MZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687436852, "uuid": "445c9184-045b-4f14-9799-f58e51b9e24e", "value": 947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687436852, "uuid": "0550f04b-9e5b-4f46-a0d9-8276752d07e5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436852, "uuid": "0e74dfea-2fef-4ebb-9e9d-414ce6fbc674", "value": "MLP3PUK589519J19663098.410217.33255.LnK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b65453-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420849, "uuid": "0aa6664c-4446-4df0-84a2-df89e2892dc7", "comment": "Malware payload", "value": "47c39b35c37a3b21e8a160463049b367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420849, "uuid": "d9f0f4ed-4f9e-483c-952e-815f1322c478", "comment": "Malware payload", "value": "07632404faa7fd83a0f1e4e9da20173c3f9ca38affd286a90dc362c73b26ee8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420849, "uuid": "aedb3328-880e-4f06-ae6b-8e3bf4c7998d", "comment": "Malware payload", "value": "6bc6b1097fd5bd4c12fe872b230a0cf8e6484a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420849, "uuid": "1b9e7383-6827-4864-93c9-023048548174", "comment": "Malware payload", "value": "165b8f8839c1e847f58162ab2d616be048b23f3ca9e72dd07d7b0ef48c18490d14e25c6c2689f0bd932778c8d85820b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420849, "uuid": "1a95b080-a68e-4981-84fe-d5ad43a8b823", "value": "T1914601320532BDFE876C389094052B452CED58275359DFACFA4414EF29A1738EA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420849, "uuid": "0a551bc1-4e21-47b3-9e02-7a1415f45263", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6R:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420849, "uuid": "8af177ed-e9a3-4055-a618-a11c876f201b", "value": 5795483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420849, "uuid": "34d0e1a1-3693-42da-a681-fe84ab478f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420849, "uuid": "d1cc4df6-cc82-496c-b036-164758050c7d", "value": "47c39b35c37a3b21e8a160463049b367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd15b80d-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422551, "uuid": "fe945e33-a422-4872-a1a4-7c2b11fe806e", "comment": "Malware payload (Mirai)", "value": "65764b34b3b7c835bda6689a27e499fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422551, "uuid": "a08269d5-bb7a-44ce-a327-0fb536607c84", "comment": "Malware payload (Mirai)", "value": "082f7a63e551c2eac189df0998270b6c0e65c60629cd49a6912bd793db8f4a09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422551, "uuid": "17c8b5c2-0c62-44ec-8a2f-f3c2f5890718", "comment": "Malware payload (Mirai)", "value": "7bbacf1a3485f70060f4ba5704503548091f1df9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422551, "uuid": "7fecd868-d809-4532-9016-1fa5175673c4", "comment": "Malware payload (Mirai)", "value": "4687b99e0594f9eca932f95611b9a952a805de4bf45eab8222f94b96937bb6a498835d0e18b972c2c1f529e8b4d29da6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422551, "uuid": "9671908d-43d2-4326-93a7-833acd78fc0e", "value": "T14CF34C46EA818E13C4DA277ABAAF414E33229754D3DB33069D185FB43FC67AE0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422551, "uuid": "32178ff3-969f-4980-8678-67af8a096201", "value": "3072:IR8CwaLbTLImyW28mAvnX4c2PpcCYDO3GFLDOYgfNvTXfD7w6TM/9mWS1hV:IR8CwqbTLIPW28mAvnlcQSGFLDrKNn7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422551, "uuid": "d61aca7b-4a33-4216-87d8-5bbd499c6052", "value": 159934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422551, "uuid": "f8969265-138d-453c-9d93-1aa937430b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422551, "uuid": "bf66e099-49be-4306-bcd3-e39ca0d3377b", "value": "65764b34b3b7c835bda6689a27e499fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281ca05a-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687414087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414087, "uuid": "aaf87b4d-b417-4128-a919-fd135f6893d4", "comment": "Malware payload", "value": "8d4f1a9b820a7f77593208a8d9a8a3c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414087, "uuid": "08ace373-c986-47e9-a5b5-0d56bb0a9175", "comment": "Malware payload", "value": "086298202ee27328c29f6867fb0bd007ac12fc3dc97262a46fcd65536f77feff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414087, "uuid": "75adebea-a245-482a-83bd-3bbe2136a0dc", "comment": "Malware payload", "value": "f04c45fbcd1695c39b69f77bc4ca79ead497114b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414087, "uuid": "1e0e58ca-ffd7-41d9-9315-a2140f97fc86", "comment": "Malware payload", "value": "ae31d160c5b7e67ee178e05c913ac0a8ee01bcecaa723b777bd380511774caa9f551169a9821d1cfc19189e572b47ecf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414087, "uuid": "fbbe7021-05f7-4869-af9e-7176bd312085", "value": "T10BB222463E866D82A74EDB3B371BA1D4C3EB5CA5E08069CBF980FD52E0D5636E5C1530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414087, "uuid": "a3f785d7-9ca3-4601-b153-9cddfead74ca", "value": "768:Twcdrf06fpnnHByxHFdnteRbguulFINp/R7wvoCxPKefF4fQfU0suHiYVtsgW8/M:1s6FShJPWo621n9UCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414087, "uuid": "f27ecaa8-b693-477a-bc42-295adcfab49e", "value": 24845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414087, "uuid": "afce3438-3967-49bb-bfdb-a550ba22c69f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414087, "uuid": "4e66c19c-9fe1-42d1-9c7f-b9d40dd8b244", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b745fb0-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687430091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430091, "uuid": "5a516641-d22b-46f3-bdca-fbfa042ef649", "comment": "Malware payload (GCleaner)", "value": "693919e787c7343bcf3564576a584841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430091, "uuid": "fcc833eb-b0de-46a9-b81e-9e7071e9c785", "comment": "Malware payload (GCleaner)", "value": "089a2e16d3017ceb7504ad67bcaebb673dbf2b80317229718557439a4cb52504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430091, "uuid": "bd2758c4-94ad-4431-b3dc-df5870ed98a3", "comment": "Malware payload (GCleaner)", "value": "e10801538bff3ea1a1805e4419e04a82a0ef89d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430091, "uuid": "8238b114-c89c-49aa-9663-5c744a861f0d", "comment": "Malware payload (GCleaner)", "value": "0016d8df958fba814756f96941f3d4f3565b019dfb8d1dd513490ff36340c5f4da103dc64cb1737704b31b91b873ef79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430091, "uuid": "48b1c6e0-e9a8-4f02-b80b-9618246f88f1", "value": "T18974CF013AD0C432D52271758536CFB15A7FB4B52B669ACBBFD81AB90F246D1EA3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430091, "uuid": "811f8999-4e0a-491a-9b5c-c857f3639cd4", "value": "4c7f209181ee40b674200cb9d1c76dd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430091, "uuid": "cefc8351-95e4-4538-9c10-f9a03286fb73", "value": "6144:9zSuwaAM9xq0YvCEG+HsFyjbKJq2TmT9FfB2eQx6rJBxruQmbPJ:Muw7Mzq0cdhMFyjbH2w9FMbSRmbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430091, "uuid": "a14d7bc0-8da2-408b-bb16-c8bb57d6df2a", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430091, "uuid": "e0ba4ccb-9d87-44a3-8229-130b903f5faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430091, "uuid": "c0f26f03-836a-46ea-b811-f941e22c571a", "value": "693919e787c7343bcf3564576a584841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e131b97-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687422660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422660, "uuid": "7302137e-f1e4-4c5d-946e-c3929876435e", "comment": "Malware payload (Formbook)", "value": "223de4efb0c50f487d0bef8adeda7317", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422660, "uuid": "5eafbc50-d998-4030-854e-f068b8d7f535", "comment": "Malware payload (Formbook)", "value": "08d32fc257cd9dfd7bac9f1e5fa15776d6842bed5f695a24f7345556af00bd4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422660, "uuid": "fcc099c2-f7e7-4f46-8101-f500a4094a25", "comment": "Malware payload (Formbook)", "value": "c596e72e27bcdf070fd19fd461d48595878fd96b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422660, "uuid": "86789a03-b0ec-4b49-9697-0bd4bc78f0aa", "comment": "Malware payload (Formbook)", "value": "f89338e8c75afc2c70c2c5ba8ba56afd35df7e259768f987bc26e8ede72ece3f05b4e10f630845bdff200bbba36e56ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422660, "uuid": "9c9ea6ef-5e93-43b4-bf5c-2689a46ee444", "value": "T1D4558D117A55C912C15D36F6D1A7603443778D822326E30AB9FA33A62E337EFDC1968E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422660, "uuid": "631e2c71-7f45-4d42-8a9b-06843a72a0cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422660, "uuid": "6ad4d3f1-adbc-4199-a48a-136b57b1e989", "value": "24576:m8uHRghqD6lcv9VAoNAtZSDXpsVvwqxzn:eghk6avYoO4XpsBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422660, "uuid": "31359ac7-f3ec-4e38-a652-242a7f63d59f", "value": 1283072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422660, "uuid": "655cf996-b4fd-4ac7-a742-719c2911738d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422660, "uuid": "fcd13ee1-9ee3-4743-ac05-c5ec08728162", "value": "223de4efb0c50f487d0bef8adeda7317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d885ee8a-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687414383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414383, "uuid": "1f37fc16-0680-4246-a87e-a6b2bc9517b6", "comment": "Malware payload (AsyncRAT)", "value": "ecc17b6beb46e39f66f996b1e5b4c30a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414383, "uuid": "4ceaea89-36b1-43f0-9ea7-6f8e454c82e1", "comment": "Malware payload (AsyncRAT)", "value": "09d28688857066ae36bef3cebcf4152c1c1a4007d12fdc3709761b717eb9309b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414383, "uuid": "0376786f-a4ed-486b-a490-d7d466ea982c", "comment": "Malware payload (AsyncRAT)", "value": "cc12fde643df2cff436ef13dbb363ece33e87143", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414383, "uuid": "298b44d0-f27a-4ad3-b7fb-f4b39bbc3504", "comment": "Malware payload (AsyncRAT)", "value": "dba5ea3c16e3e9eb6e32bfc62851edc5cda79d35b6ab667719472b607b534045be44b25759dc3b90763c11c6dadee367", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414383, "uuid": "ec4e61c3-261c-4012-85f8-749ccc458fa7", "value": "T1C7045B5837D80A15F3BE5FB8F4B012118B75B477AA1AE75F08E920EE0D62351E911FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414383, "uuid": "fce0a6ce-4dc4-4afc-ba29-758982344930", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414383, "uuid": "8178f81e-6c1f-4672-aebc-565d304be1dd", "value": "3072:ne8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTvwARE+WpCc:/6ewwIwQJ6vKX0c5MlYZ0b24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414383, "uuid": "b0eb61e9-1a95-4cef-9a34-bf98c8b7d054", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414383, "uuid": "b3821b53-0afe-4a3d-881c-3ab0812d7d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414383, "uuid": "09fc4315-6d34-4843-954f-3ec2eefe0711", "value": "ecc17b6beb46e39f66f996b1e5b4c30a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387f77a3-113b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687465654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465654, "uuid": "373cae6c-9907-4184-96ef-8f116142fe6f", "comment": "Malware payload (Mirai)", "value": "13493fdebea671d81952c8d579be7ce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465654, "uuid": "d99a862c-27e6-4745-ae3a-e410b60349ef", "comment": "Malware payload (Mirai)", "value": "0b363298ca0ec38d037031256e752766571fa87606c1064e8a60e6930d49f387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465654, "uuid": "4fe07226-bb78-4850-8296-c2939b30d338", "comment": "Malware payload (Mirai)", "value": "716b0b2f4c71895adc98b6164032e2b7c4d0f3b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465654, "uuid": "8e2956be-a672-4629-96ef-b90b353aa22a", "comment": "Malware payload (Mirai)", "value": "f72ca892806603a1a2d8c89828d2f6511699a817fc169d6197c8b736cdde7dd59b019aab8d81c17662fc4dfcdf9509c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465654, "uuid": "924b7c4f-c13a-4ebf-8ce3-6d14c05d90ce", "value": "T12C932A56F9815F22C5C512BAFE1E158D331317E8E3DEB2239D206F20B78A52B0E77895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465654, "uuid": "3cf367af-13a5-4d8d-bec2-63e0a4baa9bf", "value": "1536:8Gn+y7onFDaNS0N685oD+/yqIaEkLOBk6bdifb0Yna4xiqpMQiG3Dfc1uF5YYrj7:YNFDaXcUKMh6bdAb0Ynak3D01uF6UYCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687465654, "uuid": "82e25f5f-cfd5-4f9e-afe3-0c810576a0f1", "value": 96424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687465654, "uuid": "15939c48-6cb1-43bc-91fc-68641df62638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465654, "uuid": "4e1b5fb9-10f6-4301-af42-3bb13cebd490", "value": "13493fdebea671d81952c8d579be7ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c07a4ea-10c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687415946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415946, "uuid": "46517a43-7161-4b15-8dda-65f8051b5587", "comment": "Malware payload (AgentTesla)", "value": "eb57a2afeb9ad289051f6d3533d600d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415946, "uuid": "f6abeb5e-51b7-402d-89cc-785f0ff84055", "comment": "Malware payload (AgentTesla)", "value": "0b37019099dde1c099b071932815a725c85df546cbc156fc6db28fd0dc46e934", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415946, "uuid": "506b48a4-4fe6-4486-aaa9-67af7dcaeae4", "comment": "Malware payload (AgentTesla)", "value": "f5ddd043da6d278c8c9d17024226b01c29b310d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415946, "uuid": "3867a318-ae4b-46c3-a5a0-111f1c838f6d", "comment": "Malware payload (AgentTesla)", "value": "dc00b58d34004ec86f102967826da2b1ca10e3e3287450c2d09bc06696c6efa09f7ae7b1ecc4bf52c08ffa81d9abdf8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415946, "uuid": "8d9c27c0-ace0-494a-9749-e89acdff822e", "value": "T109F33A69A2C90DF1DF1C4075D5A1D148CFB2A157661BE76D0DA0ACFA3B0A3C3372A867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415946, "uuid": "ce6f133c-a7be-4c42-90db-4dc383e3682d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415946, "uuid": "80aff592-60b4-49c1-88dd-ba748af7f083", "value": "3072:OzvYkZ4Hl93N1QrfwFimWszlut0qkNVIMRuclyKGxOS8lMFdg8Fy:pHlZvQ7wv7utiNRlS8EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687415946, "uuid": "d65ee24d-1968-4ab2-822b-87d7599c36f2", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687415946, "uuid": "45e1d700-0dcd-445c-b7bc-2eadac8391b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415946, "uuid": "ae2372e7-0e89-4326-a7e4-13cd44b79054", "value": "1687415944d03c3455bb350ba2a97e50b1a205f189caa53e7e1889dd2a9e98ca0e65207a4c984.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b80790-1129-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687458237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458237, "uuid": "56e869cb-1f9c-4591-9bdc-f5d862dc1867", "comment": "Malware payload", "value": "53bd72ea9f6fb42ec84aab521196fb2b", "object_relation": "md5", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458237, "uuid": "34737a5e-3604-4bb9-a34a-2cbcde9b90b2", "comment": "Malware payload", "value": "0bd3e0aa6b37929c59bb1e19556abae27ad986f524279abe9472a0761f881ab5", "object_relation": "sha256", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458237, "uuid": "9da675f1-ea8a-4495-a31a-e327546da07d", "comment": "Malware payload", "value": "1f25cf56c2cf42b629dabc2bb8a5f7e4cef42c31", "object_relation": "sha1", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458237, "uuid": "250d8221-1347-4815-a2a6-37cf0364c606", "comment": "Malware payload", "value": "d3d2859032bf8fe338c49d63924271e54b06db19c10fb54c65dcdd7555e1d5c6246a7c8e523e07a9ee9ad9b0cd9c7eea", "object_relation": "sha3-384", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458237, "uuid": "828e6349-7462-42c0-b043-c93b29064b45", "value": "T13674496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458237, "uuid": "b1d80ae4-4ceb-4d28-8054-8a07f5bbfb2e", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593O:fIS1xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687458237, "uuid": "b5d9e161-16ac-4bd9-96e0-6e541af1a04a", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687458237, "uuid": "cf2d81a4-e6ac-4278-9aa9-1e0c22d08ed5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458237, "uuid": "cea89426-25cc-4f3b-8052-6a46037407d3", "value": "BSN-2000894948.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ee2889-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420529, "uuid": "379ea4ac-f607-4110-8f4f-8c345e5021a2", "comment": "Malware payload (AgentTesla)", "value": "e350fee128e974cdc1acfe3fcf2f43b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420529, "uuid": "ee14a147-fe5d-4675-8319-73b75e137425", "comment": "Malware payload (AgentTesla)", "value": "0d00e23ae3b37a998466aff5c579afa4cf1bc707dd66e75f09f3909dd4f38cc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420529, "uuid": "21e157c7-d1c9-4670-a00c-db5c78e0f71c", "comment": "Malware payload (AgentTesla)", "value": "98b94795ea257d73c1d0cc90d15878a88bfb0cf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420529, "uuid": "c9459f67-0577-4363-a40f-0744099df591", "comment": "Malware payload (AgentTesla)", "value": "1efb813e4bee6a58ad447829901497081e61ad4c50cea46f4908e5f0835f17f8d0e637f968fc5bfa233cd70141f1315a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420529, "uuid": "a724c135-f057-482f-94bb-2c20fb327a3c", "value": "T199E41248737EA327D9F383F184812A7543BB6E4D7422E7198E93F2EA0669F051350D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420529, "uuid": "93a11a08-480c-4418-851a-55ce359d1b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420529, "uuid": "0ce19c29-0928-448f-ac2f-cc18f6f4a3c0", "value": "12288:9dpdvDhH62MmgPF9PYEczFHfeUS3jgAK92p+EK+SBWpKX1R26L:JdvDcAwLYr5HfWlAEXpej26L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420529, "uuid": "7c73e5ad-f7d1-4be1-bd4b-82e3c1e5a37f", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420529, "uuid": "4f8a6efd-342d-4bd2-9f1e-bd60e26999a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420529, "uuid": "ae4e3f38-a8c7-4c96-8ecf-86f993bb5930", "value": "e350fee128e974cdc1acfe3fcf2f43b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b8cfeb-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687456756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456756, "uuid": "86e32c23-6a03-45fc-ab87-45c734a68ebf", "comment": "Malware payload (RemcosRAT)", "value": "6f5839689e8b33de7588d52d8728afe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456756, "uuid": "516f1c2f-d4b9-46a3-8745-1070ffde7ec6", "comment": "Malware payload (RemcosRAT)", "value": "0d771bed67134df3cfcbafe953d9378ca9a40ba93f05f726b9286638a08318e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456756, "uuid": "91666876-2105-47df-aa9e-c118d8400dae", "comment": "Malware payload (RemcosRAT)", "value": "908741c541b712bb7a439695cc76133af3854ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456756, "uuid": "e08c5fd2-853f-437e-bdaf-a14f49505ae2", "comment": "Malware payload (RemcosRAT)", "value": "d8410f716ce48e21566b16ab5b82649487034727dc38094d8ddad44aeea1bd6bde657966ca6b7274e782dda768c20854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456756, "uuid": "fc189149-db3a-43bb-b1a2-89c2cffd099f", "value": "T177F401C3BA0695B2C9521CB2657CED772E526C22258B15E263D0FF1F3873252862E7D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456756, "uuid": "e8fc771e-08d2-4da2-9c8a-f3f78a9a4235", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456756, "uuid": "81a9b8e5-8e28-4e12-bf0a-4aff3beee58a", "value": "12288:QzDDtEtrvgnhuy/C+I44tAD+fKJN5nCQaVMFA0WMk32Bd8u1L7nZ/8Ks//rhFSEz:CtEtrvgnhuy/C+I44tAD+fKJN5nCPVSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456756, "uuid": "33c8d3a1-506d-4959-b8a5-dae9dbcddb04", "value": 784138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456756, "uuid": "bf3c7b51-566b-47b2-8dc7-bca3e567150c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456756, "uuid": "bd4b0f13-477e-4c43-a7b6-be0142de98d6", "value": "6f5839689e8b33de7588d52d8728afe2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45315ce4-10e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687427879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427879, "uuid": "4da4d232-05a2-4ca5-ac6d-27986659a972", "comment": "Malware payload (AgentTesla)", "value": "8c6bbbb764c0d2a54954b8910b38b86c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427879, "uuid": "7ec624b8-239b-4b9c-a418-3f255c573dd4", "comment": "Malware payload (AgentTesla)", "value": "11cbc233ef5187f59c9a0e314bb8a9ac4d0a1d4c54cee653b1feaa386fb27cd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427879, "uuid": "120210fd-2500-4297-89b4-dc9e78f5ddfc", "comment": "Malware payload (AgentTesla)", "value": "2ac7c87e49c1712ded71ed1d6cc7afc56d7db2b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427879, "uuid": "7463c4dc-66a5-43de-9016-67fc05d86ad1", "comment": "Malware payload (AgentTesla)", "value": "c3bc1f6d001162fb570683412d17234b91bb58c610eb5a4acfaa387488f880c6a9a1d3ba680190f159a0e30a458d1556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427879, "uuid": "4b85b652-caca-4737-847b-a9beb1ec27a0", "value": "T19145AE08B5BABF56E57E43F580032C70C376915AA16EE7AF4ED620DA2F65BC4C485B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427879, "uuid": "890904a8-0e4b-4cc8-847b-ff09e77455d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427879, "uuid": "143ecee9-8920-4351-9355-c5ae63a7930f", "value": "24576:HdPO9JbbAH1dCbh72p8/ilhV/IvpVHVlOci2IEVHBnU:HEnbs1P2/c3QpVHVji2IE3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687427879, "uuid": "64fe522d-dcea-407a-9c3b-d6bf24b2f39f", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687427879, "uuid": "492279df-2cb3-4f21-a3db-e331afc630a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427879, "uuid": "ae4f6c2e-4d20-4349-9798-340b9cac31f1", "value": "Scan-DOCS M004K - M009K-COYHAIQUE 2210W-AIR_SEA SHIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe9eb62-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687413268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413268, "uuid": "7a1024b3-1c41-45c4-a2d4-2c65b013b34c", "comment": "Malware payload (Amadey)", "value": "95ded32aeb66b2588df85cd5ad5229ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413268, "uuid": "4c65ce94-2dee-4e65-8730-3d921fc25a2f", "comment": "Malware payload (Amadey)", "value": "121312c1dcf375ac0ba310f43084b4d185639d615b1183c900a483ad16e92094", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413268, "uuid": "bf3eb023-09ac-4e9e-8d2d-b8e63381d6a1", "comment": "Malware payload (Amadey)", "value": "58392246695f5931a8340d10e8b59843e18110ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413268, "uuid": "f348e925-f892-4b53-b9f6-0a674345f187", "comment": "Malware payload (Amadey)", "value": "91d4520aa06c57eaca3a992a92e83a74fcbfca560ad3e4206ffd819a314398323fb8bf004c659bfa698eabeb1d0e2ac4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413268, "uuid": "b6971cdf-9170-4b88-9965-651fef5c36e6", "value": "T177150102B6C0C037D57B35320AF4DB74857AB82107651AEFD7D40EAE4F216E4AAF25AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413268, "uuid": "9d33d40e-2e0c-4a02-9c06-13aebdb1b331", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413268, "uuid": "81044fc1-67c3-499f-8cdc-d25942264f3c", "value": "24576:Xk8eeVn/8ZafPRu90yr+sU31R5mkJ9te:08eeZUZx+4O9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413268, "uuid": "e4c9d11e-d5f6-4d5b-9ec3-74027f479399", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413268, "uuid": "0f97c233-887b-4c59-946b-7b08735607a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413268, "uuid": "5736cfee-af15-472e-9c70-38847e058225", "value": "95ded32aeb66b2588df85cd5ad5229ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18de8f51-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687430382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430382, "uuid": "b3c52d69-021a-4f57-9153-499222007a09", "comment": "Malware payload (AgentTesla)", "value": "d9d2018950259698ca61e0b9c2c33af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430382, "uuid": "fa5d39cd-74cf-467f-b1cb-1efa4ae16b4d", "comment": "Malware payload (AgentTesla)", "value": "122ec71f9f9911f8b80c2f2c5f26d66ffe2b62a190168ec0797072e02a8a3598", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430382, "uuid": "58d4f37c-ccc4-4603-8cd8-79cbe78c475e", "comment": "Malware payload (AgentTesla)", "value": "d829e6b268e88f6e7ce855aa3b4dd8adee716be4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430382, "uuid": "6a5478a9-090c-44f5-9e27-8a337cf93c78", "comment": "Malware payload (AgentTesla)", "value": "c0cacb34df6b703952e01930e4d382d87b6434b3f1649dc891f2d7296d88b6f726f31ffcf142710498c0609ad4c5028c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430382, "uuid": "99103bab-ab08-475d-82fd-2d57e21614d1", "value": "T1E925D0503669AF50E4BA8BF50860517057FA6E6BF43EFA094EC3B1DB25B0F028965F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430382, "uuid": "20d365d8-cc6f-407e-9188-d991869a7ee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430382, "uuid": "91b9a64b-d82d-4f27-aa3f-9edad6b52742", "value": "24576:07MyuyF1X/LwJ1KNo2hAyEiVttgORHYX0wCmEb4PiNFdXCw9gIyMc:07MyuyTvcJ1KNoOAyTt2ORHYXCjbwqPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430382, "uuid": "d69c4d4a-6638-4989-ba10-45fd5116c049", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430382, "uuid": "cfc54eb6-9194-4068-a459-63bd3cc9c635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430382, "uuid": "6fd57149-189b-4193-95af-e9a7ef49dac7", "value": "SWIFT Giden mesaj bildirimi - 28740,80 USD - I103.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dca1a41-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687413264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413264, "uuid": "30d53498-bf75-4bab-b942-104666d92854", "comment": "Malware payload", "value": "7f74b239e227585d2fe0f2526c0602ec", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413264, "uuid": "0c3fc4a3-a8d4-403b-811a-c495459e39e4", "comment": "Malware payload", "value": "125b196d6c7adac46fb0842734dcec64c044445506f529261c3357d710ac7f28", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413264, "uuid": "730c3549-43ac-4bcf-bb46-9f23270d43d4", "comment": "Malware payload", "value": "f29370fa297d24c37a758171d31de219d89bd9bc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413264, "uuid": "a163abc2-da11-4e02-b556-a08d5b860766", "comment": "Malware payload", "value": "a967a04b48a99ac551183e8f630ff7b3a2144a834c6953b98a00e013482af631041548dfe90c3db0334d864feb385a19", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413264, "uuid": "1d75f6a0-3676-4256-9a3d-e6b445fcd122", "value": "T10416C056B3B400F8C4ABD179C9169607EBB27405176097DF56E0C6AA6F23FE21A7F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413264, "uuid": "c70b0bb1-01ca-48d2-b8c3-a852cb8d8eaa", "value": "7ece47d65941b3e72bb0a2006de482fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413264, "uuid": "32d2c908-7cbd-4afa-9e03-ffe870453a9e", "value": "49152:xEjzxsgEL+rQvk2pGRUsWHVSZpdy5qVWcx:xyqgEKrQHEps5qwcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413264, "uuid": "e42294ab-4456-4c3b-bce8-aeffb128f6d6", "value": 4024320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413264, "uuid": "7e0d1399-4a48-4975-90fc-5f0bb26849a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413264, "uuid": "f68f5bd8-451a-4a93-bbfe-97126f361b2a", "value": "7f74b239e227585d2fe0f2526c0602ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffd9307-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687420891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420891, "uuid": "94cc7401-2689-4080-8c60-26c7f50e053a", "comment": "Malware payload (NetSupport)", "value": "e80146546db830a22f0c7131393b06d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420891, "uuid": "40e81991-e967-469c-8ac4-e07d37ca1fce", "comment": "Malware payload (NetSupport)", "value": "12b8d3a6268645baa20230e09a73948c840ab34c527c0dd04d13eb336b987a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420891, "uuid": "8b5f9e46-a79d-4c41-a693-51eaa20e9174", "comment": "Malware payload (NetSupport)", "value": "aa48b56a6f701f455a7b33dea035e7500d3c8336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420891, "uuid": "36b505a1-1e33-4221-83f2-644f683bd144", "comment": "Malware payload (NetSupport)", "value": "4d8e6b59433f82be7844e8284a617eacd256b0326a3c82d0febb6fc93b6af54fc49cba596364bc207bf7d63178d69697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420891, "uuid": "30c519dc-4cad-43cb-86f0-5f40c1156115", "value": "T1AD159EE2A2B1C83EC16326395C1F53E45D3ABE102B24B9867BE41B4F8F35E513B64197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420891, "uuid": "d8b29936-0cb8-4320-8b22-41edd072d30e", "value": "dad99e5c387f4e73aae419ddd17db155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420891, "uuid": "c0820780-6c1c-4cfe-a30e-45959c8ad04e", "value": "24576:FVcjvuoanTXHSs3zPxp47llK3XGvROM8JSMe7R:3cahHPuOkOle7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420891, "uuid": "f9dfbd2c-5894-40a9-b081-c511f3d1a8b7", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420891, "uuid": "ff022dcb-b976-4488-a56b-eba512dec2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420891, "uuid": "5a7a76ea-3b74-48ac-b4d1-054eba1d7c26", "value": "e80146546db830a22f0c7131393b06d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee7c308-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687420380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420380, "uuid": "d7cecbf0-2b0f-4ca6-9455-a7257bb8f18f", "comment": "Malware payload (SnakeKeylogger)", "value": "d574ae6692973162fc143160fc12b2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420380, "uuid": "3ba9afcd-dada-4b53-bea9-885c54228c0e", "comment": "Malware payload (SnakeKeylogger)", "value": "12cf168b454157d8f07521d0f2ed5457cfe87260f3e1e4ce13c51a3d433a2bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420380, "uuid": "1ae0f3dc-5357-4a3d-8638-eadcb6b04bc1", "comment": "Malware payload (SnakeKeylogger)", "value": "b24ba8dd131d084830a353fa811ebf141d00efb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420380, "uuid": "1de09776-1c4b-4ce7-8307-385f942b1eee", "comment": "Malware payload (SnakeKeylogger)", "value": "c36a047b3e79413b2dd8e0f7b3df37779fb45bf0afc47531629516b34eecd4ba83c9b060218be68b56a53d98258d63c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420380, "uuid": "5d4651bc-d377-46c6-b1ad-54d0533961bb", "value": "T126849ED5326D1F22C03DA3F95561204A27FB1A1F69FAD349AED309C70469F480692FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420380, "uuid": "c09cdb2d-5fd4-4b16-a750-af246f5d0883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420380, "uuid": "76c00d84-e2e8-4f57-869c-8a5a28be363a", "value": "6144:qTjPJaPJaHJa/iRTB4QoBLRT9CP8rOBYijZfpdl1OMKWh/XmLV:kJ8J0JdRyfOBYi5TlAxamL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420380, "uuid": "a2391d54-c642-4917-b3e6-5aee9aa83570", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420380, "uuid": "a74a5ffb-1983-4942-ac17-6efb35108db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420380, "uuid": "40c89381-29f1-43a2-8b7f-e3f1dea6f5cc", "value": "FDH0987656700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa5dc7a-1101-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687440943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440943, "uuid": "7492de58-c089-490e-9553-e1ff5d4ed56f", "comment": "Malware payload (AveMariaRAT)", "value": "f1d413bfe14ec8f4102153374eed7b22", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440943, "uuid": "06dddc9d-f9b3-4ed7-8ee5-3fdc9db9d99c", "comment": "Malware payload (AveMariaRAT)", "value": "142d98dae00dab883e0ed1e9df3ccd959cc706a1f7bb47c96bddb716aa9016b5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440943, "uuid": "25f9fa12-f114-4843-beee-7dab687123bd", "comment": "Malware payload (AveMariaRAT)", "value": "b8d5f66d4f8c97592bb0212889944da551a55204", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440943, "uuid": "7dbad5ba-194b-48e3-978d-255d4831fe4e", "comment": "Malware payload (AveMariaRAT)", "value": "403af1ad5ead2136f1750e73e62f35cbda7e326b7253f8b1ee31c975313aadf92ad53a63530963fed29ee13583c58d2b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440943, "uuid": "5a2ad1b7-3bd4-4328-b7a0-1d8d1a5df5b8", "value": "T12E5412492770C45BEE500A716E38B653CEE8B59010E46B1F63921BC93CBA286778F777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440943, "uuid": "203214f9-3800-4a84-80ef-1e8dfd7900be", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440943, "uuid": "0ea8564e-e1fa-4be7-9dc7-2a2a1c458c75", "value": "6144:/Ya6FDNAWoycEpbJBoXtgaofKtEo944l+4GFSYXqDKr/FR:/YHBAWoycEzaX/oSao94P/F3qD4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440943, "uuid": "8db69887-ec2d-4f1b-97bd-9c5478bdc8d4", "value": 297288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440943, "uuid": "012d3041-b9b8-40f2-9b18-e48cacc0fd84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440943, "uuid": "cf4ff8d0-4589-4287-8589-babcb0fa3cf2", "value": "rShippingdocumentsCIbLPl-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d9189e-1104-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687442272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442272, "uuid": "b584d58a-4393-494d-83e1-0bb9e4c61236", "comment": "Malware payload", "value": "e53d7ba028f3df8918c7447db0e05df8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442272, "uuid": "bf8cd7ef-e898-43dc-b540-3c4e4f357f2a", "comment": "Malware payload", "value": "1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442272, "uuid": "c9029aa8-4221-44d2-9087-e3d864c72aff", "comment": "Malware payload", "value": "4de1985e2bb5401ab665301432b30137f8d9b4f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442272, "uuid": "5ce8ca36-1d2b-4124-b16b-e41b7299dc9e", "comment": "Malware payload", "value": "9e742e785d7f12aab4eaad3904dc5d953eee9fcb1548baf6c2f2d872b6387235b31f01472e9de98948538d466daaee96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442272, "uuid": "0018e667-56ce-46f7-a612-9740a57e02dc", "value": "T19E437B50B7FAD9E0F4FF0A315970D985AA6ABD01DDE18D2E3BE4120E19691A4CB34E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442272, "uuid": "53e66348-4eaa-4fa4-aada-9f3912a7d13b", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442272, "uuid": "283282d7-ce4d-42df-a013-35650ef7b33a", "value": "1536:lDm8aNg+j7Ahr26oXZzZZpAsWnBCcdGje5WcA:7aNHmq6oXZzZT+jGjeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442272, "uuid": "4cd77e38-f0f4-441d-87f4-0eaf41722e93", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442272, "uuid": "6b068066-7295-47cc-a7c5-7ff8dbd96c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442272, "uuid": "14b8974b-d440-475e-bf5c-7ad49b1c88af", "value": "e53d7ba028f3df8918c7447db0e05df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46fd11b-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687414376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414376, "uuid": "9f9073b4-810f-44c8-abf3-15edf811216d", "comment": "Malware payload (ModiLoader)", "value": "283a50a3487a6d99a24e96d7c2e9378e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414376, "uuid": "1783ef75-ce0e-4f88-8294-19436675bf59", "comment": "Malware payload (ModiLoader)", "value": "17be5ebb05d5ecda4b88767177423b1198ec32869d58f244a9a63f7d2133f0f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414376, "uuid": "8380d34c-05d9-4ad0-9f58-9314f7babd3e", "comment": "Malware payload (ModiLoader)", "value": "adea4f4e4c405451716cd5432cc7d2e667d3055f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414376, "uuid": "24b4f85a-f3a5-4068-9589-efcfc0daa38c", "comment": "Malware payload (ModiLoader)", "value": "13eb535b1c3147d9d61b84f09791be161a9d3fc846be2e5447ab88db012d22ecd058bef5cdb349eb7aad31d81615a377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414376, "uuid": "ef055b3b-c45f-4ff3-8bf6-98031f4ab2c8", "value": "T138F4AF63B1B04077C2B32D798B46A7E9781D7D242D2439559AF43E88BF39242B8253DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414376, "uuid": "0e44f495-dd23-413d-9984-f67d2a4e955b", "value": "02d762f1aaf16e6c8e03fe60f0c9d48e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414376, "uuid": "6c551e4b-b04d-46e6-ac85-e2ba3d78dcf2", "value": "12288:mTlUbdpW5/5o8FF2FENOeqBWJz4RC7AStkCizoHm8gn7hQEL:mTqC/5otAqYOo8StkCizoH9gnGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414376, "uuid": "a33080cb-1114-442a-a495-eea5203095b1", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414376, "uuid": "8000a933-3977-4ef4-81bf-a6068d2fcd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414376, "uuid": "eb6f1773-1395-4624-8a8d-5827960be5cc", "value": "283a50a3487a6d99a24e96d7c2e9378e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9ab91c-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687459488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459488, "uuid": "8214e480-bfe0-46c5-88dc-da423dca0ed3", "comment": "Malware payload", "value": "02d8b48051ec7fac9b56d2fc736809eb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459488, "uuid": "089ac009-4e0f-4f33-8959-daa7e9539a40", "comment": "Malware payload", "value": "18092ae80a2f85f4486f38d1686025b610a7ccac741ac3fd1b7c9a2d2a85ea47", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459488, "uuid": "bfe2fbde-99c9-472e-8040-f423a59e2177", "comment": "Malware payload", "value": "eb32c23c7b89747d3b9bb3095c3ab35798a3e035", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459488, "uuid": "965e8b99-87c8-4bf9-8dce-1a3dbec09fc8", "comment": "Malware payload", "value": "d2a0b212348e3f36b073ac3cc075272e52ebc024256cd0a23ed6d61572825590c02b5f905f3378c4110a29671facfa41", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459488, "uuid": "6bef3f2e-a587-493d-8ff4-21508a1755b5", "value": "T126852332AEB77046E81D7A702DD9008A9C53064FCE80EEC9F99D4D8EDF107819E5F666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459488, "uuid": "599d0076-e618-4989-8e0b-8e8984012b42", "value": "49152:ry2hKep2+E7YRPUT6YbKQYAhR0yBd7UTbwm6gsvFFgZV:Ojep2+A6YmnzGF8/TsjgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459488, "uuid": "0cdbebb7-5839-483b-8459-68a3c79cdc06", "value": 1835862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459488, "uuid": "0f082dcf-43db-4b73-93e4-892a4b04c4ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459488, "uuid": "ebda7907-be11-4e02-aa81-01af02bccc86", "value": "Holoo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256cc37d-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687442859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442859, "uuid": "28409c81-7bdb-419e-a07b-fd9d4b40411f", "comment": "Malware payload", "value": "98300ad09b57917c99e5f4399d6bbe09", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442859, "uuid": "117392dc-face-426d-ad65-d2b21c9c9c73", "comment": "Malware payload", "value": "1836eb89d769650dd07cfa84a892172c55f28cfc9a46d360944576207a1f5ea0", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442859, "uuid": "98715f4a-bb2d-48d6-a6ff-22a7dcaa4314", "comment": "Malware payload", "value": "4272f1ae6fbe2ad5bb0621724b5ade5d0567a1f0", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442859, "uuid": "c421128c-9572-4ddb-9409-60752a2f4683", "comment": "Malware payload", "value": "4bbc4744dabdd4995c4abf4729c8648d4d52220063c0b0f1217e3084f53ffc0ecc975757d71b0de3dee59bddc86e242b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442859, "uuid": "7a1f1908-8b73-490a-a2b8-0edcff383734", "value": "T185523A1967DCC637CCAF4736ECA352C00771F7BA9817AA264AC114962C533248B76B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442859, "uuid": "63b3f56c-1d65-4a68-96d6-17c2dc7914dc", "value": "384:KDeB03dJGqqHeDZNoDBeEPJa2ne9Xk78x3hjHIHczfza:p0fXZNoDZDilI8zfza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442859, "uuid": "e2b4be39-63ca-4acc-84a5-0aead7b22d65", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442859, "uuid": "30573d14-877f-4a8d-87c2-a6180b64d7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442859, "uuid": "b08417e4-5027-41ee-bbec-ada7619d64b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb708ed3-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687418629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418629, "uuid": "fd6074de-f2fa-4a43-867e-68e8fba6242a", "comment": "Malware payload (RemcosRAT)", "value": "5efe6176a8a612301be758f70ff9871e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418629, "uuid": "4ad34d64-3d3e-4144-a4b3-72902a01c9d7", "comment": "Malware payload (RemcosRAT)", "value": "195696ffd6def79f55f1e35be071c1da33bfec5b187ac920495c36e1fca7f202", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418629, "uuid": "62616d5c-f189-4ebe-b88a-d2908d9ba716", "comment": "Malware payload (RemcosRAT)", "value": "59da9cecee6b8710ab24139d772c24f74fbb1c19", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418629, "uuid": "072e6bb1-842d-4ac3-ac9a-9e74135a5712", "comment": "Malware payload (RemcosRAT)", "value": "f4028e4581993ee2679dafbe419ddf5846b8df28f74918d2ee22ba9e8acc08eb0851cd6e88114f7274bf8e6a176ab8f2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418629, "uuid": "3934de7c-6847-40b5-8178-abb9f4b31fc2", "value": "T12B7422373C29DE7622016A0E28F2B5897B03D707DDD6F503070649EA8DA1662FD8DBD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418629, "uuid": "e31e5e18-0aef-4d43-b529-565ae8aae121", "value": "6144:ZO2uTN5q1fS9B6jilZY+nyYkrsHF+Q3JOY16aDJF+cLvom5/xAqHq:8rB5qp+vZyYwsl+gp1F+Q/Fx5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418629, "uuid": "c130cf86-ce30-4926-b869-f34519a75302", "value": 352375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418629, "uuid": "c6a539cc-f485-4a39-bf25-3f715e1f33b4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418629, "uuid": "d890528c-5aa0-4372-9ccb-c732c0827f62", "value": "SRL 2023-06-21 0211003_02283930.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37f7395-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687414374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414374, "uuid": "fe25d149-8f00-4a3d-a06b-d96583024a1f", "comment": "Malware payload (Loki)", "value": "4d4ab866c2c4c35bae873f65f593a58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414374, "uuid": "42177736-c5c1-440c-a924-cf6f49592e1f", "comment": "Malware payload (Loki)", "value": "19c3c17fa740022b31e4737cd0a03f38f5dc0f52ed70f6a2272bdb59b74cb209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414374, "uuid": "7254de68-ef79-4e73-9560-c691775c62f3", "comment": "Malware payload (Loki)", "value": "7be903828a681406c22b51c376d0105a25bbd08d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414374, "uuid": "18b8e1e0-26f6-425e-b76d-cf0e6a044b65", "comment": "Malware payload (Loki)", "value": "43664d775b5df54d3729501d3a7d02be821b37daa7e01ddf255712ae94af7cb2e33e23b2491620a59c87296d98e83117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414374, "uuid": "7c610328-6a1a-45b6-986f-6790d9fdfaf2", "value": "T12DD4120852669B5BE0670BF40652A7B4433D5EDF7433E35B8E87B5C6BA22F090941F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414374, "uuid": "b089580d-1362-48dc-b64f-2b72691ca4af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414374, "uuid": "eeda1e84-8b95-40ae-9041-6d102679178a", "value": "12288:/PM7q6bpw4dcZda/igRhUDE1MOYovZwUsIlh3Yu7j1:ezu4CZdOReDE1MO1vuUsUYut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414374, "uuid": "1a7ff8be-e8f7-4af7-aaff-b75b640a14e4", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414374, "uuid": "499eae57-fcb1-46d1-8715-86f45f02c698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414374, "uuid": "a1f3291a-d629-4793-b2a2-f0d54fdf5756", "value": "4d4ab866c2c4c35bae873f65f593a58e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ef9f27-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687418623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418623, "uuid": "75ecd277-c4c7-497a-8552-881446f96792", "comment": "Malware payload (GCleaner)", "value": "1b3b07b450ab413b9aa485ee89670d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418623, "uuid": "73215414-11ef-4cb4-8ad9-dadd9e09a787", "comment": "Malware payload (GCleaner)", "value": "1aebda8ec3beb39cf1cbd4a92ffe94bc6cd114c7b336b3ea6b8be5d183af731d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418623, "uuid": "d01d74b0-d9ef-4b8b-a9f7-4fdad4669727", "comment": "Malware payload (GCleaner)", "value": "28284fd759c31d95d1f5f6dd718ca78a9d77f0d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418623, "uuid": "785032ce-7d48-4b85-9d4e-5c07b5ca97c8", "comment": "Malware payload (GCleaner)", "value": "ca5e01daea3e2efce2917a8da5e39f646930b71f36186f547f93eaf46b09f0941c702e079e8a3f710fb7a4460bc3ed11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418623, "uuid": "5e28fc22-a7a4-4acb-bf00-706a731def18", "value": "T17554AE1362E17C70E5651B729E6ECAE8375EF6108F297B9B22289A1F0DB01F3C572741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418623, "uuid": "715086ed-925b-486b-83cf-9887a3275c28", "value": "f4c1b2d985de83e8ff623844bdb73567", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418623, "uuid": "5adccd00-aa3d-45fc-b62c-fb01b0ce05de", "value": "6144:+HpSwgQ33Xo/mLPizakvceDmggiOFxdhGRaBBMp6AG5Z:+JSwj3Qmejvz0FxD64BMIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418623, "uuid": "72e03477-1fee-4044-859f-6decd106c87e", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418623, "uuid": "8ac8b743-3283-4f84-881e-eab77a281e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418623, "uuid": "6839e626-ef71-4815-b351-ef9b705be84b", "value": "1b3b07b450ab413b9aa485ee89670d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b44281d-1119-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1687451190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687451190, "uuid": "3763c145-a9c0-4631-a4a3-419e4c20a753", "comment": "Malware payload (Gh0stRAT)", "value": "e78690f2b8e0a131a6cfad0dafcf2bc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687451190, "uuid": "ec12c3f3-661e-4be1-817e-b4eb95141f13", "comment": "Malware payload (Gh0stRAT)", "value": "1b59fc2fd07f0c2df0a2759d0b918ea5096fe84d433fd0e5a3b15f1d7430cb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687451190, "uuid": "dfc24cc6-b764-4ba6-a853-6ab59b1ab2cc", "comment": "Malware payload (Gh0stRAT)", "value": "ffb5829e236a9e35d760efcc254b5c893d4b235e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687451190, "uuid": "027250ae-e5a6-4ea1-bebe-963e8f9878eb", "comment": "Malware payload (Gh0stRAT)", "value": "2eefbdb66d16e93b076406549572910ac3981b5cf5097c03dd41926ab4d68f36b92445e4dae9a5d9ab0f9a752ad28481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687451190, "uuid": "670a5f1e-97f9-4025-bcc5-f28d3bd6f5a9", "value": "T19B959D21779080B6C6733E30855B9379A679AD301F3982F753906E3D3E702E2993976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687451190, "uuid": "a627e20a-e142-4e05-a96d-bbe2c9ddba6a", "value": "c3a7463401f65ac969edd5c33cfce50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687451190, "uuid": "877b8d5f-fa64-4b66-bc00-555aa0f8aca5", "value": "49152:ofq//3Qo/RAoTQ9fLl21ZYy9rwJCGUyElKirsI4ZS0rcFbkXvf/QNLxB6:6q3Qo5TWfLl21j9rwJCGUyElKiwxbrcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687451190, "uuid": "6aa89cfb-1ef6-4d75-9be7-cb3bd12f030f", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687451190, "uuid": "40cc35c4-5724-4683-bc57-bc571fad9f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687451190, "uuid": "ddef0cf2-dc46-4f0d-ba22-95fc48d25277", "value": "usagi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee442081-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687423439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423439, "uuid": "1d7db269-fcdb-45a2-991b-9b20de27f1dd", "comment": "Malware payload (AgentTesla)", "value": "417cc456b8090fc7a9f9fceaad72e26c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423439, "uuid": "693f2de4-1f8a-49d8-ac02-f43b4f596aa8", "comment": "Malware payload (AgentTesla)", "value": "1bfbb76b330000d77b2265ccec0624c973c8e368838798d4e7a20fd1d4ec3cb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423439, "uuid": "f79f7f39-f44f-47d0-85c4-df91f6b5ba10", "comment": "Malware payload (AgentTesla)", "value": "7f963cac64d1960a6cd0e52fc984cf90f9075f99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423439, "uuid": "ed72ca49-d3b9-4407-b925-bc06aa496f23", "comment": "Malware payload (AgentTesla)", "value": "4e0e425c2dbbaae59265961244582115d93776b3c836bfe2a8112587a156332aafed95f72622f8f74da37b21beac7f93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423439, "uuid": "800ee545-5785-48c7-be91-6f6148ed571f", "value": "T187E4E0AEFB45BE66C91D8E378013210843F884A39273F65F1CDC1DF1596268D8E8F59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423439, "uuid": "c0614b30-5fe7-40b9-868f-47f432279086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423439, "uuid": "59f86071-5df6-4d18-8c3d-eae1d1203bd7", "value": "12288:0ODwj8d7F7dAIQEsOBcYZV13HU6M7EutXEHx2UjaQ9byx:nwSxBATEC7EuKHxSQ9byx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423439, "uuid": "8afe40c1-5688-453d-b870-b84534061532", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423439, "uuid": "4c4d63d4-e8a2-4104-a7a8-f069bf3cb3d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423439, "uuid": "34aaaa5b-014b-4d77-b28b-0840491e3b89", "value": "payment Advice.pdf.r11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1666309-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687430182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430182, "uuid": "5fad9dc8-a8e0-4f2a-a7f9-84e894252781", "comment": "Malware payload (AgentTesla)", "value": "1d88018d7f3e95d78ca22dccede7dc6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430182, "uuid": "1634bdac-4b71-4acf-a25a-e1885e02f55d", "comment": "Malware payload (AgentTesla)", "value": "1c4c7802f3a6bcc8d0355ad3e5c482c0fcdcb79845733a5ffe5c081ef59241cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430182, "uuid": "5a5f6598-27fa-4a58-8954-9391197d57ea", "comment": "Malware payload (AgentTesla)", "value": "6871a2644464ef1177a92b596c5954f9402f1972", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430182, "uuid": "dc195654-5c15-4694-b46f-a0e424aa22fb", "comment": "Malware payload (AgentTesla)", "value": "ebfdb42b9a0fdbad9afe655cf63f9da0c35f478a28436fb1ea3c0243a919218b8fae30e9c3434a101333b25137f4781b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430182, "uuid": "48f62d6f-305c-4dd6-adb7-37e7d4e9ed35", "value": "T1AD25E05036696F60E4BA8BF5096052705BF66E6FF43EFA094EC2B1DA25B0F018971F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430182, "uuid": "ba176ef6-43db-48ff-82bd-96837bf89ac6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430182, "uuid": "411b326d-85f2-4d9b-9c7d-026f3d992fae", "value": "24576:u7MyuyF16d/wJ1KNoXoLLnHJ5EbUmHCMDDdUyRncLT0:u7MyuyT8oJ1KNoY/zmHCuVc/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430182, "uuid": "a1f200cc-be5a-4528-ae71-e3c3d2ec5985", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430182, "uuid": "1e6d06b2-2245-4c88-8a0f-7bf940639ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430182, "uuid": "13dd29f9-488e-4302-ade4-38201e43c0db", "value": "1d88018d7f3e95d78ca22dccede7dc6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b25fc7b-10f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687434278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434278, "uuid": "e78acb7d-d8de-46c9-b0f1-ba8bc25e1c4b", "comment": "Malware payload", "value": "eabedec94a062a68ace91831e037ef11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434278, "uuid": "f9115f0a-19c9-47ad-8966-464e8bddf88e", "comment": "Malware payload", "value": "1c9be4d7bd050d73c060778c4dd78907de6c128721fcfd2ca00e5d5aff577912", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434278, "uuid": "df1a3597-b3d0-454f-8c29-dcfae18fd15a", "comment": "Malware payload", "value": "b79e366ced727b74949808de06ed6423de5eb10b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434278, "uuid": "6416ccfb-c344-4741-a500-75e527b3628f", "comment": "Malware payload", "value": "73e92be2aae6b3c4289304ebf344b62f68b9551111c9718d8caf15e9006e222b6ff6ff85831f04c3659f3a7fba4425df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434278, "uuid": "5405a908-930d-4458-9af2-2606ca673167", "value": "T125A4CF00A4D2F376D5FF2A3088F8D7EA462DB9704B2468DF67D8187D4FE82D0A932556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434278, "uuid": "7e0d6c5a-c0d9-46ca-aa24-ebf5dc3dce34", "value": "f3291e3c91eb36f11814906e0f6e67c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434278, "uuid": "0f1762fd-b026-435d-b2a7-f4ece94d6397", "value": "12288:mb4Tx+FX3G/r/ft14wDBjmnBwXvT7xjwim3YWF:NT7/rYwFjmBwXb72im3Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687434278, "uuid": "179f1f6f-87a3-4e15-870f-db20ccef78cb", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687434278, "uuid": "385c00cf-36bc-4040-9385-0816c61fa7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434278, "uuid": "dccaee19-5b87-45b3-a0c3-6fab18af08dc", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.A4570DC3.29236.3297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33286cd0-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687420548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420548, "uuid": "f8cd8a6f-49e4-4063-b6cd-deb0ea854630", "comment": "Malware payload (Formbook)", "value": "43736a5b66711ad3129be1d1a1923fcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420548, "uuid": "ec80d359-815b-41da-8660-aaf2e2aadfff", "comment": "Malware payload (Formbook)", "value": "1d24effbb1519b3eb68a88edae7bea4f42e974fe5c9cb4c11496c25b7ccf1e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420548, "uuid": "8c9b0244-a1fc-444c-9de3-b176e1eaa653", "comment": "Malware payload (Formbook)", "value": "5f759852254b7de617360c69efc356af69b643c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420548, "uuid": "26826d61-6e61-4c67-b2e0-a830c797f279", "comment": "Malware payload (Formbook)", "value": "47e770ca2338ed64d669832216f62d893749880d33fbd60345a23c1fd84f500df18527dead816fe3cd1f9545efba0024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420548, "uuid": "ca4fff47-ec84-432d-aa3b-bc55fcac6e18", "value": "T1AC741325A590C4B3E59541709E7D9096AFF5CB013A78AB8B2B108B2F7E37942D30F3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420548, "uuid": "649171b5-5bda-4301-b861-4cc00f84d7ac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420548, "uuid": "f360f004-e878-4cad-970a-6a4cb516be50", "value": "6144:PYa66klyHj/EcsGw5jVEtaSM1Z/1qn1zIFv+ouSb91kOvzMQtXZ4Jtx5pesR:PYEklyHTEcw5jGHM1Z/1HRuSp1ZvzMiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420548, "uuid": "98752e93-6da1-4243-9468-9c6627351e74", "value": 362761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420548, "uuid": "5af83a9f-eb3e-43cd-97e3-f746d1956aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420548, "uuid": "8945584a-7a98-432d-a971-baa43b38173a", "value": "43736a5b66711ad3129be1d1a1923fcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee20d21-10f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687436164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436164, "uuid": "6a4d8036-c44b-4193-b073-bd6a15394185", "comment": "Malware payload (Guildma)", "value": "822d664b20499a6b1a72107d454b1ebd", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436164, "uuid": "b79e2811-d36c-4be9-a318-17371479843e", "comment": "Malware payload (Guildma)", "value": "1d8f4123aeae191a9ddcf97e6e8610373aea6098a0a7bfa4349bb72a720e4bfa", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436164, "uuid": "43193d84-d6b6-4b83-900c-8b5c0165180a", "comment": "Malware payload (Guildma)", "value": "1c53d2a7f73dfbe6b60a4f744be04c56dc8175fd", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436164, "uuid": "49255e4d-6617-4893-b064-95340e09dc6d", "comment": "Malware payload (Guildma)", "value": "46c5eb5290da153c72facd665994b350d04eb2dccdfc77fbeeaa81fb4d5a37170a3d732eac14c095edd71c91d2181787", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436164, "uuid": "ca5a69fb-5282-42c8-90fa-8b93ef5149ca", "value": "T139114CB6D7240D7AD4B20BBACC30AD0D98F69CB20B8D905DD9233148C53C6911FC4BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436164, "uuid": "b2c7122e-2f6e-42b5-a8dd-896370752b3e", "value": "12:8D28OByN6/R6MvDCu/eaTAS6yVIdyVUaVuR/yVIz87KZIxiOjl63AguqJFpHN:8FN4RZvDCu1Tfwja8340ug3AgvFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687436164, "uuid": "3c698bd3-96c7-441f-ae95-6361af1a1bb7", "value": 963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687436164, "uuid": "0b6079e9-5647-4b58-b392-4d2057715007", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436164, "uuid": "1eaf804f-8dfb-4bea-bd9c-641dd256a2fa", "value": "ORDEM_DE_SERVICO_8755723354613023.395236.53868.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f64c65c-10e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687427870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427870, "uuid": "99a0aefd-7503-44a1-b9d6-eb8d1246c957", "comment": "Malware payload (AgentTesla)", "value": "10e76f13d94618ba414578c10f38d500", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427870, "uuid": "d5371ac3-829a-489c-92b9-6377251a167d", "comment": "Malware payload (AgentTesla)", "value": "1e51f537c21ecc7c524b04bf7ca7a05dbb672fa96e287e69f5ceebd9ab4cb153", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427870, "uuid": "669b4fbc-36b2-4b84-9811-b1c1a1d72b04", "comment": "Malware payload (AgentTesla)", "value": "6c22facbfcb0191084194ef67763d9fb0f552fac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427870, "uuid": "459b119d-eb80-483b-89ca-b5b5da712d6e", "comment": "Malware payload (AgentTesla)", "value": "3b3b554a92ab90ae97dbf28d8421fe35b0c86d80bbcd4254a05fc04241e004a514712b54a2d529c8d0b90790de6e36e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427870, "uuid": "4aa3dc12-c13a-4b90-a7f3-688127235cfd", "value": "T1730523CA087AF3853F7393EB48EBBDCA5F61867456820CC6901ACCCAD57C90F6658857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427870, "uuid": "0fa27e91-dd4d-47ea-b5fe-5bb0fa468211", "value": "12288:H8ibYhOrUyvncQoTINkq0wRD/624JXQf7XU2Gq1EQ29r03K4xNLjEE1pXA9RCsR:cuyOg0ToI/0qD6JAfo2Gv9GjPaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687427870, "uuid": "96a184c5-45d6-4b0f-9a6a-09ff378761b1", "value": 813210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687427870, "uuid": "dac943bd-e599-4494-80e8-3e0a11a1f286", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427870, "uuid": "df8162b3-f767-4c9b-9d29-3f0a55bfed70", "value": "Scan-DOCS M004K - M009K-COYHAIQUE 2210W-AIR_SEA SHIP.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2678e69-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420842, "uuid": "54cbab37-193a-4ec0-9b0d-ff75a71be80e", "comment": "Malware payload", "value": "d25590cde02193682c6decce532df49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420842, "uuid": "c2d6a542-39b6-4c41-a5ad-792f636dd8af", "comment": "Malware payload", "value": "201cb984d45a5ae14b2ae2624c33f88508de8da4a5935553f2aeb981505da71d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420842, "uuid": "c8bd318e-af53-4864-82f7-5955c57b30ad", "comment": "Malware payload", "value": "b9d9b96ff4f8fdeabfb354482efcd784f3ce8192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420842, "uuid": "4c150eda-cdda-450b-b3cc-5d2dea107fd7", "comment": "Malware payload", "value": "8e71b16e56c0eacb23a532995d3189449217cf788cbf73055218bab29bbfae71edd6231180825f1516fbca2649e5ab5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420842, "uuid": "7edb8710-d164-4c1a-9296-efc31b6a32cc", "value": "T1273623AD528833E8C046C578D432ED19B3E7920E0ED596D6B5CBBAC12FF68E1D941F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420842, "uuid": "b82b1a98-da7a-4b67-98b9-e02383b989b2", "value": "846876fcfaab8d0675698c01a809ad4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420842, "uuid": "f850a3ba-96e2-4854-8da7-e43389b99838", "value": "98304:xZdthJwriyq9ouD/IJlr2TYPL0wTrVjVy1V20PC4MJkv3CZcjCnC6Z:jTAiy5uD/IJlrE21PyV28C4WE3CcW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420842, "uuid": "ffd7fd32-9348-4253-959f-63b096f7f991", "value": 5076428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420842, "uuid": "5b71a0c9-1165-4703-9acb-3f920e544c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420842, "uuid": "e54032a2-2b30-46b2-bdb7-d0c679137769", "value": "d25590cde02193682c6decce532df49e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564d7ac3-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420607, "uuid": "15451c12-b5d9-4cef-b498-bc5492b5b151", "comment": "Malware payload", "value": "43a7795ce113569437c66a9b05e8e3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420607, "uuid": "96f554b8-5488-4d67-881d-b96aaa8cffdd", "comment": "Malware payload", "value": "2094bf8727d294ad281ac797e871bc389964702dd5775fc795996d81d7caab3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420607, "uuid": "8865ab72-a2a7-4860-add7-4d8d2f177daf", "comment": "Malware payload", "value": "910e6e6b6ed103a1643bd410d92391683dbf5fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420607, "uuid": "ed092f5c-d7dd-42a8-a6a1-1e46dfa80ea0", "comment": "Malware payload", "value": "58407c002cd65eb65a31716f01e1f978fd8621f9497c8a1319748557640a5b633d13ea925831888c60dffd55890b63e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420607, "uuid": "c785aa1b-e7de-4b2f-a54f-719d26785578", "value": "T18F7612320572BDFE876C389490052B452CEC5C676359DFACFA4404EF25A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420607, "uuid": "a6f2a410-7b30-415a-b026-8f3ea405d10c", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6M:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420607, "uuid": "829d8bb0-ca3a-4d28-855c-02e74ac34030", "value": 7283447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420607, "uuid": "ab57bd5d-9f2b-4ec3-b519-e444b6b054be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420607, "uuid": "4145acef-d407-4559-9579-1dca8ed3c68f", "value": "43a7795ce113569437c66a9b05e8e3d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9fe20c-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422656, "uuid": "01e0ab52-595d-49d3-b60d-aec21249e121", "comment": "Malware payload (Mirai)", "value": "cd75326fd674dc5d2b838357f4c82605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422656, "uuid": "daa6f2b1-b980-4807-bd49-f8232d33237d", "comment": "Malware payload (Mirai)", "value": "20fdd511fdc91ab98b8de141054522e2e8bfdbd593eec1a5e7c59b5a8693945d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422656, "uuid": "7fff8838-ccc3-4118-bf90-e39741fc2807", "comment": "Malware payload (Mirai)", "value": "39bb2590ca135c9a70eed9d4d067fc8bc9d3a30f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422656, "uuid": "efdd3dfb-3ae3-4688-a09e-6f0942299203", "comment": "Malware payload (Mirai)", "value": "452d1f8560e83cc6810f1afc3907c2bbbb75d5ab5702eeb4d30839371e807cafe3e8c836a6e10cd19831d83ba30b12ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422656, "uuid": "6f1ebd4d-2d37-49f5-8846-cf2a16569d6e", "value": "T1B2337CB6C4E9BDA8D2049F74BD15CA348B13A40086672EFEDA45C699C087DECF2097F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422656, "uuid": "f767cb85-fa44-48b8-8ffc-034d168bebbe", "value": "768:UawatoKwtt8KH5BlqFejY9vijo9vKv5YJvumk9AC5o5A/YtLrCxz:Uawa+KwtypzAhvSImk9AVcYtLrCxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422656, "uuid": "3e3bd6e5-f351-4d2e-9d85-a0cde8db281f", "value": 50672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422656, "uuid": "058a8d38-a048-4747-b70c-3d7b64abbe47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422656, "uuid": "37e8d016-77ca-47f9-b2ee-4d27c529a8f6", "value": "cd75326fd674dc5d2b838357f4c82605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616f708b-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420625, "uuid": "1f11ecc6-61b3-4fc3-bc89-a02d8b9bcdae", "comment": "Malware payload", "value": "c9bcbf376bb461c71b4843460b6f489f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420625, "uuid": "ecc71373-6db3-40d6-9eac-7bfaffde6f54", "comment": "Malware payload", "value": "21e6e7eaa053738852c47e917fb9656c5d023daebfbae0d5d551ae41d8224bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420625, "uuid": "fd9e9ee4-19fd-4ca6-b048-57ce421ab1be", "comment": "Malware payload", "value": "ab15adc28a1758133ffb6dc5b2e41129af01f490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420625, "uuid": "638edc0a-2db9-445a-a629-e625707bfd61", "comment": "Malware payload", "value": "1e7a5857eaaaba85b911404e76e246dc5fc1669e605af126ef26eb35c175507c7c515040397fc06b19f296bd94e3b5b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420625, "uuid": "858ab216-33bc-4a4d-8ba7-51a6b89f48f4", "value": "T1354601320536BDFE876C389094051B452CED58276349DFACFA4414EF29A1738EA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420625, "uuid": "eff4033f-6a73-4f0b-bb72-e6ef9311e7f5", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6l:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420625, "uuid": "1ddafe85-1419-4ffb-9b12-b2704453688c", "value": 5670167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420625, "uuid": "4e276f6b-573c-4a37-a2ce-c32bd5db35cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420625, "uuid": "98713829-7c3d-421d-acfd-94c0e6996634", "value": "c9bcbf376bb461c71b4843460b6f489f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c6385d-113f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467587, "uuid": "67d20d3d-db7e-47da-9b3b-7c24b6b00020", "comment": "Malware payload", "value": "f77c9d6dea10e415c0d38aef416c7138", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467587, "uuid": "917ded6f-64a1-41b9-8452-6eee2b791551", "comment": "Malware payload", "value": "23ab76b96727d3825af7bed56e33f22e4bffc1e315011fd2cf3d7a667259bd98", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467587, "uuid": "67c19418-047e-4bd1-bc0e-729ade55f681", "comment": "Malware payload", "value": "261a522e7d2206db1dfe96e4e96e68ac86f08d4f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467587, "uuid": "58bfb46b-8145-4eef-bf27-b09720fcbf9d", "comment": "Malware payload", "value": "15dadbd0cdae2bc9d2fe74c8243cad8823bd0a47f24d876c2deb52b02e5b51ed6369e5c6ffb175190ac76a9b0d5c21e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467587, "uuid": "b014de09-aedb-4d7a-9cde-ee29c10240b3", "value": "T1D274496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467587, "uuid": "357cb47d-f428-4883-82e4-d9522d5604db", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593G:fIS1xbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467587, "uuid": "34ce438e-078e-4130-8f24-6f3b8eb7ab04", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467587, "uuid": "9dd19e58-524e-4c71-8268-5a1985b62d9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467587, "uuid": "8d315832-4bb9-4159-b65b-acce9d9b00d0", "value": "BSN-2003119938.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525207bb-1100-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687440357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440357, "uuid": "1fb8916f-913d-4da9-8278-e303b579c469", "comment": "Malware payload (Guildma)", "value": "01db4cba01a80e0754c1e4a427649166", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440357, "uuid": "c68c6a5b-a5e2-43d9-b119-51294965bf8c", "comment": "Malware payload (Guildma)", "value": "243c78fe104bf468ae9e9a9bbbaddda75756b9fb613371aface3e049063843dd", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440357, "uuid": "ac482ac1-5f71-4ef5-ace4-082f90a31cf4", "comment": "Malware payload (Guildma)", "value": "3db2a077c9059d8f45abae513555b2df89600b25", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440357, "uuid": "91bc5839-3c02-44c8-8d61-9616b84bb302", "comment": "Malware payload (Guildma)", "value": "6bed303ce8f8becdb93718f6e8ffbed9614b7de4713d861656f735b4f74e5a5d4c4c715b1faadb98b61d898ac7549e0f", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440357, "uuid": "cd5d04bc-2f19-4536-8739-8f0d6b8caa76", "value": "T1A211231AD4B5D9A0DC2FACF3500A9D60C08665CD7B42B34E3DAA8776F96B433DB30195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440357, "uuid": "d4ab2825-eebf-4dd6-b852-0c281ea3b30f", "value": "24:9w10c6ufWq0i/Zn0irfwnesh7c5U1S1eSWxBnM8:9a0crRl0iTI7F2U1S1UXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440357, "uuid": "73448fe7-4a90-4095-b266-eb4ef0e7d71a", "value": 1087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440357, "uuid": "b6abbd6e-7916-4af1-b7f4-739a9ba03534", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440357, "uuid": "f0973b4b-3bf1-4179-a2f4-6bad449d583d", "value": "ENRTWV86LNOX3B15084930.829123.55538..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff007ec9-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422608, "uuid": "c77be2f1-13ea-4c7a-a090-4c28c2ac7554", "comment": "Malware payload (Mirai)", "value": "84db8d211e42474f1774e591f28f9a57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422608, "uuid": "7a0e406b-287d-4f82-8535-64fae913efe7", "comment": "Malware payload (Mirai)", "value": "253831107adcc28cdebf8b13f63722d7f290058dae9c9ffd7ffd5968276ede22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422608, "uuid": "816fa14e-551c-4a02-9104-93b1992f427d", "comment": "Malware payload (Mirai)", "value": "5372150723ffc3060b7a2587986c5b09949f331d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422608, "uuid": "70d6536d-32fc-4394-9583-2518492e4033", "comment": "Malware payload (Mirai)", "value": "918be383976d2a88dd42b085aa5333b1e10fb034ba997bc30a3be799751739aeaa8295f9f5009dcf6accbf83950ef9fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422608, "uuid": "5d4c007c-80bb-4501-bc00-c777f8f561c4", "value": "T157832786B9D28A12C5D423BAF62E10CE372163E8E1DF72178C152F9137CA91F1EB7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422608, "uuid": "a04b7e2d-8e50-48a9-8934-fcf35557f659", "value": "1536:Kgx5j02dWKD9wXRE81A29SNrtBoO4RGlfBVffjS4tOHC8zOlByXOA:KgTj02dzDEEoOdZLjTQC8zuBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422608, "uuid": "e10c24e0-9c64-425e-b391-853ae23190f9", "value": 87036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422608, "uuid": "e19f72e6-a036-4740-a5d0-eb89d8422244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422608, "uuid": "37363496-2907-49c7-98ab-60651a781831", "value": "84db8d211e42474f1774e591f28f9a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ade0ff-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687423320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423320, "uuid": "5642850e-e536-4c04-a84d-c99c9e5c8c3b", "comment": "Malware payload (SnakeKeylogger)", "value": "b1a48b37d6eae92a63c51f1a6a26f604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423320, "uuid": "7761e1d8-7edf-49ab-9b85-e7e867c668cb", "comment": "Malware payload (SnakeKeylogger)", "value": "2550cd57f2bda56e2825a59a6d955020d157c7afb7cff0edf748009bd693505a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423320, "uuid": "a23f3308-d5e8-4e4c-9a20-48ff3e142f30", "comment": "Malware payload (SnakeKeylogger)", "value": "f0e7411d27ba97d885ec59180fe6d66dd1f489cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423320, "uuid": "92ea2da2-c72d-41d6-b055-aebd776cb933", "comment": "Malware payload (SnakeKeylogger)", "value": "9ed867747a6d504838764d2af90a26d06240ca9375ea1dc0306abc113a6ac859e86dc8dd48a4130aa6adfc97edb15f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423320, "uuid": "732fc84d-94c2-4c06-b33b-4591f78193cf", "value": "T19A730C356DBEAF78C09DADFF941D5A2D6670C879C087818129333146E96C78F3CAA1D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423320, "uuid": "46b934a1-b73e-48b8-b3e8-9cf75c730afb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423320, "uuid": "729bb153-c300-4b21-af1c-9e60a2099da7", "value": "1536:bXgZSP3VOe3U0NVpxpCcN00000000000000T0mqJO8/eRT:TgZSRpDqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423320, "uuid": "9e648b96-9849-4812-a012-57c09ce7aa1b", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423320, "uuid": "8030f9f8-d784-4588-9bac-6d86886be350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423320, "uuid": "3d7aecad-fbf1-42f4-8d9a-d0302321eb8b", "value": "SecuriteInfo.com.Trojan.GenericKD.67561074.29540.24660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcc383c-113f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467461, "uuid": "23259977-b54a-4e1c-9da4-02ebfc6a20c9", "comment": "Malware payload", "value": "cd9c1cc769a129f8538c572a5d884153", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467461, "uuid": "866f4e30-200a-4d8f-a541-5495c67c20f8", "comment": "Malware payload", "value": "2581bb9c7e2dd181ac351b45084547520751285624213221923ee51a6c9a46f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467461, "uuid": "dc7c0ab6-2342-4b33-8a46-9f8d948251c0", "comment": "Malware payload", "value": "c3c658a60edcaee1e32d63cd8c39e1700d0fdfd0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467461, "uuid": "84fea77c-f7b7-4292-858d-b258d2fe112e", "comment": "Malware payload", "value": "3f062e650f1baf64b9e8a850657e494371dd39175f04b10665dd3e96ae12edf947b84ccab624ad10735d6710eff6b070", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467461, "uuid": "8ea0055b-5862-476a-88fc-976e06a61d2c", "value": "T10A74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467461, "uuid": "6503587a-7aa1-45c4-a639-03a69728d339", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593O:fIS1xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467461, "uuid": "fba55790-691a-47d3-bfbb-a066756f1bbd", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467461, "uuid": "21400e2d-9b1d-475b-aa9f-ad82e4d59086", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467461, "uuid": "b477e9c6-23f6-4834-ba9c-1b82b149003c", "value": "BSN-1920558422.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b686eae-1128-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687457418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457418, "uuid": "91a42c24-4564-4c28-a790-768f737c77cd", "comment": "Malware payload (RedLineStealer)", "value": "3ad9ce2c823d7c6c6748f3badee1faee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457418, "uuid": "85ebb9df-7dc7-48d1-85bf-19a678520970", "comment": "Malware payload (RedLineStealer)", "value": "25fbdb6dc0e5c147ebbb54bb1642c6fa50f193a6ac101d6ba05d83488e95828f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457418, "uuid": "d7567194-8a80-4383-be2a-4bdd16ea3464", "comment": "Malware payload (RedLineStealer)", "value": "a2e7265fe0895cc2f49d6706f2e203c5cd88fd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457418, "uuid": "80d3c0c5-d450-4e89-93c0-e141b6b4d2b3", "comment": "Malware payload (RedLineStealer)", "value": "73659d6302d673a51aef69d0a3cb04e2263249b4b6c23501aac7864aba4bf51eae4a40f1e4d7b5adeffeef14d2e4f6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457418, "uuid": "f8203fc3-835b-40ff-bcec-e97d36829eaf", "value": "T1F8E402CA65404923CF33C9B1D8EFF9C74F7A71220BB54787221D99F64A451D0AA0B6BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457418, "uuid": "a40b6fed-070c-436d-96f9-9bfc59695fbb", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457418, "uuid": "ef84eca2-93ce-4696-baf5-04d1d92d61fe", "value": "12288:9h+FhTey5soErTQjAdYbEjtWvehKX/ZHwvn+QXcfT6csQJQmZ:9h+fTey5sBALo4vvPYXcfTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687457418, "uuid": "fda0764d-23d1-49d5-ac64-35f58aaf309f", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687457418, "uuid": "432890bc-3f1f-40b8-a9b9-888999d471db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457418, "uuid": "43e6940d-733b-4d92-80fb-a596b7c2291c", "value": "3ad9ce2c823d7c6c6748f3badee1faee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a05c73-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422188, "uuid": "3c941785-8198-4034-b147-7ef3b383718e", "comment": "Malware payload (Mirai)", "value": "3e1e5a79b22c4f2eacbd4dbe0c1d67f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422188, "uuid": "ce410c77-5cae-439f-9cc1-7328ebaacf35", "comment": "Malware payload (Mirai)", "value": "272e576f8d5f30f802417dd5aa9d83f17e5915fa01556e851407b8ff882ed6e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422188, "uuid": "2fcd232c-9a7a-4472-a70f-e56c56f08ff5", "comment": "Malware payload (Mirai)", "value": "a296866877d78d853f0db4a4594a8cf6e5b7e234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422188, "uuid": "02c4474c-f05d-4325-9302-de7a7e84ed50", "comment": "Malware payload (Mirai)", "value": "65b4f1f7049c93f130b013b1fe75d6da273cb461813e78fb1896008203c8b91137130efb63769c0c805b5b9db31f6be9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422188, "uuid": "73693cac-6f83-408e-8784-36949edcd9e7", "value": "T145142A46AA414B13C0D627B9FA9F42453323AB58D3EB73059928AFB43F8779E4F23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422188, "uuid": "3cb04cb2-54cd-43fd-aa01-ba2535004be6", "value": "3072:4zPZSlWyGEtUzS4T5gAaGeq2ZBqB/XoPYGxHMTpz7ZropM/RtSfkL8z:CPgWzSKSAaGeq2ZBcqYksTpz9UpM/Rt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422188, "uuid": "dfd03c97-c70e-43a4-bed1-662fc9715296", "value": 196082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422188, "uuid": "4dae1d26-5b43-40d0-a287-eddb379aaed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422188, "uuid": "c7049a15-a7ce-423d-8be1-d5b59c6d2b7a", "value": "3e1e5a79b22c4f2eacbd4dbe0c1d67f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bcfe67-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687456571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456571, "uuid": "0ff75cf4-4c3b-4349-82e4-59f2f71acb0a", "comment": "Malware payload (GCleaner)", "value": "70735966cc5b1d652b12ce72c5cafa41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456571, "uuid": "388f2cae-e522-4d4a-a2f2-49eb0e2d3ee8", "comment": "Malware payload (GCleaner)", "value": "2759fc5d3a22df9b31ad9db228dfa333027dc4a5b57ba855db12afd61a1fac51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456571, "uuid": "77884e85-e9f7-4cd6-bf51-e6910f3d2cb8", "comment": "Malware payload (GCleaner)", "value": "7b8f7cd0a99db799fe7c57d0026f11340b219c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456571, "uuid": "283a8a99-6024-46dc-9de4-a776168795b5", "comment": "Malware payload (GCleaner)", "value": "e649ee22ad76b8af81f2a7ad5cbc14dac4ebedce7c7974e622509614715342baf97e82005c8ce836dadd3ef18910f84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456571, "uuid": "ab046bf5-7254-4f43-b42b-e9d7a393c626", "value": "T1A754F1223A90C832D939B2384876CB66167F79B35B71C6C777B8165E6E312C06E35387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456571, "uuid": "72e2141a-ef24-4358-a701-4bee37503088", "value": "2155826ed5ea6b37a36f5edd206d85a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456571, "uuid": "2d350bd4-5bd3-433f-a11a-48febf18e767", "value": "3072:FycHB5BdHP49scJTxYAnPmWvjFf/TC6phgMiO2GdcCIbOen5yUcyzoqhRStct79Q:bH3BxQ9N6cFfm6pajrn5Zzoho7sUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456571, "uuid": "18c2c155-d929-4dad-90a6-f8f917355987", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456571, "uuid": "45c63615-d251-4814-8897-dd5a5a417e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456571, "uuid": "722386b7-92fe-4ea6-8efa-fcefdb15774f", "value": "70735966cc5b1d652b12ce72c5cafa41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52d004e-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687430215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430215, "uuid": "f6d35deb-ede8-49fe-97ad-e75a6e2dfec0", "comment": "Malware payload (Formbook)", "value": "57c7197e5a65dfb3079b47e524fd148c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430215, "uuid": "c9ed2930-ac1e-4d17-940f-1f2137203b8e", "comment": "Malware payload (Formbook)", "value": "2834c7716f19153625258be49e586dc0d81be392f9bedeae1ddd740469287c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430215, "uuid": "1e37d1cb-7e62-459c-8400-f1de251c8839", "comment": "Malware payload (Formbook)", "value": "433fb441b04980ba8cfa87e5b5e978c1ea2866e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430215, "uuid": "d89cfbfa-1fee-4430-8156-ba8d8b05ef54", "comment": "Malware payload (Formbook)", "value": "886853487d39122dfb10959fd58449f07aea7d26a8ee281e6e52e874add81e53fd1a408c1e0b6f71fb0e3a489bd51f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430215, "uuid": "555e20e0-225a-42dd-9a4d-49a2de001d43", "value": "T14FE4120476770711CAF50BF169552770537FAE2E3139E28B0C97B0EA666AF0A57A3E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430215, "uuid": "1a81d74c-c97b-4eaa-91fb-3d6692f0bc73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430215, "uuid": "83fe3664-6991-42f6-b26d-b0f8a01d6b3e", "value": "12288:vpdvDhH62MmgPFsOnb89E/pnrKLwqvcYCh8OESIWS6qgJWVYtE2:xdvDcAwY99wVXhzEgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430215, "uuid": "091c01f1-b250-4996-9c7f-df34494c5eed", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430215, "uuid": "3110b319-e3c7-4fa2-8b3e-3e674e66f626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430215, "uuid": "5c7012ce-d5ec-4229-b1ff-73114a40c1d8", "value": "57c7197e5a65dfb3079b47e524fd148c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08216268-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422623, "uuid": "5a5a8383-bb78-4856-b7e3-1a0e88a1afae", "comment": "Malware payload (Mirai)", "value": "94a33ccaaa443e0e544852c992e5b782", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422623, "uuid": "5f5ba838-5ad9-4bee-9e72-9442a5b668d0", "comment": "Malware payload (Mirai)", "value": "284902c8833b6b5a06a2a9753ed23e9ced63c41ffb751789a1a44a5354e987d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422623, "uuid": "48b41781-065b-41a8-bb10-ed17d9227e18", "comment": "Malware payload (Mirai)", "value": "b1e346ff98fdc6f80de3000d94ac36f0bdba6fc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422623, "uuid": "49eb3329-cbd4-442d-b0a0-16473daa6493", "comment": "Malware payload (Mirai)", "value": "f59ab43820ef0e56a907781773b8a5bc496d3649c39e1ebe75fd1be0b91fcbc5182a6ca3a6e1a6bb25811640b4830463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422623, "uuid": "759fd978-a479-4ffd-b122-215b3cd6519d", "value": "T174B39409BF604FF7E89BCC3746E92B45188C691A21A93F71B934D868F24B24F15D39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422623, "uuid": "134d01b7-3d88-4af0-ae66-7e7a7114b57d", "value": "1536:l5k2WOOwHYRXq3SzHpB/QttLjBcp6vemsRvR8dLZfoyM6wnF:U2WOOwHYtLJ2tJjBCgdLCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422623, "uuid": "e10644da-a493-409f-b862-305177833ed5", "value": 110696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422623, "uuid": "6ede676c-249c-427f-a7f8-f48e04bffa82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422623, "uuid": "6eb5add0-c84d-4c21-a675-7fff9573ccd4", "value": "94a33ccaaa443e0e544852c992e5b782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85d4c3b-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687419080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419080, "uuid": "40cb8f87-cff1-4265-ad8b-eec356f213ba", "comment": "Malware payload (GCleaner)", "value": "b8984e6154535656f8f54465e96801c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419080, "uuid": "706b71de-8192-455c-bec4-597b72ae4670", "comment": "Malware payload (GCleaner)", "value": "284ca4faa2aed76adf6b7e08af9fa309979fab0f71e5a99d0844406ceb58749a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419080, "uuid": "bd0d76b3-be5b-4262-9c34-646e197b7de5", "comment": "Malware payload (GCleaner)", "value": "250a89795879125ed458e596042a2a88b0f77153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419080, "uuid": "5bfd65fc-6d28-4e40-854b-d75c560f086c", "comment": "Malware payload (GCleaner)", "value": "b9ee3a49207988152ed5bb930f389f6301fe9aaec9935978874f0929811026646b9ebd06cd6f157856884e4223725333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419080, "uuid": "214acbb7-bc74-4fc8-828f-8d95410f73c7", "value": "T17954CF1362E07C70E5660B729E6FCAE8365EF5104F387B9B12289A1F09B01B3D5B3755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419080, "uuid": "9b85e74e-2754-4a87-a20c-ef6a0b364c41", "value": "7e2f40dcf3d81681fb786c02378f9f78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419080, "uuid": "300ca8ff-e97d-43e0-b269-7093729ab6a9", "value": "6144:I9zttqO/wdDmwkuPEvlPXzdQuXKeA7BvLcvqXi:I95AO4dDkuPcbxtsovqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419080, "uuid": "2fa56dae-19f1-4fa0-88c5-b6f4637291a6", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419080, "uuid": "68532257-a95f-4e54-9a76-8944b435bbb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419080, "uuid": "e09f248e-e503-4b3d-aa53-8220ebb6df50", "value": "b8984e6154535656f8f54465e96801c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58c93c3-113f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467555, "uuid": "e28f29f5-0f6b-4715-b236-1f1fa52f2ca5", "comment": "Malware payload", "value": "cd715954fccde30a32dde3e912bca686", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467555, "uuid": "baf43035-b369-4868-8cfc-0102933cb73b", "comment": "Malware payload", "value": "286512f7ef23bd2b9e331775433fa3a00832bb9e701ad4ec1e7fe8bd00026e72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467555, "uuid": "a56489e7-3c1d-4894-a602-1bceaa249a08", "comment": "Malware payload", "value": "d50561aab1039455d6844e41fc718e5479740251", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467555, "uuid": "d5d2551a-5f58-4afd-b1c1-baf2c0e199ba", "comment": "Malware payload", "value": "dc2aba4040714c2aa786ecc0a2d42779fe950410e2bc4674d6a03e564c9133d21ba05b68e441166c46d308a308706eb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467555, "uuid": "9669c94c-5a89-43a7-bb33-5e3a958d552f", "value": "T1CA74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467555, "uuid": "8273b7a9-2504-4432-a73a-8d6eda62c4ff", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593m:fIS1xbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467555, "uuid": "6b92b15b-50c4-4b0c-835f-2a144354afa1", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467555, "uuid": "832c1ae0-7ac8-43a3-b5c7-f1af146f34f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467555, "uuid": "fa6c9e48-6081-49d9-897d-e0a866164ac1", "value": "BSN-1977985257.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f0356a-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687414056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414056, "uuid": "bb51ec29-0d9b-4e37-a58b-bc1ee6807410", "comment": "Malware payload (SnakeKeylogger)", "value": "0640cfcae95a2d6e36dcff9b1762e730", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414056, "uuid": "9ddc7481-6ca8-4a1d-a10e-15574ec8274a", "comment": "Malware payload (SnakeKeylogger)", "value": "295bc5d94184f0f727ecabd64662cdfbced9d1f19f3dd6b3aacbdd80265da09e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414056, "uuid": "9efdddd9-2f41-461f-9945-db561e65833f", "comment": "Malware payload (SnakeKeylogger)", "value": "285ded4dfd04684cab1c29546ab29c8a1dc83cf8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414056, "uuid": "5a055e43-69f2-44e9-9b14-4d33908a7d3b", "comment": "Malware payload (SnakeKeylogger)", "value": "fd3d7febf5b1173c9221bc625ddacf6888e20e06d1de388a18361feab530bb164cbd8fe9020b7a69e9408af68d54e260", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414056, "uuid": "dd747ef0-59c8-490d-b0b2-536486954645", "value": "T16E2523FC94E97694DB887A1BE336E25957226601C079FC29BB00C736C10E9CDA776873", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414056, "uuid": "2d5c7dfc-6c83-497d-a32f-7a620a342db5", "value": "24576:IMCiHqvpu34Lsq6Yx01Tltvpu34Lsq6Yx01TlB:IMHEKKj01x5KKj01xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414056, "uuid": "95f97d2e-2547-479c-8176-82bb601136ca", "value": 963551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414056, "uuid": "8f337bcb-fdf4-4aca-866a-d5a34b637ba5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414056, "uuid": "f12a788c-609f-488b-8924-3190dac31a8c", "value": "0986543567890009876A.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d126577b-10a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687401915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687401915, "uuid": "3be9c56a-4948-420c-a1d4-1763f3e75232", "comment": "Malware payload (Loki)", "value": "a542adfd5b5699659d6bcd6347512aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687401915, "uuid": "faa371b9-ffb4-4eb8-995e-983d858f7b94", "comment": "Malware payload (Loki)", "value": "2ac835af0f155bbd5f6257b00428ba396714dd9035c3a009891b5f0ed884cf9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687401915, "uuid": "46527b10-8000-4d6e-9827-30a4aeee9fe3", "comment": "Malware payload (Loki)", "value": "7253a27fdc50d20aa24a035fb7545d0bdbb44176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687401915, "uuid": "25b42e29-f257-4da3-903c-963b01b14adb", "comment": "Malware payload (Loki)", "value": "ef4be1bf1f5032b1466db81defdff6e0b32b6e3096b83a3233ab193a6279c8b05d70073ccfa0b2c4663ea86356aace06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687401915, "uuid": "b9e06daf-3edb-425d-840e-26d76868a080", "value": "T134345C4382E17C95ED268BB29E1FC6E87B0DF6504F49777A12189A2F54B10B2E373711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687401915, "uuid": "df9a2289-fb36-4567-a821-e99b514df3da", "value": "0e48d5f6d89199cad77b21fdee68f524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687401915, "uuid": "85142804-bf9c-4c46-b6d0-df320e424d69", "value": "3072:bbqYTnDfVkcOKfB1geMa3P4bJXUec+yFRrWsz5:b++jIKfAfU+pUO2n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687401915, "uuid": "466d3230-ea38-42c4-820e-5d3a1d8e0d52", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687401915, "uuid": "f57ff5b4-62fb-42ea-b334-9e0732500bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687401915, "uuid": "0afaeb61-57d5-4408-beda-97ad56ab427b", "value": "a542adfd5b5699659d6bcd6347512aa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d1b9d3-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687418485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418485, "uuid": "0b25cf4c-7180-45cf-8c05-6205265937b5", "comment": "Malware payload (AgentTesla)", "value": "1b22f03eb7776b2298404450aecf18b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418485, "uuid": "b1936c48-ad8b-47f4-b28e-6d119148aec5", "comment": "Malware payload (AgentTesla)", "value": "2ae1bfeaca0425a84381dedc27738f98fdabe05876fc24667d0fae7b1eccd21e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418485, "uuid": "919d26d5-1db2-4277-b8cd-623dba390395", "comment": "Malware payload (AgentTesla)", "value": "1a91b28a995e1b4a8b6e273b0d6fd423cd077dc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418485, "uuid": "768d844c-36b0-4fb1-a523-ac2540abd53b", "comment": "Malware payload (AgentTesla)", "value": "fd92736de4f0285be9290302dd558d083d80a5fb22a93c40ffbb699b331794140bd98a25ad48b1db5e15d6449a8e1ab7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418485, "uuid": "938542bb-4c10-48fd-90a9-2e6f9faaca0a", "value": "T10EC4231934092BCBD422D39589C0D938EA206F85D1F9EFEC3A7795B87C5021097A73B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418485, "uuid": "e3acd24f-bb5d-433d-9661-1c011cd7ec96", "value": "12288:JB1NW8bEMeb0HkL6Hs9JfV2fyi2C5p3rRlfu84iGBbebSz:71NWEEZ0EmEJQf/5xPu84i/bSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418485, "uuid": "8c839dcd-b90c-4549-b66e-30a9e185cca4", "value": 590928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418485, "uuid": "8d9a5e78-e0d2-4634-b2e2-7244dbfde2ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418485, "uuid": "a7398ace-0592-4f90-a0d7-146e9b5af59e", "value": "NOTICE WHL050C53836900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa4f55e-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419817, "uuid": "8478acae-4ef5-44fa-9769-73e6d12cff24", "comment": "Malware payload (AgentTesla)", "value": "57e8338d136083eb411afa28a7933e8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419817, "uuid": "e035542c-803e-42e6-a6ab-61f6ecc2f74d", "comment": "Malware payload (AgentTesla)", "value": "2af3e1758223c0432696bf2252d89659db6ea920b1c926fba92b3d327a4a7703", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419817, "uuid": "a88a49e1-92a4-4119-a435-ca8c61a5ac80", "comment": "Malware payload (AgentTesla)", "value": "c13fddc8ff1381f2b2a524f89099f8a2b706018f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419817, "uuid": "a51c6adf-bc74-457c-a738-0a5e25a8a80f", "comment": "Malware payload (AgentTesla)", "value": "1589e3a2d07f446c1046312f32a0d39a907b197c61829b50912a0a6c5dfda0c271e58227e51286c7398815d68f21c7b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419817, "uuid": "7daf1ab3-71a8-41e4-84f2-56422feccd31", "value": "T1A8D41204722B0721DBA24FF199562B3087BE6D6D7532D7264CEB74E29D34F0B9582E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419817, "uuid": "48ae074e-4f6c-429a-80db-5e79bcab5275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419817, "uuid": "8b9d39ae-82ce-41ed-8cb4-6dd07546a1e9", "value": "12288:zpdvDhH62MmgPFn8vhnyvLClCz/J59Oj3+sGKemn3+LO6n5iyVti3B2Mc:ddvDcAwG98/J7u3+P/E+LO6MyVtiBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419817, "uuid": "bdfbf259-68f7-4a7c-b0d1-80ff3af9708d", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419817, "uuid": "34d23387-dd7e-4c39-a683-c2131fcec13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419817, "uuid": "53e0a031-310c-47f4-be3a-7e99a4a7d533", "value": "aEDmZrWhMUqFVwy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d9d77b-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687455320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455320, "uuid": "25193baa-ae62-4a12-9f5d-64db7227cee4", "comment": "Malware payload (Amadey)", "value": "489b9f4d4363a3ae0c2b085e071ad585", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455320, "uuid": "8ebdb795-9aa7-432e-8ded-68c9ff1db1c8", "comment": "Malware payload (Amadey)", "value": "2ccfb437fd19456a0d52838663a6f40b24c322ed2d4f34b88b6fe6f3c7bccc85", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455320, "uuid": "c82fe70a-c6df-4103-9ec0-3c8e3ef91a81", "comment": "Malware payload (Amadey)", "value": "9ada170553067ce130fdb8e2118e8e71414b3c0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455320, "uuid": "bb3739af-8579-45a7-962c-8daad138e11e", "comment": "Malware payload (Amadey)", "value": "112f742a538c9733e95183881df858564087c139e8365d1916de5655501921d23a2a40de70369f25b6c59fb780576743", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455320, "uuid": "19edec4c-148f-4236-b716-5e500109a310", "value": "T1ADB4F1CA61404973CF63CDF1C4EFED968EB9712107654BC3130C59F68E5A1E4A62BA3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455320, "uuid": "8ae318fa-ce12-45df-b5b5-abbfa7a0fc77", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455320, "uuid": "3bfe0476-e9c1-477b-97f0-4d2dbd03dd0c", "value": "12288:g4rCqTey5sQ/Zpyxw7mkSEgXVqqtBQCIZpkeb2oQJQmZ:g4rtTey5sipyxJPqqt2kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455320, "uuid": "a4ef3fae-c183-4744-932e-073d41c1bbb7", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455320, "uuid": "6e7ba667-8572-4e6b-9d7e-1604e5809ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455320, "uuid": "be50f180-14a1-412c-af21-731268a37168", "value": "489b9f4d4363a3ae0c2b085e071ad585.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f8d05e-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687456872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456872, "uuid": "2ba4be46-9a74-4cb1-bca9-cb8fd9263d2c", "comment": "Malware payload", "value": "83902056fc6dc0fdca4412fbf7979205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456872, "uuid": "1f02457c-5d37-456a-99ce-751e6e09c2e1", "comment": "Malware payload", "value": "2cdd9e76cebe68ba75d1e43ff4759147b9c27a9cf66624590caba9bf8c405431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456872, "uuid": "41a82062-5e30-4ae9-92bd-9288e8258a06", "comment": "Malware payload", "value": "cbf317fa300e4f95dace91c1b413f10b393f2daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456872, "uuid": "e83eec25-8899-4c0f-b954-e603f2149dda", "comment": "Malware payload", "value": "d45ab2c7d39aa66c5fc08c70342b61bb379e85e952346d626a1708306c77f4ebbe0747bf1b38f179fe91d71da6a698c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456872, "uuid": "594399a3-ff3e-43dc-a780-dd55c8ebae17", "value": "T13E26021AB9648C64D593D4331015D6A39206D68EBA18CFCF13B01D0AFEF55EB8B12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456872, "uuid": "6d4530ff-11ce-451e-ba48-cc20f46837f3", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456872, "uuid": "aee0a70e-d619-4c18-90f4-4391be0982d4", "value": "98304:Qq21KaNjf5rBIZU86Ch3/NCFBdkPo3Tsy1y6Ifgk31fTmU3Gt2U6cj:e1DNr558bhV8dkwDsb6M31fyU3Gt2Uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456872, "uuid": "62752cb4-f041-4afd-91c4-d17979c3276d", "value": 4741461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456872, "uuid": "632f20eb-a4af-4cd6-bfb2-d4998e6ee14d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456872, "uuid": "49dade3f-8da4-4b1d-a71e-4f7aa134a96f", "value": "83902056fc6dc0fdca4412fbf7979205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a5f5a3-10bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1687411021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687411021, "uuid": "f275a30e-970d-4f2e-a0c9-1eb63f332eeb", "comment": "Malware payload (FormBook)", "value": "d301b03b30f44092268bb007d15d8e7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687411021, "uuid": "bc21614d-9625-4fd4-9185-1b7886edabfb", "comment": "Malware payload (FormBook)", "value": "2d91cd8dae6493be45db04cf30579c626a8d1ecfb1cc5296c5b82bfbde27aef5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687411021, "uuid": "a0715881-a930-4a8b-a1ab-95ae92b5510e", "comment": "Malware payload (FormBook)", "value": "91caa09f8253cee01eb8de38297b1ac807693998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687411021, "uuid": "2af387c1-23d4-4134-9fde-0323a20ff1c2", "comment": "Malware payload (FormBook)", "value": "bda06abf2dae622dc2ae055b771e2b8d7fdfde3f88b19e6ee514d8a499feca8adcc51b09bf138fa62e15c4dd90a6682e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687411021, "uuid": "542b0baf-2538-4e6e-b385-39067c3fada9", "value": "T1AD251220B0D0C573D57A043484EB8BA58D7B71720B19A5DBA6DE6BBA9F203E1D3353C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687411021, "uuid": "bf9a43a3-7b98-4218-90e3-4885cb1afbcd", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687411021, "uuid": "5ea9c31c-d3a8-46b0-83af-572cc7d931a8", "value": "24576:dk70Trcn3/Q1o6NuC2ccNKwNLUzC+Ki+sFG6ZIeVi:dkQTA3/96NbA7NLUu+9tJ3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687411021, "uuid": "55080008-2c9b-46cc-b831-b1b08c6afd39", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687411021, "uuid": "1588ce3e-c7cb-4457-ab0a-26d8a2501505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687411021, "uuid": "4841be03-2da2-44a7-8cb2-a0adc78c57f6", "value": "d301b03b30f44092268bb007d15d8e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1ca053-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420425, "uuid": "b15e0ee2-36e0-419c-86f5-98a240cb6418", "comment": "Malware payload", "value": "2bc5e4cbb75d904cc749580bd08356fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420425, "uuid": "b94adec5-a8da-4c1f-9fe7-563746540df5", "comment": "Malware payload", "value": "2ee1551e35334357950130d706f43dec0712413a26419ce31f241a1635e741b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420425, "uuid": "cdf1f55d-d948-43d9-abbd-ff09601ff308", "comment": "Malware payload", "value": "a582064a2db60b4571d341f4adbd00fe505dc0a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420425, "uuid": "f661b3ad-5d85-42dd-ac07-5a8d775a1d5d", "comment": "Malware payload", "value": "3344c858031c49af82b0e45f724900092332139c4b1313ea957c510790835c289d2582f806f67358f8576689c11169f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420425, "uuid": "ada1ab77-7301-4332-9276-01cc0de694e2", "value": "T10B5612320532BDFE876C389494052B452CED5C235359DFACFA4414EF29A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420425, "uuid": "f1b07089-f9d9-4bea-a153-b85a87fd9d94", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6p:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420425, "uuid": "d5867d38-0d93-48e5-95b2-9038ba22814c", "value": 6356587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420425, "uuid": "983e836a-1518-4d42-9683-88bfa56ea6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420425, "uuid": "94ecb458-5b12-4fa3-b5da-2d86041e6b8e", "value": "2bc5e4cbb75d904cc749580bd08356fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0b9fd4-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422200, "uuid": "8ab8aebc-0966-46d2-bef4-ccc0564ed939", "comment": "Malware payload (Mirai)", "value": "f76af636da0db9ebb746d3797932041c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422200, "uuid": "52558331-4331-41a9-976b-eba743feb213", "comment": "Malware payload (Mirai)", "value": "2f0f249627a8f5b488c84caf90c49f0b2089c071f36854b2f84055ebf4aa8aff", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422200, "uuid": "7c4ab7f7-2c86-4260-8261-89d6bbe9e3b1", "comment": "Malware payload (Mirai)", "value": "d301614b9127b3fa927e82779d79e66e27964d77", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422200, "uuid": "5dd429d9-8fa9-4cad-894a-2a3dc7c3160b", "comment": "Malware payload (Mirai)", "value": "b92c199edbd75fbaa548732aa84916672d6a1409b7acfe296daee91b4cc40f5e9518cc5de4fd214d556b577687e88d6d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422200, "uuid": "2c7ad42b-a2c2-4dc8-b718-c6221c95e8fa", "value": "T14CE33A0BB5C194FDC899C1B44BAFA537D932F51D1238B25B27C4AE232E4DE205F2EA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422200, "uuid": "846a185c-dfd3-4b5e-975b-19e3c5374095", "value": "3072:EJKeY5LSNMILVcnhbl0xvYoobvMq1we/SEi72A7nPwYJE06RbZ:gKeY5LSiLnBBliSYJqdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422200, "uuid": "f32fb8d1-b656-46c8-b5f6-dca9ec8541cb", "value": 151208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422200, "uuid": "e41d4610-c944-4e2f-8c5a-2945a10057cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422200, "uuid": "008362cf-383f-49c1-a180-1e7cbdff7b10", "value": "f76af636da0db9ebb746d3797932041c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfdd383-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420752, "uuid": "4f60d941-7024-44e8-ace2-345f62d755ee", "comment": "Malware payload", "value": "0d6033db8f67779134eadc5b7bb10852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420752, "uuid": "9afa8e3b-5427-4060-991e-6fc5adcb03f8", "comment": "Malware payload", "value": "2f1bdb454627b2f284c307adade7239880c1ce1e69ce8d778f08e03b9985f4d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420752, "uuid": "e8d9be75-764f-444e-8a2f-3cb6cd409bfb", "comment": "Malware payload", "value": "5bf4b3534816432bad7431d13202658f3b1d6be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420752, "uuid": "911ca83d-9e46-4759-97f7-4c9367b19efd", "comment": "Malware payload", "value": "a4479379f1c1e56c86698fdadf89e61f70281349ec5252fddcfdbd9dac222f1aa9a3afdb30eddd0a31aa19205e621ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420752, "uuid": "69dbda02-6567-413b-9933-f645150bf323", "value": "T157348E01B4C0C432D5B314738EB99AA9EA3DBD600B656AEF67E40E6FCF70AD0B570915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420752, "uuid": "ade4428a-f620-46ab-a09d-3f088a028b5f", "value": "9af3e93e35221a2c8c04a3cc05e589b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420752, "uuid": "62218f88-ca89-4498-8f8e-7c6c637ba27c", "value": "6144:36GCla87CJDniKHHR2ek5WaB1AOMcy0+:36/lb7kDniKHg1nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420752, "uuid": "cd9be82e-7411-4b78-ac5e-8177556bbfa9", "value": 246274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420752, "uuid": "b949ebda-2e59-4b9d-b152-67da0fb68ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420752, "uuid": "610ff5a2-1f95-4588-ac1c-03813217f493", "value": "0d6033db8f67779134eadc5b7bb10852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f76b673-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420944, "uuid": "d75b9f23-397c-46c5-a0f6-1d9cd9e2dc2b", "comment": "Malware payload", "value": "57b3fd3a959812b56cd2b5320ddaaaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420944, "uuid": "afeb8f8d-79fe-4aa6-bbe2-2620faba7076", "comment": "Malware payload", "value": "2f681855be0dd04504af1e6dc071318e4cf04cec378586095d8f791e8c5d502c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420944, "uuid": "fd6cc522-472c-4651-be99-e11a4706a591", "comment": "Malware payload", "value": "478f5fe8f4366eec96ac8836994d1e9fd974a92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420944, "uuid": "6beb29d0-dade-46f9-ae31-893d3e1bc434", "comment": "Malware payload", "value": "35a7a980b0b1b970d22fbf51550d780eb01dcbbf6b990340a70244504fed1e1447ebb5cd49f3a1698e474746a2b4d21c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420944, "uuid": "b620a460-9ca0-4520-a69b-7a67ef5e22f5", "value": "T10C76F707E9A141E8C0FED174C626A223FA713489573433E76F61DAB11F26FE46A79360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420944, "uuid": "aa23720a-e45e-41fc-a1dd-c9d39cb13011", "value": "49152:oK9n8EXE9YYMDWn4rb/T/vO90d7HjmAFd4A64nsfJs3b3m2XPAakDMt5lttX5Hpt:ow1xYHomdJ4Uf8clEVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420944, "uuid": "99c7b6cb-d88a-4dd1-9482-596fc10d6019", "value": 7216471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420944, "uuid": "bc4fb750-c823-40f7-9af3-8f93a7052b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420944, "uuid": "0d18047b-822b-4c56-96ad-ff537ae9cf2b", "value": "57b3fd3a959812b56cd2b5320ddaaaa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088cbe18-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422194, "uuid": "7188e772-e8aa-4a18-b9ab-7a3aa6f6197c", "comment": "Malware payload (Mirai)", "value": "5511b0005c9dc60ed53309849b3242c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422194, "uuid": "da538bb8-e399-4e44-acc1-49a6f3dc6ada", "comment": "Malware payload (Mirai)", "value": "2f9876a7687f96d20d732ec3f2da91a4b49368407993263e3ab63c1c6062ed3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422194, "uuid": "721f7ddf-9688-4053-ae31-a32a04ccae5b", "comment": "Malware payload (Mirai)", "value": "320f0393da9c9415c6f1ddec4d29fe69a399dc21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422194, "uuid": "4ab48ce3-b55e-4c4e-b99f-6037065c9e63", "comment": "Malware payload (Mirai)", "value": "236f4929b7e11cb2ba395bce132971ac05ed4ef7779518c0d09521794832bf14670b8940228f9c3009afe999144e502c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422194, "uuid": "66333bec-7717-4d88-9179-c8429af66022", "value": "T142E30956F8819B12D5C152BAFE1E128E33131B7CE2DE72129D246F247B8A87F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422194, "uuid": "d1d52e35-3819-452f-b564-debb60e6e9cd", "value": "3072:ZZNkDxvzjUDGOhAXiNCfrP8attMg/l2SUX6CdDY6eR:hkNPsTAXGCTEag62SBADYNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422194, "uuid": "65719303-9760-4f7f-bc07-1634aae0d4ed", "value": 154960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422194, "uuid": "1686ca3a-52f2-4b1f-8f1b-38813fc0994b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422194, "uuid": "f4413ef2-376b-4cf3-8cf3-0a4a3028b015", "value": "5511b0005c9dc60ed53309849b3242c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b95913-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419101, "uuid": "b721f2f4-f5c0-4bc5-a2a0-afdb4a8485b6", "comment": "Malware payload (AgentTesla)", "value": "eefc4ab59083ff0291d0d5b1874bcbc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419101, "uuid": "72a7b094-f847-430e-b30e-f972d2449f88", "comment": "Malware payload (AgentTesla)", "value": "3034f4c4123e20d2d2306263c3fc0cf2ddd0b9ed15e480386d45c4550140233c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419101, "uuid": "2f9bcc5c-507f-4eb9-985f-2c0956a5a09d", "comment": "Malware payload (AgentTesla)", "value": "f9cfceca67230971eac3913e4f4bcd59112dbb57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419101, "uuid": "a006a4fd-3b98-49de-b67e-854db7e76a8e", "comment": "Malware payload (AgentTesla)", "value": "dcbee26cfac9b2aaa3984fb5920679a13aaae840a10e7a5451dc25ace1f4035e182352ee6b02df7e095e0a4ae36b5cc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419101, "uuid": "1697f076-545e-4404-acbf-1b071f849608", "value": "T199E41258736F5013D29F0BF81620267403BB78AAF931C2EF0E9BB5AF55B5B028650B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419101, "uuid": "8f79c228-d5a3-4306-8f16-9f1dec13711c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419101, "uuid": "ed51e561-3c7f-4bf4-b075-d69400e56f28", "value": "12288:wiXpM1JCIQfNsVcuoQHr0szG24SMSn7i9yp5bP578kYFBQFscFR5YxSLEMGCQX:81KNoLzG2ASnGIB78kYFBQyU51oMGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419101, "uuid": "acd19a38-1e13-4fc7-8913-18024fa28a3f", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419101, "uuid": "d70b750c-12aa-46ee-b99b-f6ae5fa9d7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419101, "uuid": "c5766195-4376-4dd5-a51f-9a401d0a3f7f", "value": "eefc4ab59083ff0291d0d5b1874bcbc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fc1c94-10bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687412369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412369, "uuid": "e6e5d57c-b07c-4762-a48b-ff0fe56f6885", "comment": "Malware payload (RedLineStealer)", "value": "45912e41c6fd225febf659405119559c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412369, "uuid": "19223b27-5591-4f3d-9cb3-d247d48199fb", "comment": "Malware payload (RedLineStealer)", "value": "30b070956e3beb5084c84499a4c0547a6c14a7e44f1892db256cc715573500a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412369, "uuid": "44ff1138-544d-4abc-87cf-026e2d0140f6", "comment": "Malware payload (RedLineStealer)", "value": "31b2a16c80034ab28a5dc3f622e35aca5877ce11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412369, "uuid": "a837c616-4e23-4cf1-8b08-07b31e6758ca", "comment": "Malware payload (RedLineStealer)", "value": "af159c8b83200906d1543f9638f53acc24ffe1db979e9f2f5d1113a70cafdab6d70f8e50403c6394c22366107796efae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412369, "uuid": "da3a0374-b5b8-46b1-acbe-3df98d36731d", "value": "T17555E011B4D1C072D8B2153209F4EBB65A7EB9310B665DEF67D40F6E4F303C19A32AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412369, "uuid": "ee4ee75d-03fc-421f-90d2-5596c2f6d8aa", "value": "a9b1a20464c3a4170fbe83bc011f0579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412369, "uuid": "bee0987b-01c8-4e50-986d-a1090280c5a7", "value": "12288:jABbBWNSxDaGXE9G2+jAwQuylK4aJOPWwFG8:jAXWUxr0w2445PWwFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687412369, "uuid": "c00f6006-b829-47a7-9b6c-755c5c741e3d", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687412369, "uuid": "9f397cc1-2b70-48f3-8fcc-7a8700c63489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412369, "uuid": "8ca80774-bbbe-4993-be2a-cfa3173505e5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01425247-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430342, "uuid": "4c728287-47a9-413e-a393-8ebbdbdf4521", "comment": "Malware payload", "value": "cdef42b9194790d45ce6356b432e245d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430342, "uuid": "225dada2-8e46-48ca-93d8-92ae0526d26e", "comment": "Malware payload", "value": "31e66a2ccad7a97321a7a37f4790f1f5faf63686e4844d87c3302ac9e852140d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430342, "uuid": "c7729758-ad6b-44f2-aac6-70a857bb1ae0", "comment": "Malware payload", "value": "9b68de55b6d681c0dea770175c51c32be5bb10cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430342, "uuid": "9fb2f763-57c5-4491-b5ec-f1754b5e77ab", "comment": "Malware payload", "value": "b1f49ecba9c862d1f20a72bafd927eaac9a53f2095919875788e527aa3d0ac18335f84741ef73afb94e911d09c3a0fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430342, "uuid": "8961f65d-2106-4e30-8a32-5ba0446cf404", "value": "T1C855336EE253CADCAE54757B53005AE9729DB47880853D3242FA3F39243A1B1E93D34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430342, "uuid": "ab8258d3-0151-4904-9f7c-fb5d488bbe0c", "value": "24576:PIN2OehoeMDT+YKRRm9cx5WgowZwGfrBGV8rtPVJI2YBZi9jELoUjrYw/YWlG5/t:PIYOehoPDsucOgn+Dyrt82oZ081rddGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430342, "uuid": "713fb455-f019-4b8e-8707-9c1300cae4bd", "value": 1282887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430342, "uuid": "1710e01b-3110-4e74-8533-aaa1a17ac5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430342, "uuid": "895e014d-d34b-45c7-9727-1178dd947cdc", "value": "cdef42b9194790d45ce6356b432e245d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c645e1f-10cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687419409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419409, "uuid": "2fa65938-5a85-428b-8d66-cc5e8b43765e", "comment": "Malware payload (Mirai)", "value": "851d26b342f60150a98ac8a11d2b4644", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419409, "uuid": "2fcfcea9-9204-4854-9469-d7adb5d0a2e2", "comment": "Malware payload (Mirai)", "value": "32ba3519537d5aedea4b7122d57887d1809c91f4ee3fdfa018b05e6ad192a8c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419409, "uuid": "1af069df-0250-42b8-8335-0cdcd823c870", "comment": "Malware payload (Mirai)", "value": "205ad2792cdd6beefc487727f9f5c60b0f79ed06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419409, "uuid": "50f86d8b-4b7c-434f-997d-bb2f93231570", "comment": "Malware payload (Mirai)", "value": "7808292d52717ffb79f756bd82ffce569e503a3b894acebcb7cebcdefaaef6d96f11bc643f615cbb6df97cf8e6d78abb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419409, "uuid": "74ad8be8-ff24-481c-bd49-d7bd577fffbc", "value": "T161232AC57583F9F8DC15057C207AE7729EB7F83E603ADDEBD399A5239812601A20329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419409, "uuid": "0e5deb9c-5b3e-4b52-b6ae-151b82dd06f3", "value": "1536:AsbZYXNkWLJMkN2mBHQv5pkmHAkFwAEUN:A9XNj9MkN2mBH85Fgk6/UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419409, "uuid": "42f09251-e509-43be-a7af-f358cc5a91cb", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419409, "uuid": "ce7f0995-9440-447f-b175-ad711c2f105c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419409, "uuid": "57c9e300-ca1c-4a3a-ba67-0807c9fdfb80", "value": "851d26b342f60150a98ac8a11d2b4644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2371cf04-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687430400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430400, "uuid": "c47bf3c8-de7e-4bb9-8e56-b32ca4b7962b", "comment": "Malware payload (SnakeKeylogger)", "value": "6feccb2cd8a42c35d57577be364228bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430400, "uuid": "0c8e9eaf-d600-49b5-bca8-b4f0080ffc7b", "comment": "Malware payload (SnakeKeylogger)", "value": "331bf1b8daecf2013f1a87e15ef1e185a1fe02958c31d22bfb0ddc499d69a80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430400, "uuid": "24d9b156-fc40-463e-a8ee-6dbfcefa63c9", "comment": "Malware payload (SnakeKeylogger)", "value": "919aa5393484bdd4617a2016acbc69579253d685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430400, "uuid": "b1f763dd-886a-4c24-b634-8ec88e2c6e5f", "comment": "Malware payload (SnakeKeylogger)", "value": "46da9846ab7bc2c569aaf0c513594c1ccc1baadd5cd12f35b8a47189eb5ee96e405f0395a967e95549c26f9b1b95525b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430400, "uuid": "773e84d6-e67f-44eb-bdba-725bb57a084d", "value": "T1CF25D04032699F60E4BE8BF20970527157F52EABB03EFA094EC7B1DA2971F518961F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430400, "uuid": "02be22ea-dfed-4f41-9133-3cc249d9cec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430400, "uuid": "58836b69-ecab-4ac1-aee3-dd40f6dd3c6a", "value": "24576:57MyuyF1d3EjwJ1KNo5oXHSR+aH5J/oSRpmACW/84vN6dN6icg:57MyuyTe0J1KNo5UHK+m5JppGi6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430400, "uuid": "50d0c293-34b2-4679-a493-58cf858c7de3", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430400, "uuid": "6a455fb9-6ce1-4972-8e97-d241128b8af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430400, "uuid": "9fa1bf19-eb88-4841-aa7e-d03285c84c0f", "value": "Bestellung PO-0641 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260c1a96-10f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687436847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436847, "uuid": "4b738029-fe22-4970-84ca-3ff19f2132b8", "comment": "Malware payload (Guildma)", "value": "49e538ca28a39087cab18c56dd6a26e7", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436847, "uuid": "680bb786-785a-47f5-ab98-46df65d9dffd", "comment": "Malware payload (Guildma)", "value": "3662738ea93adab0cb1f14c42f486809215b8ddcad12e32f9d949bcb83b77cd2", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436847, "uuid": "e4eece15-29c7-46ee-8562-3f9027a13bb3", "comment": "Malware payload (Guildma)", "value": "6c044a611dc0dd325122048ef1d0781935683ab2", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436847, "uuid": "fd5b938b-d671-4db2-8b24-9c0d9bdad839", "comment": "Malware payload (Guildma)", "value": "3e54ca857b9201a29ad9107709d3a6fde22ccc3bf9b667620b2d06bd11a57ab82fe086389160fa609531d5696d41e3ea", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436847, "uuid": "4081f0e4-b4c4-4c4c-91ec-a4857a639d2a", "value": "T17E42D0C2332A424B9AB0E6D2D078948D0D50C059FF3DA2ED65D613A5F3B0398B3F569B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436847, "uuid": "40dd04a7-4c2c-4c92-999f-6b1e75624e99", "value": "192:dAfvmbn1THJidxtBa6CFmdHFrJSX5EdkFaUFdkFx+DrqOSictdVPIVj9bbVmEB7O:+4rbPqOSictdVPILrQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687436847, "uuid": "aed93648-0235-4306-9f6a-b4764f36578a", "value": 12065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687436847, "uuid": "6fe92011-e168-438d-a342-63f99b75838f", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436847, "uuid": "5ee9be28-2955-4a92-893c-fd415818a68a", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af8f25-10f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687436168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436168, "uuid": "36c372cc-27b1-4ebe-9ee4-bc30c1f592e2", "comment": "Malware payload (Guildma)", "value": "237511d79201b073c6e1cfbc712ae861", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436168, "uuid": "1d6b92dd-0d91-4a02-ba9c-362e01d2de46", "comment": "Malware payload (Guildma)", "value": "366deb8fd6bd44a280afbebdd38d2baa641f8bddf723e2aabdb0e68a08d70c3c", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436168, "uuid": "92602afe-4232-4511-bfb2-8d17f8213814", "comment": "Malware payload (Guildma)", "value": "bcb6282140e78e4b297c582978e9671374fecccb", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436168, "uuid": "6a375ad1-5ca2-4e52-804b-1ba6f4306258", "comment": "Malware payload (Guildma)", "value": "93cc7f300fba0d52686eae64617825b4c17b5ff8859cf59c471f5deaf9d4dbb0b6e5e6b6411a0a32886d6f8f0f0a4d5e", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436168, "uuid": "6775ddc1-da33-4dae-9d11-7b78680b7bc2", "value": "T16CE2B3D45B91BC82F1A9BD8A34D956ECFE048C2E09F69243FC0909C169F96E43637E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436168, "uuid": "b3c86aeb-0cfc-40b7-9943-57c4023ad562", "value": "384:CIa9mo/ENUqk92TccQ6Xcmb0pq/I9uD8RSHQ/9WLkZav4tezr2lYPR3b1A74DvFM:bMbsNUfUTHas7qAsAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687436168, "uuid": "a6dd7126-b2eb-43ac-9261-9c732fec022f", "value": 31879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687436168, "uuid": "31a4a49f-1508-472a-956c-145f74e2d4d3", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436168, "uuid": "8c64cfa3-85aa-4bca-afcd-506260dc0e49", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45ec098-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459527, "uuid": "f1e955e7-9625-4185-8505-36a542386817", "comment": "Malware payload (RedLineStealer)", "value": "24e1b85c9ae385a2da4032152f218f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459527, "uuid": "2c3a80a0-3a6a-4171-80f1-b025f8c39274", "comment": "Malware payload (RedLineStealer)", "value": "3737cf23085d017ce4acc0574d6841624973451fd6028597e7c045354f7e769b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459527, "uuid": "dce99d12-8b0c-419a-946b-484cb3c882ce", "comment": "Malware payload (RedLineStealer)", "value": "f8644a77d312d325c9ef03d4ce7e5ab5f1d4bd70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459527, "uuid": "1cb39dc5-f7e4-495d-a685-ff4f48c3a0cb", "comment": "Malware payload (RedLineStealer)", "value": "652ac06cc15406db62a7eaa6603186c9f0bf608eca6fc408b213dbfeb8796b10bf64ffb81420af46de9949c372053231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459527, "uuid": "0f26f222-0de1-48ae-96a9-0339ce650e77", "value": "T1A3B4F1CA26404973CF63CDF1D8EFE9974E796121077147C7520C8AFA8E066D4B61BA3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459527, "uuid": "f4fc05c2-b6b9-4de7-91b3-6fb9140a41d1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459527, "uuid": "ba8056da-e67f-448a-aca6-5a66c54c504a", "value": "12288:EEFvETey5srnnOw4DoTmS8pZs7IK300MwH6JQJQmZ:EEFcTey5srnnO5oTmS8pZsR5HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459527, "uuid": "56cce9d3-dadf-47b0-a82b-221b2966b3a3", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459527, "uuid": "19dd1128-0c70-4b0f-9da8-87253190c14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459527, "uuid": "7a3283a1-d275-4c80-8606-b8227f3da96f", "value": "24e1b85c9ae385a2da4032152f218f6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba16c2d9-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420774, "uuid": "08d0c7c7-7337-4e0d-b9d2-d592812b9321", "comment": "Malware payload", "value": "d3a38fba64942d8e2d02397cbc89e987", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420774, "uuid": "1e57135d-2d86-4b7b-b98c-7bcfb6fd14dd", "comment": "Malware payload", "value": "376e59c0fe0f3f90d9d2b12334ee445997b3e3df59ceb71107e65ff446ceb49b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420774, "uuid": "386f20b9-1aa8-4d99-8cd6-fded5a99315c", "comment": "Malware payload", "value": "d4da000e4d1ae7c165ab8caa380527095e530a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420774, "uuid": "f86802ac-bb4c-4d29-8359-eb2d985de308", "comment": "Malware payload", "value": "e6844e83a0c69556c7e5dd960d8b50760f20b19964833a993babae34c59539fc446de2c68494685f7c6086473de24437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420774, "uuid": "111d6351-d4ae-47b3-a0a0-6bf2f27cc739", "value": "T1CD557C713A82C236CEE220F68BBDB96E05CDA2740F2055D756C81BDDCE741E36E3255A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420774, "uuid": "c57453ba-7df6-48d6-8b9b-4498be8fd60e", "value": "b16bc6bd289af6c694558f286b87ab77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420774, "uuid": "a307726f-b7c3-4782-9a3b-b5932156dde4", "value": "24576:dC+KZIKCkKR8kwclaVN3KVdCEZqDBXrfYp0AFRRWgR0CWUKg70p1UdboNoj91m03:AWKCkKR8kwclaVN3KVdCEZqDBXrfYp0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420774, "uuid": "e76d4d9b-8ffb-4599-8606-ff55a8be37ae", "value": 1362956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420774, "uuid": "f92cff1c-9508-47e3-982f-49d78c3fb89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420774, "uuid": "417e9bb3-bc65-45b7-9530-e0958d11795c", "value": "d3a38fba64942d8e2d02397cbc89e987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81769e1f-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687413378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413378, "uuid": "742b4e81-70ae-4ad0-a330-210eff5cd9cb", "comment": "Malware payload (GCleaner)", "value": "12bf7b01ec12ef559501607267d58327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413378, "uuid": "86206fa6-6f09-4698-b915-86bbcb213b4f", "comment": "Malware payload (GCleaner)", "value": "37f1df1dafb5facb820daaf1f1bce77aa84b097e12b94f4e078deb73b0780fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413378, "uuid": "ce8dc825-b8fb-4e7e-9918-2d5ce687dc50", "comment": "Malware payload (GCleaner)", "value": "31f4e9b20c2bf8bcb7ab0d34ebd3fad2e123e640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413378, "uuid": "ec3e0303-2148-479e-9486-0306c4726f3a", "comment": "Malware payload (GCleaner)", "value": "8c28bddd0fc5eba3169c2a0d2e749a98ac117ec73e2c53ad1b1dd0e945113d8a4f9996404acb4dbfef147f2970881432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413378, "uuid": "c464c77e-6e56-410c-87ea-0f1862c227bc", "value": "T10664BE1366A07C74D9228A729E3FCAD47A2EF5508F197B5B223C9A2F09B01B1D673354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413378, "uuid": "f91beed7-26c4-45eb-b8f9-a6be038ee6db", "value": "dd79210c843d26dc67ae66f05ffeb768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413378, "uuid": "0f5c0747-3316-4bad-af16-e95801d95592", "value": "6144:vygsk6bK6NhE7IL/ayt4Ui87+Q+xvhhqo2Ix7:6jZbPc7gf2AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413378, "uuid": "3cf6d557-5624-43c4-aedd-f54b7d36c1e1", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413378, "uuid": "94518a96-b785-45de-acf2-e53b2f2a836d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413378, "uuid": "c1411cbe-fcf8-4a9a-9865-b89b99f60576", "value": "12bf7b01ec12ef559501607267d58327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71cc3fa-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422594, "uuid": "52eed669-50b7-47dd-87af-02efe5757268", "comment": "Malware payload (Mirai)", "value": "72e848eb35a6a80bd9024ed4bb5df1a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422594, "uuid": "8f70bbdb-af19-4832-bd0e-1688f2f81337", "comment": "Malware payload (Mirai)", "value": "3938ae647a6167752f79a0ce3f3016f77219726aacd6b8bd48f84006760a50bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422594, "uuid": "bf44dc08-6990-4c0a-8435-547759cee895", "comment": "Malware payload (Mirai)", "value": "6e1e6c7e82044915da753f0831a491cf474c6abf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422594, "uuid": "f817ca23-0b23-4f27-969a-dfe8ae19661a", "comment": "Malware payload (Mirai)", "value": "c2ef992c4ab14189a2e236fc1ab28b4522897d75559589431d2de7484b9dae2261d43ebacf001a9e15d5934ba7b6a338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422594, "uuid": "58c79580-9c2b-4c80-80db-d4d6fb2a3501", "value": "T1D0431825AD792A26C0D8A57A61F78324F2F2224E26F4C61D3C720E4EFF14B4069177B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422594, "uuid": "ce36c119-7d2c-405c-ba56-8aa7ea60446f", "value": "768:O1o8uYoq94eDDzMaRTafZPuSqtfTtgN8gUrisqvGgSO+9pOm1I:O1nuYoSTDDzMaR2fpu1tfTyN8DgQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422594, "uuid": "7ec175a5-4f82-4f70-a506-adec8b36861c", "value": 59332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422594, "uuid": "0d798105-3744-4f09-ae7a-867f4c0b4c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422594, "uuid": "48407bd4-9e47-460c-a3d2-6c61ab0ab242", "value": "72e848eb35a6a80bd9024ed4bb5df1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680df455-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687456714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456714, "uuid": "ead23d56-97ce-4502-aa2f-8675cefd5afb", "comment": "Malware payload (Fabookie)", "value": "7cfe502784e8d0f55b9891c8c95fe3ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456714, "uuid": "38e5b0b0-c7e8-4a57-be5f-8af6ef5419a0", "comment": "Malware payload (Fabookie)", "value": "3995ed61d4b3901bfacb5a8d36500664c1145c6287f8eba5f0077ef1b780355c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456714, "uuid": "b2752430-6938-461d-bc60-d4291ab596e0", "comment": "Malware payload (Fabookie)", "value": "c351f93667fea954d22f1623167f892b8b2980dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456714, "uuid": "b0fd84c9-301e-4716-ad9e-a4dd2762d93a", "comment": "Malware payload (Fabookie)", "value": "6fa884dedc0caf3dd4b5537636ebc0c5f9a303b287c47288d4c59f60273cfbb5993dc97c447a2aa04ab666a1db859210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456714, "uuid": "498f4e25-16b3-4dce-9efb-6f986f905301", "value": "T12D05C0711DA3E7218AB6CD2F6DEABFC6459493B27D01D3BC8144D52E4A4BBF0C922D48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456714, "uuid": "f37ae2a4-9d7e-4d30-a4d1-047a856626d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456714, "uuid": "c410af3c-23ca-4c01-b01c-edd6c3a8d77a", "value": "12288:VJsiPqFccfWaqr6wA9Fi2Xyz+XXetgkOJ1ZKZYo7UY0wxgYgTyVe/QBxg+yn:VJlYc2qr/mFi1+0OJYXQYAWM+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456714, "uuid": "9468a29e-938e-4442-96fa-0851b69e3da2", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456714, "uuid": "fa2874fe-2de1-46a4-84dd-bca2901300ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456714, "uuid": "a1bb758c-4fe7-43fc-aedd-f1812be496bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e684ef-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687442834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442834, "uuid": "07e4158b-667f-4512-b386-2fccb1b3f02b", "comment": "Malware payload (ArkeiStealer)", "value": "9272fe5a3cf27c8f4fba0148d57dc0da", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442834, "uuid": "998f58da-772d-4afb-8831-5682c7e745f7", "comment": "Malware payload (ArkeiStealer)", "value": "3ac337b6785aaf1104179e5f38c7e1f58288f5fa9da6b442dbbb10405c0a8f3c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442834, "uuid": "908587cd-adb0-4dc7-b35b-18ae08151015", "comment": "Malware payload (ArkeiStealer)", "value": "01f67159c01fe7b1ae1c0bf4158107e119089fdf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442834, "uuid": "d27f7db2-6da9-40dd-a06d-0f55cbacf579", "comment": "Malware payload (ArkeiStealer)", "value": "64bc8dfe5aff2d20767ce46023acf4451a75b03e26507bd28c449a97cb3fda150cca470cf68e017edb3f28350471227f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442834, "uuid": "dec0370a-be49-4bdf-928b-f13f7467dd6c", "value": "T13964F1A17A60CCB2F82BB2B819258695777BF87163A5C68B3354176F0D312D19F3B342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442834, "uuid": "c1f7658c-277c-401a-96ea-8cda83d6f915", "value": "8bbd6ffd639dbd5d8bd87b5cbd77d83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442834, "uuid": "8515b5f0-c69f-4fb3-bf20-4dc35e3ee7a0", "value": "6144:8Rltf1U/Yskkb2fa1T9dhyNS2FvA9ca3gvaXcf0:0sknfa7dhyNKcaQvaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442834, "uuid": "c63210c6-8da4-4915-beb7-a1b6d3df9555", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442834, "uuid": "4ca5418e-f7a3-460a-b80f-fce02832969b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442834, "uuid": "9319927b-31d0-4bac-89ea-f245f2749142", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d7bdc1-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687413388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413388, "uuid": "63ad6ee0-949f-4ff9-a9b5-274a17dd2d43", "comment": "Malware payload (AgentTesla)", "value": "e25a26e093e81125addc4508e273bbe8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413388, "uuid": "868831fc-c1a6-40a6-b2fa-9d93e68329d3", "comment": "Malware payload (AgentTesla)", "value": "3b2e7939e8a52f2f066206975d645bbc8dce2c6851dc3e6f4d07e3de57667b0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413388, "uuid": "29536c9f-5610-42ff-8016-b2648e0478b9", "comment": "Malware payload (AgentTesla)", "value": "cc4d7f117e56db2beae292fd90c3e57e1b7c4aec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413388, "uuid": "41a57d1c-9aeb-48fa-9056-f6f8ef49df5d", "comment": "Malware payload (AgentTesla)", "value": "65cb30bbecefb103b0ed3804e59aed94566e344e7d7ebe8abad86f78750042b4a5cd83ca602eacfd74158e0e518a37bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413388, "uuid": "700fee99-e165-4326-a8f6-204488f26829", "value": "T14B049420FA07CC7AF62146343795F16202526D237E59CE562AC7B20E07F7B506CBAD9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413388, "uuid": "6922944a-9f80-4945-8484-df617ff8c36a", "value": "3072:8kZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA5XN2rh/3zKTZviALReXDu5VtGYiKO:pZ+RwPONXoRjDhIcp0fDlavx+W26nA5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413388, "uuid": "94ee91d3-5035-4dc6-8dbb-5952bd2de939", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413388, "uuid": "78af5247-c38b-44b8-9c17-da9eefbbf00c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413388, "uuid": "227158a1-07b4-4b68-bd13-ade84a6c0f34", "value": "Revised Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419b427d-10bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687412412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412412, "uuid": "2ccc5b5a-42ab-47fe-bdb1-9a86efa020a9", "comment": "Malware payload (AveMariaRAT)", "value": "bbe43c28519d6173cc7d1773d6addb4f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412412, "uuid": "5329125c-7c07-4d0a-8064-676652862415", "comment": "Malware payload (AveMariaRAT)", "value": "3c8a5775bc0f6c758001acce285042a590e38d15111bb86aa8e2fa0c7966af34", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412412, "uuid": "5434e0c1-7334-49dc-8d02-0740619a8111", "comment": "Malware payload (AveMariaRAT)", "value": "7dde17e85f65c3622567e8ca1a5fd77e4e0bfb42", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412412, "uuid": "c3fa434d-e2d0-4077-8d21-672178be156b", "comment": "Malware payload (AveMariaRAT)", "value": "eebd241253a71329a60b94d0c9fedad9a198a437dfeb68e7dbe520d6b230d597c9ba2a4a6f466048e6aff464c88e5502", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412412, "uuid": "0de49e7b-3ab0-4941-905c-75504f2d81c2", "value": "T121E4232436CE651BF6A721320E6652B1E7DEAE50A099E24F0F412EDE3F727D4C94B305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412412, "uuid": "2b877dac-2969-4e61-8e69-549d791cf311", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412412, "uuid": "428fe94a-584e-4903-b247-b991c09a7239", "value": "12288:gMwRJvbaQU4Rs4+vAWudN6Czf6twtp+GE/abYVwIiPepfS:gMwRJvHUevR2c3ESbXI3pfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687412412, "uuid": "967a3536-f0b9-42cb-868d-aa9f621be76c", "value": 677088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687412412, "uuid": "000dd14e-0ed5-49d5-8e12-8c4d6a4de071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412412, "uuid": "c5f78f90-3ae4-4d0a-a877-ae5229b64dce", "value": "PO LtS0007557rev1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9400856-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422544, "uuid": "7f3d13d7-b0f7-4c5a-bfff-47f2f82ad43c", "comment": "Malware payload (Mirai)", "value": "b69b28536a785b6b14bdde28fc2f01fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422544, "uuid": "adcd3a31-c838-4dbc-9ea2-02f17310443c", "comment": "Malware payload (Mirai)", "value": "3e6ddb4318ba549974604ef3879809845210e6d86b797cc8953b60ad78cdb0bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422544, "uuid": "9a1c0324-bae4-4091-890b-8b056cf78126", "comment": "Malware payload (Mirai)", "value": "11606e1d23a700185476bd241faca827b7a69115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422544, "uuid": "29cbdebc-efe1-485b-9e0e-ef8eb18581aa", "comment": "Malware payload (Mirai)", "value": "615b13dec651eafe496c31f8e1a47ca49aad3787b709ff7b7be7544694707a033ed106bb45ec374f71da80f020f79008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422544, "uuid": "45a49982-291b-4b45-bb08-0adb5d70327a", "value": "T11CB3D70D3E358F7CFFA9823943B79E26565833863AD1C584D15CEB012E7064E742BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422544, "uuid": "0d2d4e18-aff1-4def-a067-d5e1f46dd896", "value": "1536:GRonl2uAXHgMamwiK+/HbnXaZxuQ1CW+rGY1NiOj/2hmWkCbTZegSHUYwAvBz57C:jHAXSmwEnqWQUW+rGlDXbTZeBHUYw+lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422544, "uuid": "5a7be68d-4319-4925-80d2-c754cd50d1c2", "value": 107816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422544, "uuid": "901b538d-2b93-4d9d-b963-d31f0da35d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422544, "uuid": "8eaf1908-6a87-4877-9534-1a410189f921", "value": "b69b28536a785b6b14bdde28fc2f01fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688920ee-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687430086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "a70d89ab-49d7-4ece-a00e-44023138f7f6", "comment": "Malware payload (Stealc)", "value": "3b054af7a1ee22a7ed3bdc59b43cef16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "98cedbd9-da31-4bcd-b948-a8277751436f", "comment": "Malware payload (Stealc)", "value": "3fea6a311f606cc8762fbda091477b07ff7b4d7dfbdaafbca3d41e3d20b83aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "fcd1f05b-0d15-4d48-9468-26175641f110", "comment": "Malware payload (Stealc)", "value": "8a223530f1c0a5e7b41041fc4eade526126cbe10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "a7c98f3c-7876-4f09-bf6d-d571b67ce1fd", "comment": "Malware payload (Stealc)", "value": "eee60e88c2a60c20634843a3e006180ba6d8dcc1ad4ee5dc82045145a8b46c79a3a879d416e4ddcaf249a65fd194f45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "b059a148-7fed-4c2b-b00f-c543a0592ad8", "value": "T14F7633FF2A3329DBCEF05FB05BE636D4137621211E68A96C7998229C24E145E4C539E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "ff62109e-5b92-40dd-ab63-102c9a4c3231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "9f852f51-304a-49b8-8fcc-e0d99a576560", "value": "196608:L8ekYQ633lVPUedOau96YCi5JNHwXmp6vY5f+Fd5/iQ8u:LRQ6nXUedgRlBw20w5fAdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430086, "uuid": "142f2de1-fa77-4b50-bc22-84c4a2449370", "value": 7494144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430086, "uuid": "c4fd316d-e0fe-4488-9068-325c177d446a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "8e8974ad-8761-41ee-bb76-0d2246a27cc7", "value": "SecuriteInfo.com.Variant.Sirefef.947.29959.18497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8396a6-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687413348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413348, "uuid": "4dce8304-e108-40a7-8674-480dd364bb47", "comment": "Malware payload", "value": "e42c6979434091ab3225b7755e102d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413348, "uuid": "5f07aae1-72a7-463f-b8cd-20db5ee7808f", "comment": "Malware payload", "value": "406f0cb6cc317dee14fc23b1dbeb8a3106e24bdc273f78a8d82b61aad4f61aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413348, "uuid": "bd6b5a0d-5d37-44c2-a61b-5e9885036887", "comment": "Malware payload", "value": "cbd63f8878e7321975ee973f396dbb4e16582e03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413348, "uuid": "fd3cdd97-3655-46d1-9388-dc88f6ea83ea", "comment": "Malware payload", "value": "ed01d06df5592193cc619773fd9f738c12fa52966e6b4bc747db9ba746ce1a87b034dc6a4b15aaf66263ad5eafc82ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413348, "uuid": "5d16cce6-2c29-4f61-a65b-981dd719eb08", "value": "T1AF85CF3FF268A13EC46A1B3245739320997BBA51B81A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413348, "uuid": "d9b3e239-abc7-4eaa-9760-91fb4d03b03c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413348, "uuid": "38d1bce1-8968-49f7-8959-90c8e2176739", "value": "24576:s7FUDowAyrTVE3U5F/61lORnVKic6QL3E2vVsjECUAQT45deRV9RM:sBuZrEUwqnVKIy029s4C1eH9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413348, "uuid": "a8dbaeaa-be7a-4f1b-a070-724eb3917302", "value": 1794837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413348, "uuid": "98457bbb-5bf0-423a-b904-99aaf2f1106d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413348, "uuid": "1c89228d-ea2f-4605-8d5f-051b1027c40d", "value": "e42c6979434091ab3225b7755e102d50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d8026b-111e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687453516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453516, "uuid": "ce170a7c-5717-41d5-a1fc-2d6cf6443361", "comment": "Malware payload (RedLineStealer)", "value": "795124c17c7d065f231be587143606fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453516, "uuid": "7f035a1b-9906-4368-bb60-1555e7035332", "comment": "Malware payload (RedLineStealer)", "value": "40bbd979bcd506f0cff972c4f29914c3ae1f55210607ca30dc07427d481e7960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453516, "uuid": "6133a29a-3ca4-4d17-973e-8ba52f4af081", "comment": "Malware payload (RedLineStealer)", "value": "e1703e581dd7d1f63aec02252b9d17d6a3a1be3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453516, "uuid": "bf721105-88ed-4387-8d46-b6b369dab581", "comment": "Malware payload (RedLineStealer)", "value": "5c7816a7e5fc5e1035916848e9ace9b8acba67d638f2a770ac59c915c56027519cf35ca313857eb41f6ce54d2a27ceb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453516, "uuid": "810786ca-f97d-4688-95e9-b736a19172ba", "value": "T18DB4F1C6258049B3CB63DEB1D4EFF9E74E7561210B7187C7120D59FA8E022E4A60B97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453516, "uuid": "8dd7e3be-09a1-4865-9c60-1b9290c318e4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453516, "uuid": "1d7b5cca-94f7-44b9-8b7b-713f48802e99", "value": "12288:bJepSHTey5snUtKJjTxa4gHZpPsLoDao5mfNPQJQmZ:bJepUTey5sCKJjTA4gHX0oL4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687453516, "uuid": "a88b00cc-2c61-46d3-b14d-658ecd679313", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687453516, "uuid": "a0b8e77a-5106-40f6-9f7a-202fc657bffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453516, "uuid": "77ea9b6b-862c-4774-a666-9514e8b8acba", "value": "795124c17c7d065f231be587143606fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c1aba1-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420764, "uuid": "04cef196-dd4f-4a62-94d8-7866a0e61548", "comment": "Malware payload", "value": "db42758195798dd045ec8fe0daf5a9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420764, "uuid": "2fc8b634-34b2-4a13-be46-fd10ca5b1fca", "comment": "Malware payload", "value": "40dced6790e58f1270085a263a71587925a23b113557a16e0bff530baf6d1810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420764, "uuid": "23b12a6c-6c0c-4823-9891-779bc0c1445b", "comment": "Malware payload", "value": "2da116f8eebe086aaf34bca7fad019a1d4a25524", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420764, "uuid": "c64297da-a7c2-4033-b977-9b96211632e1", "comment": "Malware payload", "value": "4c322799877ccb2bc6d291909fa2a1f65ab146700bf0e48d860ea1516cb4c145fb161245362617e2e12726f246072c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420764, "uuid": "63ef0827-3988-48ee-85b0-dabe625b9cf9", "value": "T1F75612320532BDFE876C389094052B452CED5C275359DFACFA4414EF29A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420764, "uuid": "6bd339ca-1c9f-4cbb-9e01-0df5414e6c8d", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6e:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420764, "uuid": "ddcc3d3b-b129-40fe-ad92-86b00adeeae4", "value": 6416271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420764, "uuid": "ae446ba3-f451-4d1d-a20d-c4f7a67a4404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420764, "uuid": "cd414866-285e-4ea0-9051-d5d837dbb57a", "value": "db42758195798dd045ec8fe0daf5a9a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76e9849-10c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1687413012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413012, "uuid": "57c6dfd7-84ed-4119-b1ea-52cd3006b9cc", "comment": "Malware payload (N-W0rm)", "value": "a494133a749128886cf99016e767f5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413012, "uuid": "3c879b69-783e-422b-9aa0-77b7e823d38b", "comment": "Malware payload (N-W0rm)", "value": "427875607eaf3406b8a2212e6a4671bf6ded47f771f2bd39228014d05954214f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413012, "uuid": "886939e6-b3b4-4433-98ae-7984d0fabb26", "comment": "Malware payload (N-W0rm)", "value": "bdbdc0e68f0175414075ae9841781c51ce3784d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413012, "uuid": "a48cf8f3-997e-4c43-8ff7-cd407f7f28cb", "comment": "Malware payload (N-W0rm)", "value": "09de679379f545727fd2cb7f10534df038267cfcb8cde7cab76d9459271cbe69f651a622003417ded2158f4a55ad6382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413012, "uuid": "0beaa915-c8a2-4631-bd42-53c80a10f77b", "value": "T1DD150242BAC0C036D57B253609F0DF74863AB822076119EBE7D84F6E4F215E4ABF619D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413012, "uuid": "17f5155a-20e0-40b3-ba41-38d9b21a8499", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413012, "uuid": "4de23a7f-9720-4575-b841-cdd4d1ff6e06", "value": "12288:scztKepjWeeIOw6IDWJSn/hTUZvLglRPgc70qvSyfrZiaMr4bLHYN9YbUJOqqKbS:dkNeemn/MDgSxqvSyfonsb0NmrQb8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413012, "uuid": "0470be86-7fd5-4608-bb7e-8f97bbcdbe0d", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413012, "uuid": "31fb9cf6-9147-495c-8d79-2d06b8236d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413012, "uuid": "305c2d11-a9b0-4f16-b791-8524ca69969b", "value": "a494133a749128886cf99016e767f5dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16ebc11-10c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687413995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413995, "uuid": "2d98c6a4-55fa-426e-a549-a48180c3652c", "comment": "Malware payload (AgentTesla)", "value": "ec88e7c7984828243be4f12660cc30d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413995, "uuid": "283582c1-7047-4384-8921-30072c50e02f", "comment": "Malware payload (AgentTesla)", "value": "427883d7c6eb502e12e7ae65c1d2c241c8815998faea9dcfd9681d8f40f1f665", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413995, "uuid": "9eb4282b-0109-4f6b-94ff-d556a57cfcee", "comment": "Malware payload (AgentTesla)", "value": "22fa049fd4f4b55e03d0562b96835643a0c42e80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413995, "uuid": "2eb54e26-b64e-48b3-98f8-a2baac91411b", "comment": "Malware payload (AgentTesla)", "value": "054e08b59cdd47dbee22a1f196b1f9a15be10f499b468fde6cd3b9c11b280e34e75edc59d7dd250d954e59a71a282299", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413995, "uuid": "e67d464b-e216-4e94-b107-dfb262d878fd", "value": "T172E41260BB9E4007C59F17FC19A2027507BF749BB436DBDE0D9331E991A6B414E60B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413995, "uuid": "974a5240-8a95-4f88-aa54-8576dde1cf91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413995, "uuid": "a834fa78-7ff1-497a-9953-b3908bf9b3e7", "value": "12288:C6XpM1JCIQfNsVcuoQHA0sR43eJrvL3cc/yxoP0V6J+DT+8k08RUYehMEyWpbkDT:e1KNosG3ehb5/S8m+80R5EPksVEEWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413995, "uuid": "6ceb33e4-658a-40d3-9bec-b34c4bc29209", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413995, "uuid": "7cdb3f84-a926-4469-9eee-709df0dbaf00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413995, "uuid": "c71d9b7d-9f67-4c26-85c5-22325db8821e", "value": "57m\u00b3 LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f234fa2-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687418555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418555, "uuid": "8ed660a1-858c-4721-8084-6d85a3e1d1dc", "comment": "Malware payload (RedLineStealer)", "value": "de3413d0d140f4228b1ea3a2711ae3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418555, "uuid": "2a7c69e0-ef2c-4c62-a3b1-276bfa187ca5", "comment": "Malware payload (RedLineStealer)", "value": "42b6e8227496414ba6c5eeeb5c77d2f281145f0c8901c948802c83f6564258da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418555, "uuid": "e192604f-0036-4d0c-bd7e-437462a1122d", "comment": "Malware payload (RedLineStealer)", "value": "a5b125566c7cdd2a132c4fff9c86f040107c0680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418555, "uuid": "b1361c33-ce6e-4b73-bf50-dcce292ed73c", "comment": "Malware payload (RedLineStealer)", "value": "72251e1c9995844a72117f7e31e7ad3c103f1eb5b96a544f04850f655c830ec44354a9837c3f974b01f294021165a2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418555, "uuid": "04d22392-5cdc-4d42-9b14-69bb477b0889", "value": "T1A3150202BA80C476D87735760EE4DF74867AB41107211AEFEBD80E9E4F205E1ABF259D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418555, "uuid": "1a0db115-46ed-4fb4-ac96-f8ec742d5822", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418555, "uuid": "990c9596-3e0b-471b-94fd-cb06c6ae9e86", "value": "12288:hztKeZjWeeIOaFXzWJSn/WhJcWn63R2Log2LcxMO5hiIOyCzxUSy5tmVw4wq:hkdee+n/UJmbgScx509lrEtmVNwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418555, "uuid": "af9ac660-9c6f-4013-af27-c012a6340697", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418555, "uuid": "dc968a7a-82b6-4567-8ead-f8a773758f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418555, "uuid": "84435289-648b-4b44-9fd8-95e797bec093", "value": "de3413d0d140f4228b1ea3a2711ae3bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34719c94-10d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687423556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423556, "uuid": "0163784f-71b2-486f-bbb7-66085139d7c6", "comment": "Malware payload (AgentTesla)", "value": "3f84ee8837559bf44d9a35bb8a223eb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423556, "uuid": "4b09da42-6ca1-43ea-bb78-73b816e4cb35", "comment": "Malware payload (AgentTesla)", "value": "42d3d31c5ff9fe13b77ac0716ae91a9cec28dc173d820c51f2efaf85e5b0b3de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423556, "uuid": "d782a40c-ba6f-468e-bf7a-e63919645bad", "comment": "Malware payload (AgentTesla)", "value": "c9cff8c363a0e0cfe3059e2bdbbcc17881f95a97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423556, "uuid": "a5c306a0-0dc9-4dc9-89bb-36aa7a5c0a60", "comment": "Malware payload (AgentTesla)", "value": "30b457c9e5158d383c26c8115dc18cfaf818443e0b13ef5924466438bff8baa8b0101452b5020ed53cfee9ff6c897aca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423556, "uuid": "b9f7b18a-d152-49e8-9e14-48baec1a55d0", "value": "T1B125CE7A732C1D63F9BE02F5109121B183F50629B6DFE2C85CE6A1DEA9D6F41FA00647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423556, "uuid": "78329685-8c7f-4612-ac0e-5c7ed7b13ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423556, "uuid": "f505cda0-bde8-4a91-940c-d7f54af3aea3", "value": "24576:EWwp1KNokHQdqx8MP5Y8Acz51tQ3Ds4Ade:Ehp1KNokHQcbz5k3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423556, "uuid": "84fc4d1d-1f43-4905-be22-e8e63bca2bfe", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423556, "uuid": "c1acb691-075c-4337-80d3-c9d07d0d496b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423556, "uuid": "4c13afc3-07e5-4a86-85ab-a8ccbf8a94b6", "value": "CONTRACT-3I3EID66O6O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64ee487-10c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687416016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416016, "uuid": "693b9384-2661-40e3-9713-bc98b271d17f", "comment": "Malware payload (AgentTesla)", "value": "5aa7706b92503355e588246d1fcf02db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416016, "uuid": "a2b8443a-fdd5-4da4-999b-e7cadf8c4478", "comment": "Malware payload (AgentTesla)", "value": "44adde49a051c923e1ed89d0adfa105fb66f85bebe630f625c29e25f93da3043", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416016, "uuid": "29c9a398-c32f-4231-862f-e3f20ce23e19", "comment": "Malware payload (AgentTesla)", "value": "25f8aeb735e3942d40948d0b829a67e4d7b91589", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416016, "uuid": "2a491a31-856f-4c0f-9b77-dab5e7365faa", "comment": "Malware payload (AgentTesla)", "value": "f46410e011b6bae6979562094e6068f52814e9775a716834d697706502a09e7632b8bc5e9cd22d7cdc9e5ce3c842bbe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416016, "uuid": "4412f44b-2a12-4c35-a85e-ae9a5e03bb58", "value": "T1A9F41384B7BE4017C59F57F8252166B103B7B5ABF836D2AB0D8771EEA2E6F000610797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416016, "uuid": "ef3fe126-d2ae-4d92-ab1b-1a6b1108b2ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416016, "uuid": "d709614f-97aa-4a7e-b1c5-619825e14f06", "value": "12288:syXpM1JCIQfNsVcuoQHL0snicOsNCqsPP7JliC0H+DLJP5q0vrOxec5q1wqLRno3:U1KNorivBJNM9HMbyxro94TTFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416016, "uuid": "29679ce0-4e91-4a94-b50b-0e96531d11b1", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416016, "uuid": "9c805f5b-782e-42bf-ab9a-752099786192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416016, "uuid": "b61be4af-4838-4376-bfdb-7708f2c0afb3", "value": "Maersl BL 208268807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf0d678-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687414068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414068, "uuid": "3a1e1249-d025-4997-b552-80fb29d7965d", "comment": "Malware payload (STRRAT)", "value": "69d2e161bf4a2b0002950803067fb0bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414068, "uuid": "bc405dd0-768c-479f-affa-d870c7d32506", "comment": "Malware payload (STRRAT)", "value": "4678e2e4db6c140198236b5c68a98431ce6c791a39bde23f1dd871fd90e90df4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414068, "uuid": "0571c630-1e01-47af-b4a9-f698e9ec6e79", "comment": "Malware payload (STRRAT)", "value": "9fc075de31874155b55940f6d02d372ff5c961b2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414068, "uuid": "fcf53957-132a-49b6-8845-d408640107b1", "comment": "Malware payload (STRRAT)", "value": "077e3549a1d152f0aeec12dc490e6df5ede8196bcd03fe699b297125ede4eed9863371b2b2aa349a77994e8cc8e1bd8d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414068, "uuid": "b391c10d-a276-4a90-9f0e-e042c90feeca", "value": "T16263F1637CC64BABC19F797810F08B662E8E51EE0C17B4862374852B5871DCA0BD29DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414068, "uuid": "e0018a32-6944-4222-ba69-c5137fc62fad", "value": "1536:yqY6AUwAgPRfNZ5/Ze4ZgrDMPzKugom4x41LpIusVT:e6LgLZCJ+eugp4xtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414068, "uuid": "359463a3-60ff-45b9-82ca-a66dc3bfa39e", "value": 68506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414068, "uuid": "129d866d-96e7-45f1-ae9e-4e8bf609d319", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414068, "uuid": "dc81c037-975a-4c60-bdfa-c66195fb0750", "value": "Shipping Document465783.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512e7c67-10fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687439066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439066, "uuid": "969b1794-41f5-4f3b-bf8f-cb5e6f41bf93", "comment": "Malware payload (AgentTesla)", "value": "91351b6a8acec221b650727a7975b5b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439066, "uuid": "0345b3a0-3628-4a60-842e-d0bc61048603", "comment": "Malware payload (AgentTesla)", "value": "4722d23ef7a61d4148e32f675881c404c09992bcc0b1d58ea24dabace084f306", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439066, "uuid": "8aaa0cf0-b52d-439e-bb7d-a94c2bf3a372", "comment": "Malware payload (AgentTesla)", "value": "094b55f6aa6dcc4dc5fa9fcce7977e81e97fb093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439066, "uuid": "981cbfd7-75cd-4b0b-be1c-9b945f3bd2a8", "comment": "Malware payload (AgentTesla)", "value": "9243a1fe3952219cbe85f00ec889121ca4b479fffd0cae09a974ccf12ed6bda3fe5272f91cfa11d7f009d30d1d87e615", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439066, "uuid": "b95faea6-31e3-48cb-8a33-9a2d2a70cca7", "value": "T18E84225466A18087ECE34B7318B94F47BF679A230DE647BB2300BF26B527740952D37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439066, "uuid": "17061b45-c2ef-4d0e-b4b1-2d3126b75c0d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439066, "uuid": "b09b5835-8ef2-4d5a-8268-94f231803d44", "value": "6144:/Ya6RHEKhKIHEHNyHIZ8z8nvZPyGi8LwiM2iI6U/dq2iSyw+iCSWd1+xxaFbrx:/YLkKhhHEHN5Z8z2T0iMpIelyCXDwaFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687439066, "uuid": "19645248-8107-4650-911f-a6a9614f3bcc", "value": 374696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687439066, "uuid": "666dcc52-904e-4423-9042-3e9a0a65dadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439066, "uuid": "b23a5d42-2a73-4328-a0e6-eccd4a62694b", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d35e2f-113e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467205, "uuid": "b7dce83e-6bdd-4f3b-ac54-234906a8faf1", "comment": "Malware payload", "value": "4e398a2fe58ced56b0b81f78d4e9708b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467205, "uuid": "d0ddd0b6-2fcb-48a1-9df3-6f5967c0fb22", "comment": "Malware payload", "value": "47cd1a3b0cb2ee87a31c3dcc0769f28682b7be30b18756185656a87cb8fc2816", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467205, "uuid": "e59b70d2-70fc-4bf3-91b7-0353f1ce6e6c", "comment": "Malware payload", "value": "cf6be99c8e544de002fd93ddf6e90757909f1537", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467205, "uuid": "b24b663b-c27c-45b9-873f-05a2181daa96", "comment": "Malware payload", "value": "d7d2276b6592d3282059c56c96daa1a507ff116d6079d1d7707d8e639ae13262a90e1b51cdc52f691beed22e17dd88ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467205, "uuid": "36ffc28a-0081-44d9-9595-ab4db4f86793", "value": "T1DA558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467205, "uuid": "2021cced-ba2d-4676-baac-88ad08b6d70b", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467205, "uuid": "f0e9ea27-6782-40eb-8f93-7108c076e54d", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yvQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467205, "uuid": "c0b2e47d-fea2-4df1-a0f1-1b9801182b38", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467205, "uuid": "320c1fd5-2228-4e50-8d19-476a073b8a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467205, "uuid": "e8a4cf93-5523-4385-b422-c93b1baf881e", "value": "Spote.OCCXX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097606a-113f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467278, "uuid": "a6360791-6897-46ff-b5d8-29fe59b85ffa", "comment": "Malware payload", "value": "47821f9fcdc0ac57342ad709ac42fba9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467278, "uuid": "e30c5d6e-3b1a-41fb-90bf-7369c7e2bc06", "comment": "Malware payload", "value": "4915f9d8da8143177a7dfabe4181f365faef1a7eb7d04dbaaa9417e2f7f1dee7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467278, "uuid": "1596eae1-9345-4031-834a-8b29c57fbe9a", "comment": "Malware payload", "value": "fac5a784c94a50c1ae3578db9834cb37ab8628d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467278, "uuid": "52a009c8-3620-44c1-9481-65b326c9a0ec", "comment": "Malware payload", "value": "311196e3079741542148655f3a1f676e77fdffe87ce7a2cdbaac45c245f602dbcbeceed913c829202d6a5573e212b1ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467278, "uuid": "2f0091d9-c10e-4b79-bb14-fcca09b8a265", "value": "T189558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467278, "uuid": "77340c7f-e487-4c8f-b007-bb19cb0b0f70", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467278, "uuid": "6951da2a-862f-4fea-b8fe-bdd70df6bb0f", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yYQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467278, "uuid": "49f490ad-d5a6-42b5-8507-240a7d585971", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467278, "uuid": "542d364d-d932-45bb-b127-02e39b767a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467278, "uuid": "0f360e55-073f-4857-a782-0594e23eb802", "value": "Spote1.OCCXX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a7bb68-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687455316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455316, "uuid": "4f4c9acd-fac8-4395-8971-bcdae38e0cf8", "comment": "Malware payload (RedLineStealer)", "value": "bbf989f7655bc81548fea239f0f0e77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455316, "uuid": "55c5f836-8407-4956-979d-83ba622cd795", "comment": "Malware payload (RedLineStealer)", "value": "495a33650e2f846aefe615a69010703bf0b476de82e5589ebe8b1b01cee60651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455316, "uuid": "eb5d3ebd-5804-46f2-8c19-5672586afbe2", "comment": "Malware payload (RedLineStealer)", "value": "858b95d1ee873c2d9d5ff89007892efa2580abb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455316, "uuid": "26c9a626-33f6-47f9-b783-12a33281f50a", "comment": "Malware payload (RedLineStealer)", "value": "557d9c6fbec94ebe29455fd6e16eb3dec7b05ce15e926ef4399189f55418db705fc93fb24bbe5951dcbb7e5f67ba50a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455316, "uuid": "5b2b7ccb-c851-4bfc-8141-86ddabb66689", "value": "T1ACB4F1CA26408577CE63C9F2D4DFEAC78E7A61210BB14BC7120D89F98F411D4E52B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455316, "uuid": "a4f36c21-bee5-4d74-ad02-5e4c2f021617", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455316, "uuid": "efb6a053-1c95-4f1e-8b24-0b1b584c68db", "value": "12288:Ph+tqTey5sRiBQAdaO8HBcBIoH6IZAln1vEQduntXjQJQmZ:Ph+oTey5sAD8H6LH6IZ+8Kun0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455316, "uuid": "a2232f24-8ddc-4ba3-970f-19b0fd1a1033", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455316, "uuid": "c758159f-8472-449f-9ab5-a074550e5762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455316, "uuid": "1fb515e8-31d3-4e49-8b1e-b41ffc0937f0", "value": "bbf989f7655bc81548fea239f0f0e77f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba9ca25-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419703, "uuid": "7b4b43f9-7110-42c9-b301-d3a879e80015", "comment": "Malware payload (AgentTesla)", "value": "c8b70e9ddadd8ed102da94229453cf7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419703, "uuid": "f597d769-7aec-4908-96f6-70982c238fdb", "comment": "Malware payload (AgentTesla)", "value": "4aecd36974b86ce7332cf642818cca0f64637a2315d7b75a09ecac04808dfcc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419703, "uuid": "2e8aeaac-3128-46be-a679-9e53bf195e47", "comment": "Malware payload (AgentTesla)", "value": "3a1e02679644069d63043dbeb382bf6e0c7c646e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419703, "uuid": "ae99d45f-ff48-4d49-af2f-3b8431445caa", "comment": "Malware payload (AgentTesla)", "value": "944b89142f659825494e62f6e6ba7c6f539d6e510cd13d0eee7229663ae1e291b8d33ae6065b7d7ac47299fe056b2088", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419703, "uuid": "f9eaa735-d24a-4ca9-a7b9-b6807775c7c4", "value": "T182D4238EE17A254138646F96C0B2C2F79650C3B13D60EDF6F4B14D9A775A7C24E2E02B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419703, "uuid": "f98d6a07-6e69-449e-a25e-b22bb11598c4", "value": "12288:w4RWlWVrRyrPWU2hzOiWr7V9VUZwT6LoALxj0Y45pWJdoY/vLbtDhLF2ugxut4dl:w4wlorR6WPOiWmC68AF4f5pWd/vLhFL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419703, "uuid": "421884de-1822-43a5-8ca4-c5ad81657ef1", "value": 645221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419703, "uuid": "3efbc8b2-4682-4698-916d-0e1388c40d63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419703, "uuid": "2100886b-0b54-4771-a0b7-94348c021c5c", "value": "Invoice_0230621_087860_092920-DOCX.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2869616c-10f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687434274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434274, "uuid": "47ad8735-e918-4f39-8a17-46bf3a82e02e", "comment": "Malware payload (AgentTesla)", "value": "8db5fc99025c90db63f8c5f610c09c05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434274, "uuid": "1aaffdea-2ee0-49d0-abc3-834c9caa8f3d", "comment": "Malware payload (AgentTesla)", "value": "4b99158353369de129ea26303ff911ce49c4ecfee2f8839d48e7e502aa47d2f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434274, "uuid": "28f49900-eebb-44e1-b54a-e55b388b2970", "comment": "Malware payload (AgentTesla)", "value": "93e0ed3283cc90e00a2dbf7bac257320dd8818e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434274, "uuid": "51084245-7b60-438d-aa35-9a8566724202", "comment": "Malware payload (AgentTesla)", "value": "eea63e886270a1dfb089b21f5187ace1a0255862ee3b0c65416b5933c51562402c3013d193421922639c8278d1f46cb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434274, "uuid": "11981338-e766-4ce7-8059-ec7b15d8e40e", "value": "T136E41210776E1013C44763FD99B01BB1037FA8ABB936C7AB4EAB72AD92F5B011550B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434274, "uuid": "35bc4b5b-9043-410e-83cf-816e403a22fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434274, "uuid": "a9fe17aa-86bd-4281-b62c-a662bf4403db", "value": "12288:l3XpM1JCIQfNsVcuoQHG0sseVAUDGskyGwYg7QK6fg5Gsu6Nba6TvWegX:lC1KNoSRFGskWYIUsu6Nba6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687434274, "uuid": "01693730-f300-49d3-8bab-da8a3e50ea69", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687434274, "uuid": "dad01b9c-384a-4aa5-b3e1-f2e71b2a2f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434274, "uuid": "b4cf193c-d784-4a7d-8270-de76f6063a02", "value": "SecuriteInfo.com.Win32.PWSX-gen.6335.17340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3842127f-10d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687421415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687421415, "uuid": "acd85043-4a00-495c-882d-44b8012d13ac", "comment": "Malware payload (RedLineStealer)", "value": "aa8cbb01bd4667f716c679fea48a18bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687421415, "uuid": "3c9550a4-4121-4772-aeb9-9b64a65f6f45", "comment": "Malware payload (RedLineStealer)", "value": "4d350fe66717a8e3a48584ab22c459af22264a7e65ed06cd3ca00c048c8e3654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687421415, "uuid": "878727d9-4e63-4b2c-801f-c1adfca3b71a", "comment": "Malware payload (RedLineStealer)", "value": "2d68233dc235e7b1a9e92f3ea5e4c046bb352d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687421415, "uuid": "2d1ac072-c6fa-41b8-a3c3-62fb481b3ac8", "comment": "Malware payload (RedLineStealer)", "value": "8c38618a6e9fcf58d4bf511e7564dc13052ebc2fb27c83b6825bafbf7d03460add0cfbca51c77c70fa7f871c892c592c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687421415, "uuid": "b49eda44-a5fb-4c94-9a4e-14ff2e7dc520", "value": "T16D04D5583647A9BECA7F487D9C600CD06A7CAC675246A7078C8EF0E83D3A7819F151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687421415, "uuid": "33acf93d-977c-4830-b3ed-967bcb3918d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687421415, "uuid": "7537d5f9-0fcc-4898-a8cf-d2c95c0dd323", "value": "1536:S/rZb6i336sv0W7TN6InrHS1PwrGWfAdMyxNgCYQlJbuNoBUCfTht70+0GkR08ep:sb1QBVoRAdMyxNMWdPf1t70+X8e8hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687421415, "uuid": "f59c81e1-391a-414c-a76e-011c8ce804c7", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687421415, "uuid": "e75dceef-d729-45cc-bc6f-01a5e879ff76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687421415, "uuid": "b68539dd-c63d-4667-b851-ba6b2b8f7792", "value": "aa8cbb01bd4667f716c679fea48a18bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c01c4c-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687420601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420601, "uuid": "9ce981ac-7489-4ee4-be23-e1d0debbf7d1", "comment": "Malware payload (Formbook)", "value": "98f77c40ece5a0af4f1a4597ab414fda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420601, "uuid": "e055e2af-5276-49d6-8fb6-a7e7ba2c0f9d", "comment": "Malware payload (Formbook)", "value": "4faf527fcde9f38b487c5f4a7c29dcba98977f664c1f2c8be13bc88c7232f496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420601, "uuid": "87925bdd-017b-4fea-adfa-60669151cc64", "comment": "Malware payload (Formbook)", "value": "08e01cd1e38e764d508097ac6cf4aa401f432dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420601, "uuid": "ca38ff0d-1d9a-46eb-acac-29df913eabbc", "comment": "Malware payload (Formbook)", "value": "47c047599a73703f237a22d9285f8460be4191c17d42823063af0a0eeb267c7b60b62558f7c8f6ef3793f32e5f2b5460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420601, "uuid": "b8a8e51c-f187-4171-9003-2e042c4f903f", "value": "T1F3F41208226B9B1BD0575FF40820B7B5C37D99EBB033E24B8D83BCC6B656B191652B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420601, "uuid": "aade04dc-42e2-4d05-af17-8f2f336fff16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420601, "uuid": "5c0ca9c3-08b3-4375-a9f9-89277cfc16f7", "value": "12288:k9PM7q6bpw4dcZda/igiO/fY68YwdxY8TWStwnDlxgoM6HEykHUAaa3bDXB:zzu4CZdONfV8YwLY8C3lxgoM6HRk0ADx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420601, "uuid": "a40d5ab2-8c86-46bd-921d-682fe63409ec", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420601, "uuid": "95a10d14-9162-4884-9010-51aae9543ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420601, "uuid": "6fd0932c-fb22-4bef-9a1c-17701e1348be", "value": "98f77c40ece5a0af4f1a4597ab414fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6647aba5-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420634, "uuid": "e786f563-59d3-466b-8b64-3abc3fc88a5e", "comment": "Malware payload (AgentTesla)", "value": "7d2771ad412d5b91cf7e0ee751e48c20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420634, "uuid": "94dcb228-7476-492e-8516-c98584ef9d41", "comment": "Malware payload (AgentTesla)", "value": "5055a2248b9f1f6ae561b3c7fb6ca2f08b057f568dc70dfadc23d5ebec21a8e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420634, "uuid": "ade0b9a1-81c6-4384-bb49-45204a3a8483", "comment": "Malware payload (AgentTesla)", "value": "cab2ec635ac10a2d35db57a94a75df35252958c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420634, "uuid": "9d20cb7e-0d44-4a59-9f35-c33dccb450c8", "comment": "Malware payload (AgentTesla)", "value": "d429435ae41ef04bb14371293cf0d845d457d116489e6900fa1fe2727e64e48ce7e9328815de33461589ce6c138263ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420634, "uuid": "30a8f691-1c02-48e4-a8eb-53e9e667f945", "value": "T1E5E4121A56669B47E0A35FF82221F3F0937DADDB7432D38B8D8BF4C5BA50B49095060B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420634, "uuid": "514b4c9d-7817-49ff-9105-9b0afd89253c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420634, "uuid": "31da3299-9e5a-4697-8c9b-5ef8a5d65962", "value": "12288:mPM7q6bpw4dcZda/iggE6q93P6Fs4osupOIuOXzJoy+ume8NBYZMvAJ83r:tzu4CZdOgpq1iDosupw05+umTNBMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420634, "uuid": "ac4d702c-a849-4f76-a986-338ad703d5b0", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420634, "uuid": "3f805be8-f1a1-4816-b35e-dcf4d8e802f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420634, "uuid": "63912a4d-3da2-4a3b-93bb-36bc5c8dd769", "value": "7d2771ad412d5b91cf7e0ee751e48c20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771a50cd-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687459316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459316, "uuid": "a36c38d4-5c2c-4486-969a-7e1a99ca4730", "comment": "Malware payload", "value": "7605cfd7a7d38d3f8e5eb0341b580d9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459316, "uuid": "4980a0fa-4f28-4197-9725-d43bd9bf9a52", "comment": "Malware payload", "value": "532800b423fecbca1ad9934d4f0101c31018f3d34031ffc4107d4ea5763a2a3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459316, "uuid": "552504f3-9d2b-482d-a576-deff922c5662", "comment": "Malware payload", "value": "58313b34916fd0eb0498d6c3f79d23e5aaa244cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459316, "uuid": "828337e3-f5dc-4888-a1f6-c05fdb608175", "comment": "Malware payload", "value": "ed5b1deaebd8b67e840e64701dba2579bd47f352558142056c6156a0752ff18b3e83990bd7e8b1f542570b3cf90a02f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459316, "uuid": "e589de84-fa8b-4e9d-9a96-c71243acb648", "value": "T1DD558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459316, "uuid": "8d96d0ec-3ba5-4cc5-9e6a-27cac32ef6cb", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459316, "uuid": "7295bbbd-5cf8-43e7-9b05-19f4e2c64c28", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yuQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459316, "uuid": "be985e27-c1d8-4a08-a1f5-b2e2973280ae", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459316, "uuid": "b778e04a-9166-4a04-99e0-0b1b4e014474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459316, "uuid": "8c1cfaf9-18f4-4d7b-9b69-595af1a149bb", "value": "Spote.OCCXX.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7faff6-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687418502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418502, "uuid": "c1179f5f-0687-4528-a1ac-86057c3370d8", "comment": "Malware payload (AgentTesla)", "value": "0035e26f826643953bbd80ef7ce2940b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418502, "uuid": "88ea104b-2fa5-4ee3-ab3a-7f22b99f2a70", "comment": "Malware payload (AgentTesla)", "value": "53e3d39344aaef29d4097afea0710880323fa0da1b6e525082a0bc26465db0a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418502, "uuid": "0510df2f-6333-4595-a998-3395246d42c1", "comment": "Malware payload (AgentTesla)", "value": "0603a86d83e4b08ee59246c3494100c77d2022f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418502, "uuid": "5ec274d6-0915-405a-9629-b28a4476be77", "comment": "Malware payload (AgentTesla)", "value": "28659c11638ba50150a3e08867f6ad6e9c56615661c7db7858c6a717643b39e1be82cca1d5a5e8c45cd8f6e5a8561c0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418502, "uuid": "aa0e3c90-b41a-4585-a924-94033b894e7c", "value": "T13BD412557227076ADAB34BF009925E70077F2D6DB036E30A8DDBB1D86A35F050663E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418502, "uuid": "287d0896-e799-4dcc-ad30-18d4effaedfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418502, "uuid": "865b0267-f63d-482c-b958-1bca8717f115", "value": "12288:FHipdvDhH62MmgPF5kL6HypJDicCBP3rsLnCGsrK/Wk14wyR00G:BodvDcAwwmS8BDAny2/Gw6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418502, "uuid": "0ee05be4-0db5-45da-afbc-795837d3ef87", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418502, "uuid": "56a8f169-4ffe-4e24-9db4-5a51b08ffe06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418502, "uuid": "38ef5739-a901-464f-986a-44f60f3b30c8", "value": "NOTICE WHL050C53836900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b47b40-10f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687435643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687435643, "uuid": "90ef98ec-b619-4276-8e30-48685cbd3b5a", "comment": "Malware payload", "value": "100609f0b0a9535a20538d2d8ae61d77", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687435643, "uuid": "4d1e7c6e-c5d5-4eb9-a44b-56f72e1f8489", "comment": "Malware payload", "value": "5413a1704661929761afa675e392390f373d7cfa875ea0bfcb29f70883b48da4", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687435643, "uuid": "d9e3628f-35f6-4ead-837e-f8ad1c0fb52f", "comment": "Malware payload", "value": "33ff24da3267bba0fcf8dea0a732cfe3133ef401", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687435643, "uuid": "3e788f49-738d-40e0-8741-0d8a1984f39b", "comment": "Malware payload", "value": "886ce4ddbac61a5899882ce41c097c5f64598707b03a798b0faeec71c1eab5bdf35882b7a021845cfa49a0c758a63868", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687435643, "uuid": "20eabfd0-e4e9-4822-a43f-799c6d70e971", "value": "T1AF56231175C6C536D0AE82F00B1AB7BD35A56E1843B184AFA6C86BDF3CB37D01672687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687435643, "uuid": "66eaf947-3387-465b-9fe6-7c6b8b97ec3d", "value": "98304:TYchFIxmVAjW9xER5UFY+MX3eWQW+jw9qLndeNg3/7TKwDtwwKxsYepul1tMHA:dhuOyW9xa5UFY+MH1d9ynhvzOwKxsY8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687435643, "uuid": "6ab7e268-f39e-41a3-a2fb-379d2cd6030d", "value": 6006272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687435643, "uuid": "18c64d83-e824-4ef5-b8bc-db93d71bcbc9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687435643, "uuid": "239ef809-62db-41d5-a6f8-0e9095baead9", "value": "_Outlook_Sec.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2131275b-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422236, "uuid": "b9d6e200-005d-4239-a461-a6fa7dfd482f", "comment": "Malware payload (Mirai)", "value": "148596288a5b89d841444ca7cc4fa84f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422236, "uuid": "0e421730-ca14-4214-85d9-f3a90dcecc15", "comment": "Malware payload (Mirai)", "value": "541edd1a24a6425d2924a21ce5160b46a16c03cf3d3ac839b6f205fdf5fd99a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422236, "uuid": "e7270742-3991-40f3-a772-fd0f6373ced7", "comment": "Malware payload (Mirai)", "value": "8071ad853e6018e841d5db7a7ddd7f3f7e5b2cbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422236, "uuid": "34b04257-8aa6-46fd-9037-310f090a0437", "comment": "Malware payload (Mirai)", "value": "fda24ecbec07c1a9e04dd36569eeb2730f986113eda375eb1ff26c34cfb4b8de7963977a1baf68c6162f385702772868", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422236, "uuid": "adb2d80a-51a6-43ae-99e5-fa1daa0d4103", "value": "T109C37C73C869AF58C654D1B4B0708FB82B53A911824B5FBE19A7C6B48043DCDF54A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422236, "uuid": "9451d0f7-d8cf-4798-b183-0e64c34c56db", "value": "1536:zaW9YFuABnx/EKmw9AMCQKuY0B7cSwS5EVTsWOkxQ+rapDoJ:z9YvxsLIAMeu3ySyBsWFxQ+2GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422236, "uuid": "2cc5506c-3124-47a6-a702-a27939275feb", "value": 129452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422236, "uuid": "fe9f537d-9c32-4e46-8547-8287cbba4713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422236, "uuid": "b5d7354b-6331-4b52-85ba-ef66c11839ca", "value": "148596288a5b89d841444ca7cc4fa84f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366f0042-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420553, "uuid": "1f7e80ea-0864-484d-980c-4dcbcc0fbf11", "comment": "Malware payload", "value": "1d89abea4f4e42507419f684dde9768a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420553, "uuid": "f153259a-ba1c-4e62-9be1-cd2a70142852", "comment": "Malware payload", "value": "544f6c60011a20d97d0731cc459ce12188d9222270c3258f48abc111d04b8491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420553, "uuid": "e9d50196-8ded-4116-b274-03acb42a252c", "comment": "Malware payload", "value": "020ba433f99631873c7d37f1af62f60ab279f74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420553, "uuid": "ff3daec1-815a-461f-a42c-76b49abfacba", "comment": "Malware payload", "value": "39c179b2e79ad2c8f2574793c696f36bf320cf335e6f5922b5d5114bfd785f941de922a5e2927cdc56c700f9fabe551a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420553, "uuid": "d425bfde-cdbc-47a7-85c1-5979cb55de3b", "value": "T103348D00B5C0C472E5B314738AB99AA9DE3DBD6007656AEF67E40E6FCF70AD0B670911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420553, "uuid": "356dfcd1-e281-4f36-aa75-b1ecd076b26d", "value": "9af3e93e35221a2c8c04a3cc05e589b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420553, "uuid": "0a946888-b843-4b5b-a1f1-7b3df0bb3792", "value": "6144:7Q4qE90zC3OtAYiizHB2XkE/lfAOMU0X:7p99iC+tAYiiziW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420553, "uuid": "457ae6e9-ddcf-4497-80ee-db8a49c6e3e4", "value": 246788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420553, "uuid": "19a5afe7-f674-46a0-976a-66404eeff40b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420553, "uuid": "7550d6a5-f130-4d05-8e3d-5d7465eb51de", "value": "1d89abea4f4e42507419f684dde9768a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4aa07e-10fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687438226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438226, "uuid": "7436dd58-25d8-4ba5-ab14-9e1e85ec3006", "comment": "Malware payload (Quakbot)", "value": "26274d85846bdc0f429e2dc75f54b06f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438226, "uuid": "9d40f2eb-95b0-49d7-8212-928587c7b2e6", "comment": "Malware payload (Quakbot)", "value": "54a45ae2eba4f398dc6bae5be6acdab2c1e2434550930c45d6bf0e2233af09dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438226, "uuid": "c43e4881-417e-4fa7-bc3e-50d545a032ba", "comment": "Malware payload (Quakbot)", "value": "79f0198d42652c59815bb8780c7d078320c6f918", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438226, "uuid": "21fdb08b-acaa-4308-9e86-3f2b3dbc79ba", "comment": "Malware payload (Quakbot)", "value": "3ea54ac4538668902178adffb9852bcdf30a77aaf2d02e324e1c3d6b828041006ca372755c96fb6cf39a1257a6cb8979", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438226, "uuid": "5d69093a-8e80-4945-aaa3-eb3d2364c543", "value": "T15AB4A7D12BE1AC234933B339E67A9404F1A146A751944A79B53C2494FF7AC0266FFFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438226, "uuid": "b64a19d9-891a-48e4-b10e-5b10b4df2ffc", "value": "12288:/Hq5j7bcOahKu0B6xlU9fzyhnmRFGfAGmFcRmkV0b4a7WOOX/wMzAnlkJalue4kG:JufzyhcBs/MaxGoE9L89sYm6IZEn/GPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687438226, "uuid": "48761659-838f-4a2e-a2f4-eb17a498f70d", "value": 508943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687438226, "uuid": "38642bd5-01a8-43d1-8cb8-ff0b5103b53b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438226, "uuid": "3af680e7-152e-4d8e-9838-57aa1ad6d5f0", "value": "Slh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0d3f8c-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687420353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420353, "uuid": "a60afd06-57e3-4b2f-aa09-b13de1a60e90", "comment": "Malware payload (AsyncRAT)", "value": "ee9e4624386439e6b8bf16279dc68af3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420353, "uuid": "9cfbf3b4-c41c-4283-9171-ad76849cd0a5", "comment": "Malware payload (AsyncRAT)", "value": "54b6c23d9bc5f44ceed5946ffc935a88488d30a848c75568b084b9c9287a3cb2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420353, "uuid": "b13707c8-bfb8-467c-a673-66902b2e96f6", "comment": "Malware payload (AsyncRAT)", "value": "31ea4d10e0a2d1d14d40ff390ac7cdfc6aa0e2d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420353, "uuid": "003d7c8d-bda3-4382-be79-7d67f92d57bb", "comment": "Malware payload (AsyncRAT)", "value": "33ce7042f875872d13ca45f95aec5895b6fdc46711a33b1e4c029f8e0086571804cce96df324ffe62e02fb0f325faac0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420353, "uuid": "81dff1c0-73d4-4ed3-98d4-319120afc17b", "value": "T1B9C418A2631C6BC7E1F98DB04F8E4960E5F1A69858D4C74C7CF1478E8BC2785835C6AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420353, "uuid": "3a2604ea-618f-4082-8ec9-b5e8447824e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420353, "uuid": "bb97744e-b084-44ce-bfa1-a9442f5f88dc", "value": "6144:knEEr/kVxmO0wE3jjxRMpAXuOQlMbHxpaqa/VVWadJHKwM1TyA9tYLZKi8vj5:knr7O0wE3jkpOQYxpaqaPd1WTyUthb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420353, "uuid": "aaa6fd15-e773-474d-8272-5d648f81de67", "value": 577088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420353, "uuid": "5918bd67-53bb-4264-b55c-475d0c89021e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420353, "uuid": "c1f2ca53-35c9-40fb-a830-5e477c385cc6", "value": "INVOICE_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff385012-10c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1687414018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414018, "uuid": "9ac9adaf-eddd-4b3b-a4d7-98c92da002c7", "comment": "Malware payload (DarkCloud)", "value": "8cc60fb21b3d22af8eb1acf37bf46d9f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414018, "uuid": "2a894b2a-3dc5-43fd-8c5e-9ded16edc239", "comment": "Malware payload (DarkCloud)", "value": "54cd2e3e00d7370c6064ac4a49494694df623ff169a1aa6eb8759f55bae2f758", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414018, "uuid": "6aa73d19-fadb-49b5-bdda-ab6f651d3bc5", "comment": "Malware payload (DarkCloud)", "value": "7a750a5e81d9f9c01687618caa120d9ef801a70d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414018, "uuid": "aa83d071-af60-451a-8554-a9a837143e9b", "comment": "Malware payload (DarkCloud)", "value": "5c775e0ab6a32ba9570bc04ccaea3da56e6af0edcb5eed68df8ca7f1272600ca63f718bafef09518abbadb2715091297", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414018, "uuid": "5e7a4965-64fb-4241-88ba-81188f95a679", "value": "T106E4DFD2B15C0F12E0BEABF54533300D1BFA0FAA66A5C3485DD604DA9097F052ADAE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414018, "uuid": "fa5466ce-8cdf-495b-9fa8-905148edfee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414018, "uuid": "66f0f4d7-9228-4949-a585-958d9c3fed32", "value": "12288:RJ8J0J1Ae3KydYTCXBqLC0tJtT4stkMAadMs+1xoxam+:LOm1taydKCXcCitPGMREDFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414018, "uuid": "dd9dd414-c752-439e-9655-0f6a25ab2f5d", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414018, "uuid": "13a8785e-0635-47c2-a626-100543bc1a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414018, "uuid": "371e4cf2-b83f-4729-ab71-808ea611aeb5", "value": "E-DEKONT-html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbd70df-10f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687437313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437313, "uuid": "dc131585-8b56-4bab-b8bc-0f760671e1a8", "comment": "Malware payload (AgentTesla)", "value": "12d45b5ea03e0f36facddf88e78204ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437313, "uuid": "13add292-bd8b-4c3c-9ec2-dbddcbdd8fce", "comment": "Malware payload (AgentTesla)", "value": "55e587b7b643821cb4fb53b8cf549fac16e5a19a61869c26d6059dc55eeda1da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437313, "uuid": "451f8bbe-8c4d-4301-8b12-7e9ae06ec86b", "comment": "Malware payload (AgentTesla)", "value": "c8370fe17db37c01beabed436df98ef88aa21595", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437313, "uuid": "612ac97a-b593-4d67-8292-fda6b178c465", "comment": "Malware payload (AgentTesla)", "value": "a3160e44d64fb5df35a1300f2c8ccc012e0d3c4d38cd17829f0a7c4bd1cf455212b684a29d97c2590af551b286200e8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437313, "uuid": "698875e2-7623-474e-bba4-041a5362e87f", "value": "T1F655F1356FFEBE49E1046E3F9523952447E1C84BA431F7A224F579E247CE8CA186B438", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437313, "uuid": "75ae9565-b60d-4d4d-9521-67ce4642c944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437313, "uuid": "6fb548c2-a344-4850-994c-5a3fcc018fc9", "value": "12288:aNBvQdL9pBjzyHjDkU8BkUMSKcMUoscx1z80Z9H:aeMSK78W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687437313, "uuid": "5a963942-94f6-454c-8964-061424bf0159", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687437313, "uuid": "b66a0653-3dd9-4cec-ae7f-27e2bf9241d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437313, "uuid": "d78cfc72-7d60-4788-912d-a16e06ce04f5", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593aded9-1127-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687457119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457119, "uuid": "0d816911-3fe9-4386-a0d6-7f0a23aff5b2", "comment": "Malware payload (RedLineStealer)", "value": "7e69f4b7bfb4bd3890ef54a15b777a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457119, "uuid": "2a5c65c6-d814-48bd-8265-a33afa499276", "comment": "Malware payload (RedLineStealer)", "value": "5753cc6ed646f477448e8e0f41e65d3348deeb301c45eee47744ee41483e7a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457119, "uuid": "5572eb85-f6fe-4ab3-85fa-7d8bcad2de63", "comment": "Malware payload (RedLineStealer)", "value": "3556578ffcbd8794a337519049935bbe96a76203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457119, "uuid": "0d129b12-b44b-42e6-91b7-10be6df8e459", "comment": "Malware payload (RedLineStealer)", "value": "a306c86a793223d35a4be95a46c0cfa7c0d00698bf940fd5121720ac7f7cfe89fb8e8c3126176c1b95cbcc57981ff23b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457119, "uuid": "c0081792-8415-4b31-bdac-3e7b58951e5d", "value": "T187444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19B90952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457119, "uuid": "e95f48f3-51a8-42de-beb8-594c40175ba3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457119, "uuid": "c749be1b-bc9b-4043-9b83-ee85ed8a21de", "value": "6144:Fkvw6igt0poiRG/XvLNUgYhuE228QJQmB:Fkv6gtAoiRG/fSvEQJQmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687457119, "uuid": "97a718dd-7e4c-4ccf-bd09-dc975c4c00b9", "value": 275266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687457119, "uuid": "1e2bb950-259e-47f8-8524-6dcfd9592f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457119, "uuid": "4f9eaaa0-f6f8-4dd9-9dcb-6c0986efa182", "value": "7e69f4b7bfb4bd3890ef54a15b777a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43831829-111e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687453217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453217, "uuid": "4f1621d5-5655-430a-ad3d-248647e2c5de", "comment": "Malware payload (Amadey)", "value": "a273c1c9bbde170cc98c3c9c42637d1d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453217, "uuid": "086768b9-36f3-49ca-971e-52157915e6f3", "comment": "Malware payload (Amadey)", "value": "5778677b27049800f124999089877df3718d68c909eb08cca84644c353b4b925", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453217, "uuid": "0268d4d0-fc42-4f89-a491-62c195a3a64e", "comment": "Malware payload (Amadey)", "value": "8d2394382372010c09ff17968eba7aadde1f36c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453217, "uuid": "03fdb901-89ac-4825-9927-dbb66eb22f8c", "comment": "Malware payload (Amadey)", "value": "18c6b173f88f3ce2a62683dd87a7569bf0cc9c67f8bf495d22d7662ee59e23168a6e8b3c63017d16380b7718740fb18b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453217, "uuid": "d3b014a0-2d02-4537-b775-bc79910c1902", "value": "T1A4E402C635404533CF27DDF2C8EBE99B6E7A60210B764BC7120C4AF98E452D4E61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453217, "uuid": "62873b99-f093-4557-8f6c-e40f4a7747fa", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453217, "uuid": "67f332f3-5789-4242-b7f5-05d01f39cd4a", "value": "12288:ce+cu6Tey5sBPqxqO3C1QYWVy/JnFH1xHv812Y4JifHDwosS7LDnoZofDpNvJqiH:ce+c1Tey5sB9OaWVyZpvuLUZo1NRqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687453217, "uuid": "1c5b3564-37cd-4826-bf06-49f325a704cf", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687453217, "uuid": "d918e88d-e1e3-4e20-b94f-c84897522a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453217, "uuid": "1968f5e8-83a3-4742-ac33-baa29d777543", "value": "a273c1c9bbde170cc98c3c9c42637d1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3072db29-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687456621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456621, "uuid": "37d454d6-232d-46b8-8e7a-93a9de0ac569", "comment": "Malware payload (AgentTesla)", "value": "17c5f7a133149c8df74131d9468befcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456621, "uuid": "bc047ff4-f2c4-4db9-bcdb-2e363365c147", "comment": "Malware payload (AgentTesla)", "value": "59084f9c3435606045261122fcece85c7dcff26b245657929a983e896b905405", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456621, "uuid": "42cbf8a0-d52e-4e1e-a199-893fa07f10e2", "comment": "Malware payload (AgentTesla)", "value": "ebe5602a058f06e1670003bcf41f287500d6932a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456621, "uuid": "07d88011-2b59-46e2-885e-a15491616945", "comment": "Malware payload (AgentTesla)", "value": "875d12626594895c3403530fdec3d8908d46a057d5b2b9aaf04b7e90261bb69cfe46fd1f4b206a042643b21ec92d9874", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456621, "uuid": "530bfcb9-bfbc-49fc-a67e-9510706f4401", "value": "T156052389A36B0205C5B317F8285027B2926D9C9E392DC15F4DAF736EFD35BC501B0A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456621, "uuid": "1b132652-4cfa-4a93-bd29-e9fe04644a10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456621, "uuid": "ef75de4e-0f05-4c58-b63f-d546cdb591a7", "value": "12288:JM1JCIQfNsVcuoQHT2iNTbl0uU9SYTdrWe4hpBDl0aQGaglaDOUd2h+FDw1Rk/rV:i1KNoT1llASYTOhpBDhaglxLAoRk/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456621, "uuid": "98766eed-a8d5-4a59-b3c6-ebb643caa524", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456621, "uuid": "b61748c2-5a6f-4d04-bcf0-d7350a23a4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456621, "uuid": "d88be9d4-2001-45e0-9c43-34a0e9fdd7d1", "value": "17c5f7a133149c8df74131d9468befcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad0b106-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422601, "uuid": "d611d6eb-e35f-45ef-9cc2-6a117db160e8", "comment": "Malware payload (Mirai)", "value": "4337435c4026eb072b68649ff5e731bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422601, "uuid": "370b7954-c0ec-45e3-b5a4-c919ea25f420", "comment": "Malware payload (Mirai)", "value": "5a05cb228af34e02b4ec94f708af15df47297526036c24ce31937eeba963be06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422601, "uuid": "7aea8f0b-1220-47f0-a0fa-041b1b7e1650", "comment": "Malware payload (Mirai)", "value": "9b09697301bd179391deda3691f27bf46abd64f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422601, "uuid": "fc768302-f4cd-422b-b99c-3be1081b63ae", "comment": "Malware payload (Mirai)", "value": "cb7b620f3d9f077b6b3e1082ff0b632d882a1e9702f93a07300eb932860c35d9230c7db4f442ecdf3c45d41e68e7f722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422601, "uuid": "3d60f63f-95c2-43c4-ad96-7de4d50914ac", "value": "T16A63851A3E119FBDFBAC863887B79A20964837D616F1C584D15CEE015E7038E781FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422601, "uuid": "e1c91153-feaf-4cc7-9f8c-9e5446e33402", "value": "1536:GVpuIaAyz90k15bNW/ZBVm/EGXCgPxJpmnx7d6bpcoq:GVEIJp8bNKBVmzhxJIGLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422601, "uuid": "dd8d72aa-8a5c-4da2-b843-576d0f1fccd2", "value": 68276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422601, "uuid": "11e6f465-6b01-46d4-9957-6e2c8ee54f68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422601, "uuid": "b670ffa7-4c88-4528-b241-bdb9291067d8", "value": "4337435c4026eb072b68649ff5e731bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c318c4-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687413336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413336, "uuid": "0d893bca-6f41-42ef-873a-c7debbba1bc2", "comment": "Malware payload (GCleaner)", "value": "477ba03195f3b0d566546ef9ec031fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413336, "uuid": "704f3017-8d1a-490b-a23d-68febfefcc41", "comment": "Malware payload (GCleaner)", "value": "5a4b558e3f228adc43c877a56890612ba69b2e112ca8e0fdd538581e0dc6898b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413336, "uuid": "bc76104e-5702-43d2-aec1-4229d2dd5138", "comment": "Malware payload (GCleaner)", "value": "171b4d74354c4ec4653ce99d662172ddac9833ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413336, "uuid": "4762bc10-3932-4304-a2a8-c2e4c789395d", "comment": "Malware payload (GCleaner)", "value": "78695a95fa6c5629eedf8326318994a87a586d2412c5558c727967b31be4ca6fb2f6e76a04e88a576cb0b206683d3f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413336, "uuid": "91daa780-0046-443c-b021-681823ba3958", "value": "T1AA85CF3FF268A13EC46A1B3245739320997BBA51B81A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413336, "uuid": "a539a355-cff6-4c45-a554-409bfe9ab3d4", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413336, "uuid": "d498414c-1c41-45e7-8aef-1a5a8b832b8e", "value": "24576:s7FUDowAyrTVE3U5F/G1lORHUKic6QL3E2vVsjECUAQT45deRV9RU:sBuZrEU0qHUKIy029s4C1eH9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413336, "uuid": "8ee49601-6894-453e-ac7c-f12a1f86c1c8", "value": 1794899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413336, "uuid": "514395c0-5797-433d-8dcb-f100b9242012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413336, "uuid": "0eda23dc-193f-4436-8a16-b3c228809156", "value": "477ba03195f3b0d566546ef9ec031fe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a2b7ba-10b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687407996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687407996, "uuid": "54dd8b1c-9f51-43f2-aea4-88470a3fc423", "comment": "Malware payload (AgentTesla)", "value": "3f0136973e66077ee32b5e5dfca5303c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687407996, "uuid": "bb443ca1-bfb4-4dc4-b686-15152b3b0790", "comment": "Malware payload (AgentTesla)", "value": "5aaf14f255169f6e6b49bc06c8c77470a387f9395ee2e3c9658ba735196261ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687407996, "uuid": "bdc20e0d-f626-4447-9148-ca1ee5efda91", "comment": "Malware payload (AgentTesla)", "value": "df00032ca3d64544caf4a1a7571b0292e1ab7745", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687407996, "uuid": "be26ea03-47b5-4d29-85d8-dd43384af30f", "comment": "Malware payload (AgentTesla)", "value": "96a5427bf61043ac22a04ec936a53900830144810cc46d6f1ef826d56a22da9d5ae4212be5f0faa6de53f36f38a7cfd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687407996, "uuid": "756c5b6d-d7f0-4f93-9c1d-68aa824f3287", "value": "T161E41214271E4073C91F0FFD18226B7403BA55ABB1A3E2C74DDEB1DDA5A7B894B84283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687407996, "uuid": "bae5c217-8b4d-4724-8913-35819cfd8981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687407996, "uuid": "509ae8e7-a0b2-49d1-a298-1c73f802e665", "value": "12288:hfXpM1JCIQfNsVcuoQHz0snRmKD9v9Ya99euKSezrR5NbvDBNQR5JYz4caiJL+X:s1KNojcKDYY8RDHvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687407996, "uuid": "6d415013-976f-47f4-8f68-2d2e9b994996", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687407996, "uuid": "de82aba6-a628-40b1-9705-ad7dd5068c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687407996, "uuid": "cd3c92e3-1ddc-4314-b34a-d84357552f27", "value": "SecuriteInfo.com.Win32.PWSX-gen.19400.17833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7419b93e-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687414214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414214, "uuid": "eeb6273a-955b-4d6c-a6fb-73c694b6706d", "comment": "Malware payload (AveMariaRAT)", "value": "01fc6b8266219508674d5ed265e98ccc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414214, "uuid": "1e857af4-f833-4983-a953-2b7b788f0529", "comment": "Malware payload (AveMariaRAT)", "value": "5b35b1d59699d07b6c9cb106aef34339f4a14bfcdb002da14f844da0bc2c8784", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414214, "uuid": "b62c0a23-2cd0-4b9a-b524-280ad9103469", "comment": "Malware payload (AveMariaRAT)", "value": "9dabdf3ff3a4bfa78e5f9513b5c73d6d3edced00", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414214, "uuid": "1c278fb2-af6e-4cde-98a2-f460687e5741", "comment": "Malware payload (AveMariaRAT)", "value": "0091f071878b8c15c52b18095b165aa8adf8fb9be22ed9067fc5d7c54fae725b57163116a573fbd4ea0e985ad6768de3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414214, "uuid": "f7e0bb67-7073-481d-b142-d8e279069379", "value": "T107C57765A3901309E496E7BB32A08B90895F3C815D9E529F6D467F86C63E2E43F0C5F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414214, "uuid": "b1a79998-c4bb-423a-a619-d86f77096cdf", "value": "eb55ec890528ca04e6435e92462c7b09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414214, "uuid": "07fd5398-4cbd-437b-b9e1-bd7fd3952ef6", "value": "6144:x+IedjRFBmeF213S+1RqOBWUYtDF+L4H70Nkd2OUS1KB+i34CHFeLxCG2d7XpR+9:x+IedjRF0ewhqHf/ozG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414214, "uuid": "386c9a33-652f-4de5-a959-8829babbcbd3", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414214, "uuid": "8b88dcd7-3e26-4611-b04c-6e177483c6fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414214, "uuid": "60a13a6b-beef-4536-8d83-14c4186e74ee", "value": "01fc6b8266219508674d5ed265e98ccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee68259-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420648, "uuid": "fa3e4202-a405-4b9b-9198-b91cee70d679", "comment": "Malware payload", "value": "49cd1b6a4ae762facec9d5c1129f0692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420648, "uuid": "766cf79e-567f-4023-8ee9-c9dfd16ff672", "comment": "Malware payload", "value": "5b927a56009e42f863d4a2633e3dd12fb09bf94afcbc46c577a1f55d4593c8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420648, "uuid": "2c2c0628-b7b1-426f-8af2-0e11e24eaf3d", "comment": "Malware payload", "value": "42c6d4a67a7374d082e7f0160a4b3aedb4881c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420648, "uuid": "f18a5df0-e83f-4d0a-9f3e-5bdb58cd0e1d", "comment": "Malware payload", "value": "f9673d39c4c216713490a92e6016a70bb2a96ca2398530b197ad65df2363c438ff23fb562a9366b159b2a2e32441a0c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420648, "uuid": "a58f6da1-864d-4dd4-aa1c-5217818f37b5", "value": "T125C4233351D38F1AC46B587F98914CC63CB0E069968E6CA1BB556FF2843DCA89BCD2D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420648, "uuid": "e3951037-49d2-47d2-8dc1-94eb6fd118cf", "value": "12288:0xf7e2xCqAg09TaZkLjbI3Xg6P2jrYayJunUQdc+3tKo+hUq72Ym:0xfa2oqAg0dikLjbI3X5eQabnUQ64ByG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420648, "uuid": "317c5501-c9a7-4132-a04f-feb80e642aad", "value": 562100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420648, "uuid": "f1538da8-bd9b-4f01-98ad-4958a93f9125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420648, "uuid": "34015a92-3213-425a-b944-6417f5799b16", "value": "49cd1b6a4ae762facec9d5c1129f0692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d894ef8-10c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687415572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415572, "uuid": "fefbf20e-5411-488c-80a2-147f82b8428c", "comment": "Malware payload (AgentTesla)", "value": "613250ae007eaba98a9cdf53bb1d1ad7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415572, "uuid": "84f0f85c-f113-4e5d-80e4-4fa6bdca9bfd", "comment": "Malware payload (AgentTesla)", "value": "5c6d793af492602543f46f1ad68b19f45569125f8328d640ab78b74101a8dfd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415572, "uuid": "164b57dd-69fa-4d12-9eca-5206dca3a5ae", "comment": "Malware payload (AgentTesla)", "value": "6c9f9a03a6ca8089368a287c7ee7a5bd5b0cb98d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415572, "uuid": "8df43dbd-2478-419a-be7e-b5dfd0cd44d7", "comment": "Malware payload (AgentTesla)", "value": "ca7ae5d79112e584365b6b022f46c0fa4c79fe5e33e9e5a2aa81f53a96490dcba86b04409d81f453850adbf4b07c009b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415572, "uuid": "c08a6b57-c605-4be0-939f-2a55536a1bc9", "value": "T136D42316E90AFEFD9855B2A4332362765F5AB6B060322C45A7DC6E4CF1C1837F8461CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415572, "uuid": "078796e8-e7cf-42b7-beb5-be55a4816208", "value": "12288:uJ3aK6G5gsx3/PKjMOfHU16j3g+/tUTFN4fp7jHWpXJ6XDLx8AZy70k:uFL5gslW8101/+XSqIvZyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687415572, "uuid": "d6110981-66b1-41ba-be7b-ff86cb6fe3fa", "value": 598594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687415572, "uuid": "43f012d1-8da9-4b12-870d-759dbe802b8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415572, "uuid": "65af050c-2fe0-4ea4-956f-66ab717f5ad7", "value": "Pre-alert M160-45027883.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8fb4e5-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420025, "uuid": "fa897626-3ced-44a4-a568-9d37eec89f87", "comment": "Malware payload (AgentTesla)", "value": "f39a32524e3ce93fabbf1defc5abb8c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420025, "uuid": "e899e631-1173-41cc-9a16-fd10589fa5e7", "comment": "Malware payload (AgentTesla)", "value": "5ccef341dfc20939a8964ba1d54de1a3e8c42ee9881a2b1bbda5aaadcf3844f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420025, "uuid": "9343e92c-d07f-43dd-8844-8e3caf59a468", "comment": "Malware payload (AgentTesla)", "value": "0a67191a3846f138ba604d37db7568d831337553", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420025, "uuid": "b63a682f-9e6d-46ec-a1ea-e2685ebd5a6b", "comment": "Malware payload (AgentTesla)", "value": "af337a7efbe8bf1e4dcf08ab3c4305c574c8996445a9ccf8373f6f0d7105504966aec75cd46afa5f74ff2e8df3c7705f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420025, "uuid": "f5cbf695-5888-4e47-84ab-5d2f45128fd6", "value": "T1D3E42254B76E4043D4AB4BFD496012B1033E769E7433C7DA0D9B30AED6AAF426B60B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420025, "uuid": "f1c80dec-7889-4dae-9052-b41c168cda26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420025, "uuid": "2e63c9b9-4432-42b4-b2f8-78e44297ecec", "value": "12288:eXXpM1JCIQfNsVcuoQHe0sUGSSrqEMAGgnYaMxhflrrvXfsqbtbi6AYQrbhZR8uC:ei1KNoaqSesLMxhftXFxibhL92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420025, "uuid": "69638422-f46b-4a73-86d9-7823ee7bea63", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420025, "uuid": "aa489110-97c4-41fb-a3d6-6d6c950ae847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420025, "uuid": "8481c2b4-8027-4458-9f26-326cab6a514a", "value": "SOA # 87594094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b25db7-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422213, "uuid": "7ab37329-866e-4e25-bb9d-846a15a478c8", "comment": "Malware payload (Mirai)", "value": "24e715f6f919ffdef06d2bf47825bc21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422213, "uuid": "19b3d625-3f21-4373-bad9-fc26e1553139", "comment": "Malware payload (Mirai)", "value": "5d7720db0b369204a0408ee33a8f70c6eeaac1270e05dbebf2622c8f5a89f49b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422213, "uuid": "2e72da69-c5bf-493f-9cbb-97f5d798468b", "comment": "Malware payload (Mirai)", "value": "af5aa6cbc806319348826ca7677c440e8cb98ffe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422213, "uuid": "cd4c01f8-ec1d-49c2-afe8-d2f9faa6c027", "comment": "Malware payload (Mirai)", "value": "fbd61d87fe5f16de0417a7d57b6a96eb1625fefec5a4b07cddad1fc68d83dbd766b9304a9d2a868921bfee77de449b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422213, "uuid": "9b9c7099-b6a5-442c-9d48-5957e99bf19f", "value": "T1FFA36CC5B643D8F5E85245B1643BBB728773E43A503AEF42D3689D72DC62910EA1B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422213, "uuid": "de486cde-67cd-4e52-921d-622b8b71ec4a", "value": "1536:C36E3Sv5UAnSQGORaggPuIiLhdx60l3uv749TR6vcx3+vm79ckSsHqfkJ:CqE3wyQGcaTPuIQDx60l3gPvgWXxs4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422213, "uuid": "9ebae728-3c06-41d6-b228-825817f6d1c5", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422213, "uuid": "fe98a85a-3a37-455c-b13c-ea32ac95fe48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422213, "uuid": "f4e375d4-97f0-43ab-8ec1-07a362021480", "value": "24e715f6f919ffdef06d2bf47825bc21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a937fa3b-10ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687431913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431913, "uuid": "7e206bf4-5263-443b-968c-e8a129627e1a", "comment": "Malware payload (AveMariaRAT)", "value": "3c1f4839d9947c358653f24b4422fac0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431913, "uuid": "30de0c7a-0610-4929-a515-64c93c19b154", "comment": "Malware payload (AveMariaRAT)", "value": "5e55b972a4b1e7a202f9d20f8f7e74162f89590e3c0fd19e489d1a7d52d1a439", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431913, "uuid": "d96ec164-21c6-473b-b54d-f57a6b6d5249", "comment": "Malware payload (AveMariaRAT)", "value": "77b381aab65c810fb62b8049758bec86216d8433", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431913, "uuid": "a488aad5-3e26-4c02-a5da-8ad3eaff36dc", "comment": "Malware payload (AveMariaRAT)", "value": "406d45cf832cd5ede10c855ed9f212a92320f8c0858f56356b4ff9eb0ac8a0b822ba250e6dae42b5551751b2e07ca6dd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431913, "uuid": "9ec78b6a-ba6c-46b7-811a-2576ef5e1414", "value": "T10555379C361075EEC86BCE76CAA82C74EA2034AB570FD243941715EDAA1DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431913, "uuid": "d5682363-c4bf-47d0-83e9-cf83adbeb765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431913, "uuid": "2c75834d-4fca-4a5f-9846-cdd9fa41c828", "value": "24576:uFMWZT1WI2jpQDGBwov+wJ1KNoMztJgCmd///AXITfw9uCRV4L:uFMKgQDGDRJ1KNomaNfa9RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687431913, "uuid": "14cc3fb4-b99e-414e-aa0c-e74e3bde3e45", "value": 1385984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687431913, "uuid": "bbddc7f4-b3f4-404e-9f7f-1e3d68bc4cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431913, "uuid": "0037e656-4082-41ff-856f-bbfb04f05917", "value": "FACTURA 2303822PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d7d9e7-1116-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687449914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449914, "uuid": "5fac89af-caf5-4f1b-bec0-c71e8aeb5409", "comment": "Malware payload (RemcosRAT)", "value": "b6e0a5740f3a35ad6c5d5668b2d43442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449914, "uuid": "ab2963a7-524c-4660-a6a8-7fb58e83c708", "comment": "Malware payload (RemcosRAT)", "value": "5e75e6201d276c99cbac6caf0e2ddca24e0937867fd141c4fa3a70fdeee7782d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449914, "uuid": "5c99e7ee-8038-4d67-bea7-eeb9ef4831f9", "comment": "Malware payload (RemcosRAT)", "value": "7f1a480b3cd96a2e570b59049b99362f5b5eb8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449914, "uuid": "8757eb16-9420-480d-9de2-143b8c9f73fe", "comment": "Malware payload (RemcosRAT)", "value": "523a4784512e0855d304efe038b757f87e80591929d72761c3630cc559cd85e7df366a065b832d183cbe6b9336753e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449914, "uuid": "67f8bf91-df65-489b-a83f-0df12a3dfeed", "value": "T1F545DF6AB491F57AC9D206748C6AE6B8D8357E753D19304AFBE33F0DAA346913008377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449914, "uuid": "f5578bb5-e557-4bea-bc6f-1d043d7e4fa8", "value": "fcdfec335cedcb7fe99f19a37122fa46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449914, "uuid": "a1ed8fa6-fe18-48f9-8bc3-064bc29bc724", "value": "24576:Jzsa5dmos2s2yRHOBvwY3MZ7D5sfHTcmyCyz0K:JzsjmjMZ5+ztyzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687449914, "uuid": "3042e51e-d10d-4ecb-acda-92f4edc673d4", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687449914, "uuid": "4b5b01c8-e57d-4f24-b1bd-ce3f7b4475f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449914, "uuid": "be14e556-40d3-4b88-a024-6977d329b3d6", "value": "B6E0A5740F3A35AD6C5D5668B2D43442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25571d0a-10f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687434268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434268, "uuid": "fc63b085-f56f-4c52-9d73-c06e8539c94f", "comment": "Malware payload", "value": "0b3cb9c431a9b8bddd867ccccbac09bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434268, "uuid": "a83cabdc-5321-4ab4-b9e1-bb2c1509f343", "comment": "Malware payload", "value": "5f48e36ee42b470d7bba4370e8afe06f95a91de4747675bf60c429ad52b52608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434268, "uuid": "3c983b2e-d51b-4239-b6a4-b3931d894600", "comment": "Malware payload", "value": "fce2e82a32913990add98b1b431495f65b40e1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434268, "uuid": "32388983-6afb-472e-8125-5e817d3c1319", "comment": "Malware payload", "value": "5f33ea682441035a3c8e907d0ba47279a9df1f3ea65eab7547a51bcd2e24dcddc60060126f32ac54130cc9337b4985ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434268, "uuid": "e1076dd0-e719-43fc-84e9-0e2b37d5759d", "value": "T1ADE6330F320731E1DA6ACE73E05F318067E4D1D43771C71E77ACBA952A5AB759882A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434268, "uuid": "1b6e8240-46fb-4a1a-8c95-bbdec6944b01", "value": "393216:pVBqsKNljB1YbfgJ0DD23qztbpiGMdKnSUdP78kPxTU:xqjNdHYbmE2kbp+dMdj8aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687434268, "uuid": "dfb6a06e-172b-43e5-8e3d-bda740012737", "value": 14892032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687434268, "uuid": "c70202bc-100e-4335-aa26-d7389b96f609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434268, "uuid": "c0896fd4-f526-40f5-a4da-09e54a1a7c90", "value": "SecuriteInfo.com.Variant.MSILHeracles.88976.19093.4975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fccf64-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687423319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423319, "uuid": "2aa026d6-b833-421a-83a6-c0a825d0ae5e", "comment": "Malware payload (RedLineStealer)", "value": "13c173a3a3b6255020197ff38e788837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423319, "uuid": "d9488991-96bb-4ba7-83dc-b64cf8364cd7", "comment": "Malware payload (RedLineStealer)", "value": "5f4bfa1c4fc1b5d0f8dadb74ca35b3ee413ba48406704cef03276ee97a574474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423319, "uuid": "106b2e5a-4ddd-45a4-8957-e035355fc782", "comment": "Malware payload (RedLineStealer)", "value": "939b4e8766cd5cd62eef1859a2fde188a03b6e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423319, "uuid": "c54cadd1-953f-4768-8b35-52a805df1c40", "comment": "Malware payload (RedLineStealer)", "value": "5185f41a5b8d59cc84965eab1563bffe5d3373d82a917a74b9e73645fb04ffec2dde378d3d07476c17fc418fc1ad7f90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423319, "uuid": "ad81b338-2a9d-4367-b29f-d83aa501cdad", "value": "T194150242B7C0C436E9BB26320AE0DF74857E7411076519EBE7C40EAE8F205E1ABF659D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423319, "uuid": "1df26bb3-48fb-4330-b1b6-d556790426a7", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423319, "uuid": "5a0be93c-b844-4886-9e5f-4dcedab1ae00", "value": "12288:zLztKeEjWeeIOk033WJSn/cdeecKXcTmu+B7J/2UpnvBqLViyBl9YrufgF:3kOeeLn/cdeep7JlpvQQql9+uI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423319, "uuid": "1a63a47d-4494-4bc3-8a3e-bfccda8b3726", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423319, "uuid": "0f4f1626-0e13-404e-bba5-b720da7a0c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423319, "uuid": "336735ba-8fb7-413b-aff6-93ebf34facc7", "value": "SecuriteInfo.com.Variant.Babar.215418.1445.27111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16176e0b-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420928, "uuid": "f84582da-b953-4ea3-9dde-9c7efcae96ca", "comment": "Malware payload", "value": "20fc50640f9022bd46d59d1736844d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420928, "uuid": "8ccba4c8-6326-4edd-bd40-d5875268ab48", "comment": "Malware payload", "value": "5f761c5674b013684acee8dcf8248550ca909cc1f0453ab00ad7fcf72d5ab940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420928, "uuid": "6bfa71e4-b309-4739-b376-e7c87ef7c908", "comment": "Malware payload", "value": "b19504d857dc8c7ef80a65a82128e8d9068d192d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420928, "uuid": "aa52e6c0-79e5-4a49-8b46-a446f6d6b2c1", "comment": "Malware payload", "value": "4c468c4b16a5a1214a5787ccc40a53763fbac699d969f93e5e3d79b47d68ed917e3e9b75f8e6eb21a33c0cc0bab0bc8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420928, "uuid": "c2737d6e-8f33-43da-9a0a-54201ae450ad", "value": "T16844E152B6D88132D9F52B705CFB03D31A31BCA19D78876B1782699E0CB27C4A97173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420928, "uuid": "149737d5-06c7-4688-b3d1-69aac842a148", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420928, "uuid": "9e7fcd1f-ba40-43af-9e39-f4a85c85c9ea", "value": "6144:Kmy+bnr+ep0yN90QEKCl8Auw9TTUUA+hgYk:qMr2y90UCl8LwNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420928, "uuid": "fdc54a96-dd21-4769-a122-aa37855c18e2", "value": 267476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420928, "uuid": "0a2a88ea-6b81-4d87-b8f6-a7d3d5b4f376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420928, "uuid": "0eb66af7-a30f-4c3e-b83a-14e7d4f0d68a", "value": "20fc50640f9022bd46d59d1736844d7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaefc765-10c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687413984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413984, "uuid": "2b4c4ade-f301-45a5-a905-bc57297eadb8", "comment": "Malware payload (Formbook)", "value": "8beb6d32ab7a3b9259846ed6c92ce55b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413984, "uuid": "f7fc52d7-6f08-4a7b-a81b-b096c67dc67b", "comment": "Malware payload (Formbook)", "value": "600e9328c592417bfa986a5a2f7aca7503dcfde78d962d1e289bde8f890c1aae", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413984, "uuid": "90f69881-aea3-402c-a8cb-f2c3960510e0", "comment": "Malware payload (Formbook)", "value": "78ee1fcf7fabc1d9d56f62ac7854db23fd598e1a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413984, "uuid": "ddd283f6-5c83-4ad7-b0d1-118a19dfe1ca", "comment": "Malware payload (Formbook)", "value": "439cd3afa362dcfcf2e6e1e7907c217a96ab36346f7fce993536f77b2b1f6acbe28b62c1bebb9976fb04208439d7f1e2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413984, "uuid": "699724b6-15be-494d-8652-15003754fc24", "value": "T1C491E8791B8C1CC3E72290F4A5DD7F531267F22687CB2E4817AFF870082BA21413289A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413984, "uuid": "c332bc1a-6307-4406-a9ee-081639d32bcf", "value": "96:URTVGuOSk2ZdupImAw0STlMxFdH7LeOKA3wuxu2DPp:UfG5xUPhKlMxFdHlKqlA29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413984, "uuid": "295536bb-9580-444f-9096-2f569e8fea74", "value": 4414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413984, "uuid": "0fa01911-8ec6-4cf3-9082-a9eecb6972ca", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413984, "uuid": "f47e7901-4b0f-4f11-a20d-40540604dc53", "value": "SPR 2100004771.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279b94ac-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687413227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413227, "uuid": "c4d0fa81-f58b-4ec0-a504-30eb8b8875a7", "comment": "Malware payload (SnakeKeylogger)", "value": "23c12a1ff8ef6c2d9ffc8020e69e9804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413227, "uuid": "f42c3bd1-364f-4a51-b265-83fd7567250f", "comment": "Malware payload (SnakeKeylogger)", "value": "6026079cd4a895bf3956688c9da038c721810971b5ad4dbea0646f3286ddc521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413227, "uuid": "dbeeb9c5-2f82-458f-b4c4-80756bd933f4", "comment": "Malware payload (SnakeKeylogger)", "value": "56aea9bff7dfd92859f80cb791d1b829f1a5c994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413227, "uuid": "b88ea29f-edbf-4210-a18f-3cde2bf3eb11", "comment": "Malware payload (SnakeKeylogger)", "value": "cac5eaee0a14f41bad35422087fbbbf60d4bc0da07f149b6798b382b13fff7d81c953bede47b288d1453b5d163927953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413227, "uuid": "2e0d4b58-99c3-41de-aed4-cb52ef10ac08", "value": "T111C49F1AEA04611AD4B6CBF00873A2657D361F551F61EC8B77E01E89B8B2613B1F631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413227, "uuid": "6e6d718a-01f9-4990-9bd5-8944e479caab", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413227, "uuid": "af3689b1-43e5-4825-a2c3-65bf4eb421fc", "value": "12288:GENN+T5xYrllrU7QY6+RyfOBYi5TlAxamL+:K5xolYQY6+4Gqi559Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413227, "uuid": "955b69ee-4c66-462f-9814-98d3336044df", "value": 563576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413227, "uuid": "8654cfec-e686-4818-bea0-6b753c07c240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413227, "uuid": "b78cb142-5ee0-44b6-9114-6cabab5aad1a", "value": "09865435678900098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e052092-10f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687437290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437290, "uuid": "2f16663b-7e7f-41e3-aa06-43bfed6f8864", "comment": "Malware payload (Formbook)", "value": "f836946fa95df493a78871faee76c3f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437290, "uuid": "e7102bee-19ed-4b2d-a070-9d31b8c300c3", "comment": "Malware payload (Formbook)", "value": "6198d9bed18e04a2661a530baa625bc1405bae202a283928ef5246e1625c6c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437290, "uuid": "39c8a274-4f1f-46bd-9be2-7e31cd099a0b", "comment": "Malware payload (Formbook)", "value": "3586dde021ef013a6fbc7b126610acc61b910a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437290, "uuid": "56c66726-5c73-4302-b890-e3752c73d16e", "comment": "Malware payload (Formbook)", "value": "9cae577549b25ba5aecabc3afc3a1662e06777eb3de25c141f99a9fd193cb438291f2a56ef589f2485d878d9875d40e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437290, "uuid": "da60a675-fe16-40c1-b3af-b81e1240b939", "value": "T10D742344B681C4A3D87A6370CD72976AEFBDE9011461E55A2B600F4E7AE2630FB1D3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437290, "uuid": "46f18c41-007e-4520-b3ca-2684b7f16ae8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437290, "uuid": "98d2cee1-9b6e-4277-9dbb-2ad57b7f335d", "value": "6144:/Ya6jub17uy4BfqCrx2644Wb30Mn+fwrd/uHIUJILokCairiWMoUI5CMti0+4SLF:/YR017uy27F24KBn+g/uoUJIMkCaS7CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687437290, "uuid": "258ccd82-266b-4c62-a123-7744145394e8", "value": 343927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687437290, "uuid": "d3073506-5197-4f5a-af88-ba3858bb7945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437290, "uuid": "e4b0f619-e26d-40cf-9aa3-db3de6727b19", "value": "Talimat- Vakifbank.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fda417-1096-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687394994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394994, "uuid": "4c224cc9-1952-4293-81d8-5f2c0f60864c", "comment": "Malware payload (RedLineStealer)", "value": "26a4e7fa64f567e433f63813716040d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394994, "uuid": "a60b8d8f-704f-47cc-b722-88f9c86e9015", "comment": "Malware payload (RedLineStealer)", "value": "61f00aed28e8109dfdd4dde615fb713e3b8bd5cd4995fd336f4f299bed1f310e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394994, "uuid": "61349a8f-267c-4f17-bba0-39ae014d7c71", "comment": "Malware payload (RedLineStealer)", "value": "a8f264326ccc1ec8067703b3d2037cc15aa62a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394994, "uuid": "88ef7b5f-add5-445e-b84d-71b0c8620a74", "comment": "Malware payload (RedLineStealer)", "value": "139002f121830b655d67089538238822c4c2fac65e3419956028c3157086693eafa8baf29925c7c0506f4a4ed769cd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394994, "uuid": "764ad79e-a6c2-4db6-a98c-30ceaaaadbd4", "value": "T1A5159E1139B0D373D86221328E598E74553BF5700B310FEBA7D45A6E4F23AE2AA3175E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394994, "uuid": "fc3977bc-73c4-4720-97ff-92c76a7ae377", "value": "d3bef53bd3b1af06f068902986513bdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394994, "uuid": "c4d4e1ff-1b56-4aab-96f2-49ffdd7bcf37", "value": "12288:jV80Jo17O5rRfZZExSnCTWM/VFtwIHq+0lufgKkvKrNxmy9t9D:jXJo17WrRfZZEKC/VFBK+MuCYHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687394994, "uuid": "ede5086a-530e-46aa-9cd0-d724dfe7646e", "value": 885176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687394994, "uuid": "c94671ee-7833-44c2-9696-af1d68457be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394994, "uuid": "2378a6fe-ae9e-4c27-85ec-63a7ab964a03", "value": "MapleCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b2fa4c-10bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687412420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412420, "uuid": "825bb3d4-dd27-4f17-9272-45b2557c2323", "comment": "Malware payload (Rhadamanthys)", "value": "2809bff19753a15b31614cddde67f245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412420, "uuid": "e1889b76-fffd-4ad3-b358-c3a066075fc3", "comment": "Malware payload (Rhadamanthys)", "value": "6266cd88962428cfc873a4c0390491375e91505a66e0165ec476e3be724b9b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412420, "uuid": "fae93c14-2574-409f-ba14-8208bcd4ede1", "comment": "Malware payload (Rhadamanthys)", "value": "aee8f16a80a6422885f3328d90a3621719249f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412420, "uuid": "66fb6eef-6f75-4878-9d0e-99a51f3aee61", "comment": "Malware payload (Rhadamanthys)", "value": "bacf3d64dfcad60059d9cd2d7d3a975eae506a68b2e6790ba22f997b11733210a368b72cbfe0d8269b1fee04bb8fe011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412420, "uuid": "b3441308-c80f-4e0e-9212-30f819756176", "value": "T14EA45BA5BBF2ADC4CE8D33F388046BA4069E477645F2D2C84D295952273F6A5CB0B53C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412420, "uuid": "270a1b0f-6345-40e8-b577-7aa03b604f7e", "value": "fd020041ed8eb76ffbdb414a8b3716f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412420, "uuid": "bb2ec3f2-b5b5-4a42-b870-dc31f976cd78", "value": "6144:L/E8DIpjK28t4snQalp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snJv/cgu4VGn6OaM+ucj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687412420, "uuid": "4adbe230-0de0-4825-b435-949a6c87d4df", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687412420, "uuid": "dc4d1054-3c85-4f3d-91d8-1bac4cce057b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412420, "uuid": "a165ac43-522a-45f9-bf2c-a344246d0f08", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53bbbde-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687420766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420766, "uuid": "659e516e-dc51-462d-a2bd-8b053b3466f8", "comment": "Malware payload (GCleaner)", "value": "db22ce8e97596394062d7ebab792e94c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420766, "uuid": "674b2d41-dac1-4fb7-ac96-ef4e52669bcb", "comment": "Malware payload (GCleaner)", "value": "62879ececd7367d6fb217517e882860536a6a650a2bfa5d0df3d1734c7b886ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420766, "uuid": "7896f8b3-440e-402d-85f4-ffb4ff82830a", "comment": "Malware payload (GCleaner)", "value": "852efc5f4981e0c1e281b9299b6231470e5a357f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420766, "uuid": "70aa4552-c552-4761-aa7b-42833c75655a", "comment": "Malware payload (GCleaner)", "value": "64c9fcb3f1df9d2d0db0d3a9cd0aa548847f4d51605642b3167b9a6981aadbcbbac55b7d19fb5dd22ee64c16d43cfb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420766, "uuid": "378e395e-2436-4a87-bef3-ae16bbd8d6db", "value": "T17C74DF1136E0C072D12275768672CBB14A7F7476663A9A8F7FD81AB94F387D19A3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420766, "uuid": "15daea24-1812-4c83-9b36-ac6ee7c0df4f", "value": "e1bc49d18619a3dde79993bbed87ee38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420766, "uuid": "a1a895c1-b0f6-4be0-b5a7-5520e2eaa126", "value": "6144:qWihKyRbYdtrUcu7S7xaN4Aepe8LUJLC:ViEyRbYdtBum7xs3WeJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420766, "uuid": "cb39fb1a-eb52-4f8a-9f39-051887b4c542", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420766, "uuid": "7f49bee3-013c-4d05-8a9c-56b750702b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420766, "uuid": "4737f108-1ee3-4c2b-bf64-7fcc6a7069b1", "value": "db22ce8e97596394062d7ebab792e94c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094d73da-109c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687397285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687397285, "uuid": "e12fe4cb-9137-42b1-bb87-bfb7a18e314d", "comment": "Malware payload (AgentTesla)", "value": "17540af6afcc7ae5ad69485e361fcf92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687397285, "uuid": "de1b3ee1-4bf1-4d29-9ddc-4556f5b454a7", "comment": "Malware payload (AgentTesla)", "value": "62b24cbb76ba7b4d7df8d6f39b1521e8e8a6063789c4be19059d4f94dceb358e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687397285, "uuid": "e4564b1a-5d24-4436-9090-1c9149ee8d90", "comment": "Malware payload (AgentTesla)", "value": "83aa78e1626edc785f608bf3feb563be19a37d0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687397285, "uuid": "2c07f73b-502f-4895-b6b4-b6dcfc7d14ea", "comment": "Malware payload (AgentTesla)", "value": "262baa13b5e5e87048897369482e2499fa74705c8564b217461198e68cb6cd626ae295f18bf8cf3fe8c4f72bc1d95236", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687397285, "uuid": "c10331de-45c9-4056-8ff6-3573bfcb5c0b", "value": "T1BEF27D5AE38F02A88F5113B3131B1E99A6BDB63EF35054A5346C833433EDC6D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687397285, "uuid": "dd8e0356-8feb-44e6-8280-b25854aac5e8", "value": "768:iFx0XaIsnPRIa4fwJMOI+KDlUFDxylCurCl7uHQQ+yCB:if0Xvx3EMLlU9urySHUyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687397285, "uuid": "d2d6fdda-124a-478e-92e9-b36964f4ad76", "value": 37125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687397285, "uuid": "0f9b98c3-d1c4-46b5-9dff-2e3ec259f847", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687397285, "uuid": "7a4f29a3-5997-40f4-9151-54cfce74fac6", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.6703.16844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f314524e-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459524, "uuid": "90b3e596-bded-4d41-9623-0d56f8730987", "comment": "Malware payload (RedLineStealer)", "value": "4a7a250b5022bfa0420f75dbaaba67c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459524, "uuid": "61f824bb-284e-456c-919b-4ecff856cab2", "comment": "Malware payload (RedLineStealer)", "value": "62d0faf01f74ec584efadfb6f7ab59514bf30d9684081298ffd88a2dc760486f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459524, "uuid": "f9d51f58-945c-4fbd-87ae-1ce25f7765c7", "comment": "Malware payload (RedLineStealer)", "value": "792a1dd52b10cbb9156dc7b035e97c6721e8ce3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459524, "uuid": "6cdd3d92-5a66-4243-b1d6-b66a456af51e", "comment": "Malware payload (RedLineStealer)", "value": "e8d17fcbfb5684d2c0c650210b5ea14766db269e1166942916376cae211c5dccc1982889053f01862382b271b5bbfd2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459524, "uuid": "bdbb81a3-7609-41e8-b22c-b7704559bc63", "value": "T17AB4F1CA75804927CF67DDB2D4AFE9834EBA702107714B87130D4AF68E461D4E60BA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459524, "uuid": "87663d19-cbf1-4817-8b7b-91e78d5986a4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459524, "uuid": "7cafd52b-3592-4b3c-9a96-e3a46b1bd4e4", "value": "12288:oeeQnTey5s3W3ol1w7S29/sIvYaK+9zHslQJQmZ:oee6Tey5s3bqu29/sJ+9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459524, "uuid": "ba9aa746-ad35-4aa1-827b-ceb40a80c3a3", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459524, "uuid": "380d1e28-eb28-4671-8a51-6c765d879147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459524, "uuid": "d5a39bb2-47da-4f98-be19-994615b060a4", "value": "4a7a250b5022bfa0420f75dbaaba67c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badc6ba4-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687420346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420346, "uuid": "50c3dd1e-18f3-46d6-b71f-16d38ad2ae0a", "comment": "Malware payload (AsyncRAT)", "value": "889ba30b889d6a6c0c62d575ee873de9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420346, "uuid": "efa1960f-8693-462c-88a2-b829a4f6165e", "comment": "Malware payload (AsyncRAT)", "value": "62fd96c7b7b24e8ea4386053191265fe483b2270b2e1e81fbd7f7b09d0739bc0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420346, "uuid": "c93cb6d5-e8ac-403d-944d-f051cd20bfe8", "comment": "Malware payload (AsyncRAT)", "value": "2be02b8bafebbcf81fbe9e565bcc8a18fc8e66fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420346, "uuid": "99df7ac9-30fe-482a-9f73-600ef7a27d06", "comment": "Malware payload (AsyncRAT)", "value": "199326f57ba78e1251c584481d18ed489a5fb2404263b7351f84f2881fdce23aa5d12acc8d4642c157102c62b973d8e1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420346, "uuid": "d481ba40-da71-4ecd-85c2-ba9455dec1a3", "value": "T1204528A2631C6BC7E1F98DB04F8E0960E5F1A69858D4C74C7CF5478E8BC2785835C6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420346, "uuid": "a10f3a47-f97c-4171-8197-c7641c1123e8", "value": "6144:SnEEr/kVxmO0wE3jjxRMpAXuOQlMbHxpaqa/VVWadJHKwM1TyA9tYLZKi8vj:Snr7O0wE3jkpOQYxpaqaPd1WTyUth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420346, "uuid": "c01ed6a0-3ba5-4f4f-9aca-7d301caf3b97", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420346, "uuid": "9a114d6a-5553-49f6-aa57-2bdfa96ac3bb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420346, "uuid": "5c7cf898-9718-485d-9ac1-d0fe87b8fea0", "value": "INVOICE 00082995 -1y , #PREV INVOICE 08878.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea38ce6c-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687423432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423432, "uuid": "8e4f27de-72e7-4c29-9a6b-ceb2115d3b11", "comment": "Malware payload (GuLoader)", "value": "72f648edd8696f9851583c0305937985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423432, "uuid": "fb0e64d9-114f-4ae3-9724-17549dfd0472", "comment": "Malware payload (GuLoader)", "value": "637d4e1411e4b97f9479010717927a59129041a0d5d929aff03d31c7d58768fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423432, "uuid": "7997c0cf-73e1-4e3f-9e7a-778b2145b5ad", "comment": "Malware payload (GuLoader)", "value": "e5ff2979525833a5c2dc158b01a79dcf83a16e2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423432, "uuid": "9a849986-319c-4ded-8a72-1f80f135d948", "comment": "Malware payload (GuLoader)", "value": "60498ad6589365145b48e47d42af90e6799557b9a76d00cafdb4d64ad62cd50f6d6df019fe56f37f5bb7f2f7bfa19b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423432, "uuid": "557bab3c-7b9b-46a8-b0ea-d589b06c224a", "value": "T1AA84021733C08CD6FB17A23184269B79B7ADFE3D177662371BE12E5E763D2804A1A142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423432, "uuid": "39d42e73-efd7-468e-9377-07f3d353d02c", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423432, "uuid": "f75529d2-fe5b-4316-9cd4-0bb64dae9fc0", "value": "6144:Cp2VYdh+Qhj/fQHbeG47z0EMrj3qHLbF8AY72gHrL8HbwAYJfO/CydvkqATzG95f:hO/hjnBgEMv+LmrHrL8HbwAYJvybQzG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423432, "uuid": "1353c4a8-ed96-453d-983d-cd1dffbeff06", "value": 380204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423432, "uuid": "b956cabf-03f3-4cf3-96d5-3bb76b4aab9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423432, "uuid": "1336fc6f-1ae3-4760-8347-c130b8c7b34c", "value": "Nr.21594772 Technische Dokumentation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f40d5c-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687418539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418539, "uuid": "777e45d9-c2cc-4eff-8313-4696b30a41f2", "comment": "Malware payload (GCleaner)", "value": "79c0addec9c6ec287d94487869fb15e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418539, "uuid": "58045424-565d-4dec-abf9-79c739d96814", "comment": "Malware payload (GCleaner)", "value": "63b53b29e36e3fa5b6ae82cea87ad8c3f15ae24ae66a555d510978d1383cde43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418539, "uuid": "7da4f593-028f-4d75-8d67-6dab9dab0688", "comment": "Malware payload (GCleaner)", "value": "4a1db5d04dc18955e7613608fe54eef931ee6fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418539, "uuid": "566880ca-5b38-422b-a611-d370c45d04a7", "comment": "Malware payload (GCleaner)", "value": "01342ed4e18b578adf12456c59fe0996c1832fdc2ecaab49c782941666f91eaf50b488f9382d08166a5102e556707048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418539, "uuid": "42c13ff5-7530-4359-94e9-cc11f23a8171", "value": "T17C74CF1136A0C032E92271758572CF755ABFB8B167255ECFBFD406B94F246D1AA3034E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418539, "uuid": "3f32e8f6-add2-4b3b-8b14-c0bded036d76", "value": "4c7f209181ee40b674200cb9d1c76dd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418539, "uuid": "86162562-ed76-4696-985f-ca47e3c0eb88", "value": "6144:JWyuwaZo7SxV3C0Ro6qYM/bfDWRcQg+65EV/UDpvcs:buwqo2xV3pG/bf6RcP+65g/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418539, "uuid": "11d7dc35-a1cf-42a1-a550-d21704fca6ec", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418539, "uuid": "e3a3b478-83d8-4225-bd98-f02a373875cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418539, "uuid": "b65bf194-ac95-423d-b189-791651e0d05b", "value": "79c0addec9c6ec287d94487869fb15e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2f51bb-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687423440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423440, "uuid": "8ce7a3a0-5284-4e6c-b194-124665fa3158", "comment": "Malware payload (AgentTesla)", "value": "9abe53f4c16aca4a0105dccc3f7c6b07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423440, "uuid": "9d705b4b-92f0-4d12-9a64-f94635b4b62a", "comment": "Malware payload (AgentTesla)", "value": "64447139224657a8aa462c50753ad70595743102813d04bada0de2d1a5707683", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423440, "uuid": "1eed8faa-00fe-407f-8fb4-6c1769178f1e", "comment": "Malware payload (AgentTesla)", "value": "d4ea482ea71ba020b85ff60b9712a6cb3221a699", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423440, "uuid": "6ef97fd9-f011-4a99-8ef6-35a0a6af2754", "comment": "Malware payload (AgentTesla)", "value": "587d66d5b7d30e9e9a06698f5183aeb8d8a9890d7026750ba1c0ccd933f44221cd49a7e1d383fc84f9c29753822f4e1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423440, "uuid": "f8e7e95a-a136-440e-b4b6-8a7e36fe95ff", "value": "T107A4234E37A14D025AD0389212EF221C8D1AF4D4F7F41E9DB98397107E78DE532B2AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423440, "uuid": "e0bd6801-189a-4f16-ba5a-2e5b795be953", "value": "12288:XVk534dhsAnDMFneCN37C/kc1m6SCoXVj/tAyyThU/mR:443sAAFnJNLsBMCoFj6yshU+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423440, "uuid": "9b853867-d0b0-41e6-bc18-70e610ad94bf", "value": 463022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423440, "uuid": "1e6cdaf8-ef35-4e6c-ad35-88eb3f91a4b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423440, "uuid": "9e0e2a1e-c3a9-405b-9458-69d585af0546", "value": "payment Advice.pdf.r11.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724de5ed-1151-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687475200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687475200, "uuid": "4b4194a6-62ae-4087-a4d7-66272188c88a", "comment": "Malware payload", "value": "b5b208089a6d677dd7fa18c64721f4af", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687475200, "uuid": "dabb1bce-0aa6-444e-baf3-cdbf292ab593", "comment": "Malware payload", "value": "6463fba26e089c871f8c9fef02d935b9cb686a6570f901cec099e58493d8d2d4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687475200, "uuid": "79837837-3873-44a7-bdc6-86fd2f5555f1", "comment": "Malware payload", "value": "506c5df301a359f878baf8c383fbe64d199f0732", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687475200, "uuid": "2c3a994a-12b3-45a8-9f8a-0743774b0447", "comment": "Malware payload", "value": "09e7c5b230d9774c7dc762b7af6218925db6e4060a52073bbfe95a8e2ebac056c3081f2cd41842a23342bf0c94a50b06", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687475200, "uuid": "1d99335d-8c6c-4a0a-9c11-e980dbc932de", "value": "T1B0752327FEC7F452E85BE836C1A2D172CE4E425D4189FCBB5EF4868C59E1E648B42C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687475200, "uuid": "19dc2c8c-a62d-44b1-ab7b-03e2c6b02839", "value": "24576:xP2DwUeTQg1rTEyceVV2lGTWOOlUHgq9RhDhFpofJ9fVZGfugZ3VczW6nGKDpL:pAwUgQcE8qGTokRhPGahZFMWDUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687475200, "uuid": "e3e9d3a3-9c32-4167-bdf3-fa5d2afa1a40", "value": 1607004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687475200, "uuid": "ece27f41-1153-44f8-a3e8-d2d7e6622254", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687475200, "uuid": "9771ff76-7a1e-4fcd-a925-b15aad5cf7db", "value": "sms.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c40b287-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687455325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455325, "uuid": "8992ed8a-5d01-41f3-b425-ff59b3db8ca0", "comment": "Malware payload (Amadey)", "value": "49b2316513b87cbda97867db57e87eed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455325, "uuid": "33feffc6-744f-4b87-8036-b7464437e3c3", "comment": "Malware payload (Amadey)", "value": "65a656d8fcd62e43d9a01fa3b778901ce779849f2fa38f5965d2e212bba23e0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455325, "uuid": "165144a9-d9f6-49fe-a5cd-7226dee7892e", "comment": "Malware payload (Amadey)", "value": "3e44515a0c60c3c137c0d3154c0b30c093a33eb9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455325, "uuid": "72027d63-1d92-4f19-8c1a-b1718fb4b2de", "comment": "Malware payload (Amadey)", "value": "4ff79b7493363390ac7b2a735b6e4d4d5aa631a23b207c9263a07a244658862173462760772f63b1dd0be4105ae63d9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455325, "uuid": "32a8ea0c-6333-4cff-adef-5057033f8782", "value": "T160B4F1CA354045B3DF63CAF2D4EFF9D64E79B0210B7546C7220C8AF58E456E4A20B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455325, "uuid": "e2d59f67-a69b-4ced-b31a-08ea93bf5261", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455325, "uuid": "5b1bdec0-acef-457a-bd20-bd1309836b0d", "value": "6144:6mEgCNvhQJuqwePpsyJfsRNcVPEG294oxqwai1GV3SgVWWTpK3yc1g6QJQmZ:6mEgusTey5sRdSo4rSgJTkiwg6QJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455325, "uuid": "625eddab-7863-4306-bacc-f737942e13f9", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455325, "uuid": "a6d2fe1d-0ba7-478d-abee-fa36cd6b875e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455325, "uuid": "dc44ec8c-ac04-4d56-9d47-8639c6ea53e3", "value": "65a656d8fcd62e43d9a01fa3b778901ce779849f2fa38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4baafa1-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420846, "uuid": "3576576b-c129-49c2-889e-f61129b4b9b3", "comment": "Malware payload", "value": "da598f4ccd4dcef6df3dec3b9e70fbf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420846, "uuid": "6f564838-f8a1-49a0-8816-cd78162ab74e", "comment": "Malware payload", "value": "66ab47355c379fdd2907594ac7579b5599dba913124b56491ba6c63aaf2e9ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420846, "uuid": "ed1ccfdd-7773-4485-bb98-e689f75ea98a", "comment": "Malware payload", "value": "2f35e5f2457d13246dd5826bfe76b87e6cdc3b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420846, "uuid": "38184ade-b25f-4612-867c-76b11b3a89c7", "comment": "Malware payload", "value": "913513c9388b403564835e0b864bde339984282b10d0880eedf8ac167f3068da2082b688632c8e9bf29cf8534f2c56b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420846, "uuid": "d042f2fa-6f29-433a-bf12-59cbe9b6b81a", "value": "T18C26F1320572BCFD8B5C389194011B452CED5C27635ADFBCFA4414EF29A1738AA7B9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420846, "uuid": "ba33cd06-1b12-45cb-afdb-694664bbb975", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhL:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420846, "uuid": "9b35c67e-565c-451e-b208-1ccb17aab09d", "value": 4459831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420846, "uuid": "d41d043a-8de8-427e-8557-09194b188969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420846, "uuid": "62f52211-666e-49c3-9acd-61e320e167f4", "value": "da598f4ccd4dcef6df3dec3b9e70fbf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e7fdf-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420879, "uuid": "f00431c7-5501-4fa9-b8b8-df53fc155c64", "comment": "Malware payload", "value": "48df7d6f564bd25b755b797b31d81338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420879, "uuid": "ea916fb1-a4ea-4c2a-8a60-04a2b9d43526", "comment": "Malware payload", "value": "680fefdbe11a969bd5c2189ec8fbdd7e60713592af516557bc5e62585766cdc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420879, "uuid": "754a24bc-32d6-45fc-b8a8-a540f6d5a5f1", "comment": "Malware payload", "value": "2e5d8fe86a5e54a36aa6a797dd5db6fd9506f4ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420879, "uuid": "cdc64b23-6b92-4420-8ebf-4a9b01c2130f", "comment": "Malware payload", "value": "3c5224cff1da1c86145205be1b161b9ad0952a83262a101e30da8b26f5f17450cc1c82d200e30b9b8672d20c6a9da5b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420879, "uuid": "b1dfe2cb-b843-4ec3-8abe-7fab6f6c4df2", "value": "T1DA4601320536BDFE876C389094052B452CED5C275349DFACFA4414EF29A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420879, "uuid": "e4cd1ae0-8249-4381-b9d6-7fd39cc71aaf", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka64:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420879, "uuid": "51f85477-ad70-4d0d-9546-d1b3b4876e5b", "value": 5545247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420879, "uuid": "4dfec1af-1a35-463a-8c0c-51b0a7d797a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420879, "uuid": "377069d8-e2bd-4d17-b225-b23a0738a597", "value": "48df7d6f564bd25b755b797b31d81338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d440d886-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430267, "uuid": "00834a21-961c-40cc-b864-e4e472aacda9", "comment": "Malware payload", "value": "4c8234afcc757215de797dc464833d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430267, "uuid": "7b983c53-823f-437b-87e7-2dbc21d35b8c", "comment": "Malware payload", "value": "689237d2f44033680730daca65da6e0e40c943bfb612c8cecce0ad77177aaac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430267, "uuid": "e4d97fa0-6d71-45fc-a81c-e11737670843", "comment": "Malware payload", "value": "06a0f0550c727596d6523b8949fe4b7c003cdfc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430267, "uuid": "05d58564-729d-4781-b104-d2a4be49b150", "comment": "Malware payload", "value": "4ebae0c4bc5883e0d0c47b7bea95dfdd120d25e52b23ce2e2aa24e13e880c865ad3d1606bb06bde8fd2b13719a52c4de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430267, "uuid": "eb14bc98-3457-4aac-a3e0-f38c1bdc7f9a", "value": "T19A4601320532BDFE876C389494051B452CED58276349DFACFA4414EF29A1738EA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430267, "uuid": "4d73ebb7-e07f-4422-9acc-1e1436a87204", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75kf:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430267, "uuid": "d90542c1-d067-4158-8949-abb1de6cf717", "value": 5371747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430267, "uuid": "b24d1154-b6da-4d82-937b-0fbf28e14966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430267, "uuid": "91a96023-956c-4fc3-94e7-76268a32bfb4", "value": "4c8234afcc757215de797dc464833d9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749850d5-10bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687412497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412497, "uuid": "4daa45ae-377f-4c40-b4d6-f09a52a13394", "comment": "Malware payload", "value": "f7d6bd06f96439787aa170983ab55c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412497, "uuid": "9a94ed75-acbe-4e77-800f-6aebfad17935", "comment": "Malware payload", "value": "69a695a22c366f9ccdbcb42e6654834bbecef41cda7f9cd2d81d21912fcd0a1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412497, "uuid": "917c588c-deb0-4d50-b0f3-eab8a5323cf9", "comment": "Malware payload", "value": "ed74e29748c586137a3be7c6a519687fb64767bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412497, "uuid": "63d807ee-e12a-4f11-9b74-ece5e4f4ad5c", "comment": "Malware payload", "value": "ff73a0a1b43843beca609701664146b0e334a5ed1599ab134f38b999db21423fa951bc474a3c21e57928d4f3bbf5e789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412497, "uuid": "ceb8f834-4991-427f-adf7-5f2c7374672a", "value": "T13A847B0335D9BCB2C13155343BB79BE5C72DFD100A69D96FABC41A694A3C283B522BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412497, "uuid": "47506562-f052-4711-987a-34f2b0791b81", "value": "59205d17118cd7f4c84a50e8810865e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412497, "uuid": "208bbd31-5e60-43a6-8f4d-7ddc585293c1", "value": "6144:q0FPy3bQeuMyxK2hGFgAObpOXFVrZLqaZ3A8ihSxfw+o7Rpybm:qV3GdGFgliX5+JUq+eAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687412497, "uuid": "383e79ad-1fff-45dc-a6d2-b647c899d37b", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687412497, "uuid": "cec75edf-dd65-4b2a-97e5-abac670186df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412497, "uuid": "123bdfa5-81f5-43d0-9b4f-6408c824a06c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d267e0c5-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420385, "uuid": "3fa3458b-2d66-434b-8d13-791cde5c7713", "comment": "Malware payload", "value": "fc39354222762d93a3be5202e9ac8274", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420385, "uuid": "e7688ac6-d49f-45a4-88c8-61d8bfe91426", "comment": "Malware payload", "value": "6aaa14e55fb909ecabd62230f3c7c060ca33c0f4b2ac63be1fcec81b40fdfb36", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420385, "uuid": "411128ff-f7d0-47dc-82f1-da80939adee4", "comment": "Malware payload", "value": "07441cba16c9fe4cd7f029f56876344c42ef0340", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420385, "uuid": "7fccba8e-0a7f-45a7-b7a3-52de6a986aa5", "comment": "Malware payload", "value": "cbea2e885df3c5f8c69c9a8c19421b8fe1f0177a753b8bd2c5c377a03e54971c4427712a82d6d574a174ef670fada91b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420385, "uuid": "e26011fa-4694-46b2-a01b-8a7ed42b5179", "value": "T16ED3C6B0081E9E1F835D1E49E7A86C1F74D404E3AC3A50A9D5DB178BBB0DEE2D17B924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420385, "uuid": "0471b4c5-0ced-432a-8238-7ba7937c8c82", "value": "1536:BlbZJ63O9WoOT2OZ4y/6pvjlo1bmEc9XxvlSP3:BdZoCzPj9B9q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420385, "uuid": "5651a12b-d4b2-46dd-bece-4ad215c4fb3f", "value": 138564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420385, "uuid": "5a384e1c-bdc4-49fa-8076-59e96e338cc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420385, "uuid": "0d34840f-9199-4fee-b88d-a689bbe26874", "value": "informacje_dla_odbiorcy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b83742-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420956, "uuid": "b0186e16-4ca1-4f11-8fbd-a6c14a931970", "comment": "Malware payload", "value": "407c42af2dd7b1eedcea3a786d91bd6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420956, "uuid": "0d5302e2-f7cb-4dac-bdca-48c97b3f9c92", "comment": "Malware payload", "value": "6ab3d6d5581611dc2b94bc090c6af407eaf6d90ff6e2c7ac5db0c2ac32846e45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420956, "uuid": "9be4e892-af41-402c-b405-304945f523a2", "comment": "Malware payload", "value": "3ffe50fa160a33d763b57eb4cc191d649bc1b503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420956, "uuid": "f44fbec5-06df-4fc7-9fd7-2ccbea6bd71d", "comment": "Malware payload", "value": "6943a655cbe22ce589ed23354de950d0b0d7e8188f426ba57ac9ccff498138f92f2aaffed3b8d02f8a4cb5882a502911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420956, "uuid": "d8092eac-ec7a-489f-90e2-5e5244d09c01", "value": "T115B37D2421D2C0B6D45240FB812587376AB6787D1A2A7DCB4BC7D8B02F386E7D736396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420956, "uuid": "2785b843-56d9-48a8-ac60-4d75cbe8c823", "value": "1536:BwL42hI3IetDA3F39dOPD4IyuKUc7H8LiYHOv3YHV2m6:BwL4mOIet+uPNyOLiQC3YEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420956, "uuid": "6450f358-5d5c-42ce-891f-95b81d3bad05", "value": 114668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420956, "uuid": "1a0f16a2-4d87-4d29-b36c-03590ce3a0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420956, "uuid": "f1447502-4447-4012-99e9-14bc763c7488", "value": "407c42af2dd7b1eedcea3a786d91bd6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e873a117-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422570, "uuid": "ff2fc320-bf63-4ba1-8be0-df34817628ec", "comment": "Malware payload (Mirai)", "value": "a2ec947f408be9c4bda261677058ba92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422570, "uuid": "fcccd543-0ea7-415c-ac88-5f48483169da", "comment": "Malware payload (Mirai)", "value": "6bc1eba6a650cad343613157ba3cc867209cefd1978edf6ced8d6f8bd260f950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422570, "uuid": "65f1161c-e0f4-44a5-aec9-b5e16c0bcede", "comment": "Malware payload (Mirai)", "value": "0f068260dac04ebaa4bb6e3538ae948f95ec5a86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422570, "uuid": "f1964c8d-b6e0-4dcf-8263-cb965cc9eb79", "comment": "Malware payload (Mirai)", "value": "047f0571f5bf3cc0aaf6dbd732a06ae4a26373b0e53e84f8a836993683ba9517432ec4ecaf76bafbce83f05582acc83b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422570, "uuid": "b960d5a4-0500-40d5-bfb8-39eb5467656f", "value": "T1E0333A42B22C4E4BF9E61EB0353F1FE083BFE99420F0B584694EEB458535E761086F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422570, "uuid": "4f0a1788-d9de-4741-893e-0e9c8ada95f7", "value": "768:1iGBQ9j21i0M+KClRpqhGLka6NtybaEuVwk6l8jbo1OAMU/:P0j21i0Mp6kGIbyNuGlkAF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422570, "uuid": "64234fc4-8c72-4d81-aaeb-ebb5fa16d62b", "value": 50588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422570, "uuid": "d1f66510-2b2a-403f-8473-6a0653dbfd22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422570, "uuid": "922dac06-5ad8-4f43-a88c-fba370ba925d", "value": "a2ec947f408be9c4bda261677058ba92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15505d0d-1101-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687440684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440684, "uuid": "4cbfed63-c13c-4cf3-afb2-a0c8945b5df8", "comment": "Malware payload (AveMariaRAT)", "value": "706f4b329e2a70c84c4bebd98d30192d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440684, "uuid": "fca53a3c-d639-4297-b350-cca14a750a8c", "comment": "Malware payload (AveMariaRAT)", "value": "6bf422a52745c2b43d590030293b30a0a2270650e409ad93738dd5e68fe80321", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440684, "uuid": "759a3dfb-a712-4368-9b05-0037ffe2c159", "comment": "Malware payload (AveMariaRAT)", "value": "9fa45f01ea9c4aa90b20eba480901e5b03b8f3e7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440684, "uuid": "338d2cfe-33a9-4cfa-9161-5ae822c65803", "comment": "Malware payload (AveMariaRAT)", "value": "0040a80349107558c1e811a33665eac61f6a53e27d854304ecf8b45003ca8a33c0c1bdbc6d51593902b8014b43b74375", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440684, "uuid": "260d7df8-74af-4993-b1f2-a743c075bf54", "value": "T14CD4120A733E471AD9B787F9A2A2127103776E5B7622D32E0DD3B0EE5A17B050111EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440684, "uuid": "afc8c311-70eb-4944-a3ca-432806effc4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440684, "uuid": "ffc90cc1-61e4-4274-b120-24ef9991e8cc", "value": "12288:bxpdvDhH62MmgPF+dp8fcsfAQ9wzRqJX2elRyiMYR7ELzmgYcT8T/iEuhK7L5:PdvDcAwA80ctLXJryjNv+cT8T/ZL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440684, "uuid": "e70491a5-f967-4038-a12c-dc94c7a3c3ab", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440684, "uuid": "d2bddb07-2abe-4739-9b4b-73986adf1fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440684, "uuid": "bbba07ca-01e7-40dc-8d6e-7439848ec929", "value": "SecuriteInfo.com.Trojan.GenericKD.67670379.12729.18214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad3c260-10e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687429902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687429902, "uuid": "ab68ae11-e470-4f8b-a12b-702d271df706", "comment": "Malware payload (Rhadamanthys)", "value": "57dbed98db437395ecd9d3920f7b72bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687429902, "uuid": "7e13c06d-477b-476f-9012-4fc475b84ee0", "comment": "Malware payload (Rhadamanthys)", "value": "6bf641eddeb9ab3ed92ffa13b97fc2377ede44827ee718480a4561c536713599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687429902, "uuid": "8a7de656-1897-42cc-9a73-4268643d1496", "comment": "Malware payload (Rhadamanthys)", "value": "e6516c620605e901b0277a73c9fb049501f96dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687429902, "uuid": "3954f1e9-3cc5-42a8-aff1-18bc366a91df", "comment": "Malware payload (Rhadamanthys)", "value": "e56fa484f6b5121a0effcfd5d5513d2ddcf6a30c82495fca6384504acf6cb776b84f53034ef33c3af7a92e4951122db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687429902, "uuid": "a6553fd4-1ea2-4aab-bc69-fd629f52a59e", "value": "T19C544B65BBF5AD84CE9D33B3C8146BA4069E077646F2E3C84D285952273F6A5CB0B13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687429902, "uuid": "a44f603b-92f5-4635-8a22-8e737a0bf4d1", "value": "6144:L/E8DIpjK28t4snQxlp3z/pSZ+pDKpf9EkQz:dEpj7snqv/cgu4Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687429902, "uuid": "49301816-1d4d-4a43-96aa-7557215874dd", "value": 304398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687429902, "uuid": "ea755365-e373-4436-ae1e-d0832c7a2138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687429902, "uuid": "3b578ece-94ce-4a3b-9e02-8c01dd140218", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d10f2b-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687430348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430348, "uuid": "0b8e2dbf-79ae-476d-a5d8-64dfdcd4ca9e", "comment": "Malware payload (Formbook)", "value": "c4ee1e364de3536ec7ac2ad0ee252897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430348, "uuid": "8142779c-043e-46aa-a358-eed4a2a6a780", "comment": "Malware payload (Formbook)", "value": "6f7c3c3907e06bd00c89d34c81871f4d667139ad7001490942eaacaaa1925327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430348, "uuid": "7dfa3ac2-1208-4691-aa9c-b768eaf35260", "comment": "Malware payload (Formbook)", "value": "29a461cd8b95a0323e101bc7846a41551ba9e91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430348, "uuid": "f0376393-497c-41f1-95e7-987a0c2433cb", "comment": "Malware payload (Formbook)", "value": "3b4a2050be44e153d05aee39cfa4f5f86dc457e3dda532c0309907187a3c7a71256652635d174677e762ceb428c9c12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430348, "uuid": "39681813-48fa-4d6c-bfb2-ad057cd066df", "value": "T107E42209322F0B25DBA74BF025926730437F6E2D7436D71A8C83F0DA9566F2A1692F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430348, "uuid": "80b92399-76a9-4cca-b1fd-0127ee93732d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430348, "uuid": "31339259-e2bd-4fda-9b74-8313c652b0bb", "value": "12288:hpdvDhH62MmgPFD8GGKR+hhd4wcT6smRLp3GkeV/T9XXbrfgx43FxC:DdvDcAw1G0+7OThULp329XbL04XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430348, "uuid": "f23ad643-245a-4220-a271-21306908962f", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430348, "uuid": "e88dd70a-7b05-4f8f-a639-e3ad566a5757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430348, "uuid": "edd3e65c-0da5-435b-9129-67ad3769c0f9", "value": "c4ee1e364de3536ec7ac2ad0ee252897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044871e8-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422617, "uuid": "e2cd98e8-d14d-458a-98cc-2bc9e0af887f", "comment": "Malware payload (Mirai)", "value": "bb1cd743d680c3e6c3d33b4af989cd45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422617, "uuid": "da3e1682-f53b-46a2-9288-a270a6b6641d", "comment": "Malware payload (Mirai)", "value": "6fa154d9d7642f7381373bfc64fbd8c22419dd1e25a5d94f3d88508110135ede", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422617, "uuid": "8a6b2827-6062-43f0-baac-6be658cdd952", "comment": "Malware payload (Mirai)", "value": "668698540207f34247f6f2e6675041d36fc9a6ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422617, "uuid": "a7f3558d-f70b-4ce7-ada3-803ee26485d2", "comment": "Malware payload (Mirai)", "value": "aeb3ce291b2c84d70dfd9308252ca5f5c04f37223b7b7c0d52487586c0e39b447ba0d159a89f56a3a69276e80e273b31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422617, "uuid": "a5912d7c-2375-4347-83e7-472acf61485a", "value": "T1B3332ADAF5029E7DF88FD6BA80674E09F631221040830B267777FDD37E321949A52E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422617, "uuid": "0e2de951-ee27-4a32-9dc9-672fdbf201b3", "value": "768:HaeKdnuq3yaHFpeLZMpyeTLRDYuR7mwGJRytw9hDdEY8muu:6fdn33y++zuBmBRytwzDd98Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422617, "uuid": "38cb2ec3-021c-4b0c-b86e-712611d362ef", "value": 51956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422617, "uuid": "1cc49bce-6ce2-4a76-96eb-d87c4877ee3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422617, "uuid": "bb7333d8-b833-4ebb-8534-af7a530d7621", "value": "bb1cd743d680c3e6c3d33b4af989cd45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f1b1b4-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687455322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455322, "uuid": "de9b8107-e238-47d0-8007-738a1de1789e", "comment": "Malware payload (RedLineStealer)", "value": "c6328ea6779ff08d7bc60106c0204f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455322, "uuid": "f1ae9f9b-452a-4134-8975-15b4c2f7f977", "comment": "Malware payload (RedLineStealer)", "value": "6fc2953d20ba9cf2d509eeb08544f7b36f2578d2560af2e71dc2fc6a7f82bb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455322, "uuid": "a3cf373c-b3b5-4ffa-9aee-4984528f9d81", "comment": "Malware payload (RedLineStealer)", "value": "d535386da63078ba002168fcec83413d2b6f71a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455322, "uuid": "7f92becb-17ef-46f9-8993-da93db42bfe8", "comment": "Malware payload (RedLineStealer)", "value": "d6143f49d31928419c47199d89d999adea295ce0d8916f5ae4aab12e34b32e60ace3dd6b49c32c3c8dee8102fc5e4b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455322, "uuid": "450bbd46-f234-4d01-bef3-338685523eee", "value": "T1C1B4F1CA29408973CF63CAF2D4EFE9DA4F7A71210B614BC3130D49F64A516E4E21B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455322, "uuid": "a8b1bdeb-21ab-481d-b958-919372e10084", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455322, "uuid": "100b6b9f-57ac-48f0-9003-e462f54b29c4", "value": "12288:AIDzZTey5sssUSo4iREO5bqM3YSU3iaCYTDQJQmZ:AIDVTey5snTo4iCp3ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455322, "uuid": "8f852a1d-8a7e-4bf1-ab52-e3b596e49fe3", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455322, "uuid": "6c83db66-bdd3-4268-bc4e-1e4d33b6c5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455322, "uuid": "ef74d7a7-aec3-4f04-a68f-f13d66547edd", "value": "c6328ea6779ff08d7bc60106c0204f8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e556b59-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1687442873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442873, "uuid": "87eadd7c-2192-4439-a08f-2251b09fc47d", "comment": "Malware payload (DCRat)", "value": "90000217ea0ebc7c640a0e691ee084c7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442873, "uuid": "494448e3-d9f0-47a2-935a-da9b63994e12", "comment": "Malware payload (DCRat)", "value": "70744eef387ff76c00d2ba765db77acbeefd04e774eb89710b68f8623d828a08", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442873, "uuid": "97889a48-dc82-4329-b2c0-a801ea3a6d72", "comment": "Malware payload (DCRat)", "value": "050beb0b16eea66d23b966685b0b077f593e3166", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442873, "uuid": "feca6c19-3701-411a-8d52-8750c6c97ff0", "comment": "Malware payload (DCRat)", "value": "eb8b0be2561e0f05aace085dea8fdbf96a28e2d06eff195c463aa04f3964f67966593191a6aacab7be436d8ec39f6ee0", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442873, "uuid": "8d4cff9f-f398-4294-8326-59665f4d9284", "value": "T1B9E5AEF8D06F40D2EC076EC468287AD3073176B3CEE90424376E7A488F7BDA95549E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442873, "uuid": "c4963063-5f46-4616-ace1-179a1f463fb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442873, "uuid": "df478e8e-590e-4ca9-99b3-ea111dc2496f", "value": "24576:Usz/7R+L7zF67wHasGvncaewULmhM95DL9Jc8aF/RgMFtDKfocm+VU3HHU:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442873, "uuid": "c334ec63-817b-4d5c-9c27-ced36a1071b2", "value": 3130880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442873, "uuid": "679b3f3d-c28b-4ff0-b90a-73f2037b8a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442873, "uuid": "7656bda3-9bb7-480d-8342-6e1ce33b729e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a3f195-1122-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687455128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455128, "uuid": "ca94cd3f-5586-4a65-8c81-1e1b28c599f6", "comment": "Malware payload (AgentTesla)", "value": "ea8ef96952b61210004b45e0b4fcfb84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455128, "uuid": "78506afd-100d-4efc-a367-78a0fd32304f", "comment": "Malware payload (AgentTesla)", "value": "70c499252627effa5dccc94f8cb4a7c160455ce1bc0121ba12b4d20e79f543e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455128, "uuid": "1bb7c60a-9597-4b38-9b3e-e9d48aa01801", "comment": "Malware payload (AgentTesla)", "value": "62df7182a00b1c425cd87195c4f2a19dea2583ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455128, "uuid": "682e51e6-f24b-42ee-ab55-63340722c09a", "comment": "Malware payload (AgentTesla)", "value": "606f714c9daf5322f47de63c0346f74e9667d8f4d1034acf4e15d97219fc3e4da5d5b86a3a1937e87ca5f635c37f054e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455128, "uuid": "bbef75cd-e3db-4e3a-9f64-a56d79b9dc40", "value": "T1D53523AD12F69202CA630BB4685567B047FB9C4EF125C8470E8732CEDA6BAD55A7C703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455128, "uuid": "090cf949-0a75-4812-95a0-8c2889e0c62d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455128, "uuid": "85e4e22d-c53a-497b-97ae-49169b9c238f", "value": "24576:Y1KNoT1Fn1XWOa7RXHM9rdsIg4QoxEDF6ySoNAAhNds:Y1KNoTXn1Xna7RXkd/LQoxED/SURhNds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455128, "uuid": "6ca17e3f-80bc-4c5a-888a-78b668e67dae", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455128, "uuid": "d075daf5-eeb1-4974-b66f-15c3fa78363d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455128, "uuid": "4a7aaeb4-8829-4fe7-8bae-912511f23ad5", "value": "PURCHASE ORDER (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae46446-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687456800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456800, "uuid": "646a37d2-81ef-43f7-a514-a0dfc8653f1a", "comment": "Malware payload", "value": "7cf4182db87387d8cc856324e0d6129e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456800, "uuid": "021290dc-269b-4aa8-88f4-f38269cdd3ff", "comment": "Malware payload", "value": "70fed089cabe70e9ae9cd11f13054811e5995348a7d01292ad62cb0eb45ccd31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456800, "uuid": "05bb9591-2c02-4886-935b-a90522bc154a", "comment": "Malware payload", "value": "26072cb9a35ebfb90d37803b3e2948dc1489bf9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456800, "uuid": "f8d17285-f864-439f-b28b-02f39cd5cb09", "comment": "Malware payload", "value": "e35fef6221ffd7e5608cbd5a7e2b87650708fb166ef41bb4e747b770e4cb73522a19c4844f03ea92f59ce86dd594b909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456800, "uuid": "6edac2b8-6d8d-41bd-9e7b-ed8951caed79", "value": "T17C15010075C08872ED6301335EFC9DB8576DBA520B6526FB13D85EBE8FE52E2E632911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456800, "uuid": "ef6677bd-1fc9-4dd2-bc35-89df30d71855", "value": "0330cb8599ebc8e2472474ca94c4c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456800, "uuid": "bada3dfd-b730-46fa-b74d-00f2b826df1a", "value": "24576:M4lu+hE3lmon4E4itbXyXulV6TS3jhlRTp:Tlu+W3IC4UbQulV6TsFlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456800, "uuid": "435a3383-099a-493d-99cc-e47f3658ad90", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456800, "uuid": "4cd5110d-8549-4b79-a309-e3d0bf728c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456800, "uuid": "ef8b7932-fad8-4331-9c87-b3db1b3d1238", "value": "7cf4182db87387d8cc856324e0d6129e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4653a4a-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687419127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419127, "uuid": "1ffb6876-db34-4557-80aa-888f822fce5a", "comment": "Malware payload", "value": "e759db6126f61826725fecf18207dfb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419127, "uuid": "aa4cf136-97ff-4787-b625-d0683aec51b4", "comment": "Malware payload", "value": "71b83a4a645cee8038819ee490a2b6324d287d8aac405adb1b373277dc5c23ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419127, "uuid": "2cf3c71a-37af-484a-a357-20fc35bbd321", "comment": "Malware payload", "value": "f572ca3d4493402f258682b3a7515041934f1dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419127, "uuid": "317cd45a-d447-4010-8104-f66231315fdb", "comment": "Malware payload", "value": "ee29c30eefe18c915b01e70b27d0d8a300a31ae83043fc68310c4bb352a79e841026fb0a3d802d37186bde0f0a25dcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419127, "uuid": "14baa1ca-3b6f-4f41-a321-ca7002016b2c", "value": "T1E5924E1BA7B48367CC8E867A9C6213804235F3BEA707A73A07C7695739723745B417A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419127, "uuid": "80eb0250-2449-4cd4-ac85-ee8ea123e158", "value": "384:MCeGFrWCNoJW+TUXFbAGsCBOr4BP6a2CP19LvNDebHzXZSmiaCu3jFfixNyly+:vw0D+TiBAeUCzuHpiadTxi2k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419127, "uuid": "88b0b2bd-7cc3-49d0-aad6-040f3566b142", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419127, "uuid": "63a0b55d-5a71-4436-9d1c-e50ff6967faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419127, "uuid": "6616ae77-1def-4b9a-a472-281f98bedf5c", "value": "e759db6126f61826725fecf18207dfb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77163f4a-1094-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687394033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394033, "uuid": "491bb469-962a-4915-9e1b-74f52459c1b6", "comment": "Malware payload (CoinMiner)", "value": "1741f83aee5e1e08ec009f13f6e5e6fd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394033, "uuid": "d29bef81-4b06-47a5-b4a0-6998402733b4", "comment": "Malware payload (CoinMiner)", "value": "729e05d421b393fa6a856a81da96ca38806e05b32f0276e7dceaef03b586abc4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394033, "uuid": "912e04b1-d517-42f0-9ea1-4c0c03523c6f", "comment": "Malware payload (CoinMiner)", "value": "e7c8f5514bda7aacfe7d318503370e1b138fca69", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394033, "uuid": "82991a0b-1a75-442e-87a1-f201f62f4545", "comment": "Malware payload (CoinMiner)", "value": "5f6c470f3e141cb6cac56337649e5d43c23c1504b0a2e89228399b69dfa5f4d5dde8042a9f57ad58eecf2e1d70291073", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394033, "uuid": "b06bb191-061e-422d-8cdd-880e90aa1844", "value": "T1F0A622BA2980F37CC41A88305123FDF575B11E2A0679516AB1EE7AC63FBE440971FB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394033, "uuid": "55c638ad-c2be-4788-99ec-c95a1e07e037", "value": "3107a962ef642e38a608fcb339f56d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394033, "uuid": "35a28aff-a7a7-4672-88ce-4bd79d7e71a8", "value": "196608:/z77PZKcmYu/f9xKWGpcR5lx1RbqSlQ1DEoXdEGE:/P7PYcm7fdGpcFAS61DPuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687394033, "uuid": "1a479bb3-bcdb-460b-bd91-4a82167875ce", "value": 9538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687394033, "uuid": "81ddd1c2-1f7e-47c8-881c-3b844f62b9b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394033, "uuid": "4c74d71a-b1af-4f4c-81f9-22195a756236", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfb8c0e-10cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687418121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418121, "uuid": "e305c235-1c94-487b-95a7-538251488e28", "comment": "Malware payload (AgentTesla)", "value": "7b365f53fa7c9195d7a2e1b4c07ca5d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418121, "uuid": "22cc81e1-f83d-437a-9196-4bdf1b93b12c", "comment": "Malware payload (AgentTesla)", "value": "734adbdc6a1aeb78aa81e7cb2d2c8b17baeb7efb85c33a513516a03d3b2c8c31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418121, "uuid": "40495699-1408-4df8-9cab-ddeb80302e07", "comment": "Malware payload (AgentTesla)", "value": "24ecc397199e31fa6d68303a0163ec5bcae05582", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418121, "uuid": "d4f35d34-eb93-49aa-a27d-5f2801e363fb", "comment": "Malware payload (AgentTesla)", "value": "90837db82ba1a9f80f95cb6e232b9feeb493a6c4853f0d5daace03a3d308029d8c7c28729ce094993fa322d19c5f9fce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418121, "uuid": "920e494b-0a45-45c0-b41d-5d04823fae90", "value": "T1A7327C3649E82CEFD31A70B581A51324F2A432C3562A9D0BFA30FA65D5732CE9B003DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418121, "uuid": "adcb866d-c3a6-4e7f-9c53-aca9904e4fc7", "value": "192:Lya0N3QuCWBARgZVPCK44AG9xXSJ+Ej7JJYjKw6KFY1WYDcWeRm:LyX3QuCWBANK4499xXSJf7JJYjrrYD4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418121, "uuid": "5ff1a7d8-24bd-4a8c-923d-8aea9e3ed300", "value": 11083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418121, "uuid": "6b06bbfe-2ae7-4d24-b5ea-48826f470b77", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418121, "uuid": "cc400b81-f54b-48c1-967a-cd5a0872d739", "value": "New Order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4da901-1104-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687441962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441962, "uuid": "1de9c5a4-307d-4d97-8bda-6df7455483a8", "comment": "Malware payload (AgentTesla)", "value": "076569d51c616ec2446a2e6b85205764", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441962, "uuid": "86f9d45b-3556-4f69-9d2f-ed492d0606a4", "comment": "Malware payload (AgentTesla)", "value": "754794ccb5c349adb0551759cc1cd6add14616a50b5b3ffe1b4c0d133d13f300", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441962, "uuid": "02e78122-dab0-4bda-9643-53df13a4baf4", "comment": "Malware payload (AgentTesla)", "value": "e66ed4fd01550e7fef7fe4b6b4d57aaaf1109c11", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441962, "uuid": "b09e8c22-93a0-4737-bef0-53c2bd6f8221", "comment": "Malware payload (AgentTesla)", "value": "f7fc5ad0285561c4c12d2595ecddf1fa59eaa7b6fa4a0b4052c65cbeb846a17d2ed4667ca6b9f341e67f9d1acc426301", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441962, "uuid": "b1b9ac68-9a72-4289-96cb-46d4516aa10d", "value": "T10C823C1A63DC4236EC9E8779D862334003B6F3BA6B03AB2647CA65652C723704B557F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441962, "uuid": "e20a9181-7291-4c68-901d-dc5af3805e5e", "value": "384:GWeOtTbX4sJStS77uBLbt+B6a2CaneFrmbSEM1+TAVDxfEHufIJzJf:HetAidANFAA36uwJzJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687441962, "uuid": "b7949168-dcbf-4342-824b-69c1094a5310", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687441962, "uuid": "aaefe058-d4b8-48a9-af20-ca611cbc36a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441962, "uuid": "684a7005-61f7-44f7-8c2c-f4e9a55e18fd", "value": "076569d51c616ec2446a2e6b85205764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf89b681-10fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687438822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438822, "uuid": "cadc52f9-7250-4661-a4c1-f6f940be492b", "comment": "Malware payload (Loki)", "value": "a1c8e685ac3732d0afbd076395bc7bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438822, "uuid": "de21fed5-eca3-4b12-9434-a9f114cd34b5", "comment": "Malware payload (Loki)", "value": "7869eaa2867398aa71fbfc6baca7a8079644a77f0493b8ded9865e6941a49cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438822, "uuid": "a2e3e145-8bf4-4955-a967-faa606b364a5", "comment": "Malware payload (Loki)", "value": "e2ba4fd0b86539b76b459adf80be6b41727f5c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687438822, "uuid": "b36dfa31-ac01-4073-bb0c-e4de00ea08d8", "comment": "Malware payload (Loki)", "value": "d6c8fce7dad5f0330afa7659ae231355fa7ed8dee1db562624d8d887ffb757d4785d404972f12b7c9c0f69ca7da779aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438822, "uuid": "4fb0903c-9f32-43d8-8618-cffccfc8062e", "value": "T15AD41254776D0047C55B5BFD097012B1437AB9EAB662D3DF0DEA72EE82E2B410A10F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438822, "uuid": "a259b670-3c23-4c1e-818d-b4aaf3b164d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438822, "uuid": "2e91a8ea-7fe0-4045-ab78-2683c867786b", "value": "12288:GsXpM1JCIQfNsVcuoQH00su8JHJUu11rWKQDUsWwg+PrEso8X:E1KNo4RJUu11ZQ2wRPr7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687438822, "uuid": "b570cd78-2564-422b-bc24-189e857645dc", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687438822, "uuid": "c10394c2-da5e-436b-86a8-6800e98732ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687438822, "uuid": "57e4fc5e-967f-4385-9e19-0f3f67b42fa0", "value": "Kp4U9PztZQxAwfF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de19aabb-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420835, "uuid": "191b355b-878a-45fc-9beb-2ab5b543709c", "comment": "Malware payload", "value": "6bf18964781d04b0f440560f1492b744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420835, "uuid": "9711848f-193c-437f-af9f-268738a0557f", "comment": "Malware payload", "value": "792d326e81940d6cd403f4daf72e73e8a9e9534ca477df75e1615d65dc948f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420835, "uuid": "3864d7c2-f04e-444f-90bb-990b27717561", "comment": "Malware payload", "value": "034eab17375daeac6ef5213123d9f71a8e0dc45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420835, "uuid": "488b2555-1683-46c4-9faf-905bba6b8971", "comment": "Malware payload", "value": "f07b43e5a3286087c8b194cebb9f681b66bfbe3d0d3eecce2fde99a151e8c9244b175d6d058b8c05ff95600e81ae7ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420835, "uuid": "8a825ebd-bc2b-4449-b8a0-f27f4f4f7afc", "value": "T1F1C5E857E8A580F8C1EED164C726E213BD613489473437E36FA18AF11B26FE4A6BD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420835, "uuid": "f1e40c63-6d91-4aa1-b38a-479aeb266858", "value": "49152:6winh45T6YYdrsYArb/T/vO90d7HjmAFd4A64nsfJoMatRQlCsO9kZ2wYYSkufHh:TClrUORM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420835, "uuid": "e2dc4e4f-a5f6-4c9d-b0de-264f084c6d31", "value": 2656362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420835, "uuid": "5c384850-5e67-4a23-bb26-51af86eb7ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420835, "uuid": "c955a400-cffe-4e0e-8321-da3274b5bfb2", "value": "6bf18964781d04b0f440560f1492b744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74241595-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420227, "uuid": "3ef2d9a3-d2e5-4c57-91db-7fde853d20fe", "comment": "Malware payload (AgentTesla)", "value": "f48ee32c2c7b9efa67d054cb053511ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420227, "uuid": "42fd7f80-eb9f-4532-b514-a9c2e4ba6dbc", "comment": "Malware payload (AgentTesla)", "value": "7b33cef6985044ba1c2bb99a9ff0f4988424c8e8b4a40dacccc22f0dc19fe3ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420227, "uuid": "44dcd4ee-3a6e-4a0a-a0c6-3f0b0bab8b94", "comment": "Malware payload (AgentTesla)", "value": "4958dd0c44d1b6325d702f9228eb1f67a5f435c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420227, "uuid": "86809b54-7c20-4803-abc6-d8b82ab7ffe8", "comment": "Malware payload (AgentTesla)", "value": "1f6c2b790a70c335408963db0b5a358b370529e19c4152f9df7f6a837a9d3a4b3cad209bc64284317d4d5068d974edce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420227, "uuid": "35c8a1fd-4eb2-410e-b55d-582a82a4efcc", "value": "T1E505334F322410CAA5ED4C30ED2F52F1453E67D352CB3B596AB1BF484E69879B62B6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420227, "uuid": "c3b73580-6a9f-4720-8ee2-5d823a763066", "value": "24576:PqX7RsDKZvvlDswVCN3dB1BxvXJPd260xG7xPGH9X:PW7WDKZvvawV6BvnOxGIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420227, "uuid": "423619c2-b904-4377-8098-6fd15d4b8cb0", "value": 834614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420227, "uuid": "154a420f-c8ae-4d99-9987-6f636f3eabae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420227, "uuid": "15586faf-51ef-48c4-8344-a5b93056c0a8", "value": "DHL Receipt_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cd2ea1-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430355, "uuid": "0727b942-0d2e-4d91-bc8e-4e490cfbc029", "comment": "Malware payload", "value": "e48ea589f526a9247ae48b772e26f7b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430355, "uuid": "5ed8f7f7-3ea6-441d-ad9a-59ba0866236d", "comment": "Malware payload", "value": "7c53ab4cf5f997aa947c4fbadeccbbb7b43eb0eb204f57b446d87ae442d84eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430355, "uuid": "2b37f88b-cb25-4235-add8-28263cb12c51", "comment": "Malware payload", "value": "4ad3330f25c49eb75085b9f9aaee5332796c8c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430355, "uuid": "a77e1cdd-89ea-4388-b259-b8af7f4eed75", "comment": "Malware payload", "value": "977a796a374388ae0b0dc1fc7b4f4f94faac7b08f4bfd15a730ee307c154942a3ff6c2fe9f40f71a2a212e59fb7370b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430355, "uuid": "8e4d9859-7073-40ef-a3b9-f3ee52653889", "value": "T1ED4601320532BDFE876C389094052B452CED5C275359DFACFA4414EF29A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430355, "uuid": "2df9fa10-5787-4e04-80ff-5d5af46d0215", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6o:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430355, "uuid": "9d03aa62-ff2a-469c-a828-8a7672a38302", "value": 5581335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430355, "uuid": "a3eced9f-deaa-4de2-9a9b-5676108ffc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430355, "uuid": "776b2c2f-43eb-452a-bbd1-d098e7bda371", "value": "e48ea589f526a9247ae48b772e26f7b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4113f2-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687419087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419087, "uuid": "d2765725-1fd8-48ba-96ae-d27c8f145a7b", "comment": "Malware payload (GCleaner)", "value": "24bdd2c5c3b058009f563906d4d2cab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419087, "uuid": "670fd815-4269-495a-8d9a-5640366ac753", "comment": "Malware payload (GCleaner)", "value": "7cae2dfda0e760588e774ba63e6fa081dda56f570e2d44df510dd551d0b19818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419087, "uuid": "4ba3f9fc-5879-4e77-bd56-b10a2c41a559", "comment": "Malware payload (GCleaner)", "value": "533ab00026e23768b123d8c61fe6cd2cd41cb5e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419087, "uuid": "c4667014-bdf5-4ccc-8e47-429e0fb30f7a", "comment": "Malware payload (GCleaner)", "value": "24e640199b91135e506f5fbd33362d372a94341bb46121bc8b8492ca52212ad1029023aab6bd4441159197dd07c61197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419087, "uuid": "e40e050b-96e2-4eaf-baf9-4c3cbec87d77", "value": "T14654BF1362E17CB0E9261B318E2ECAE4365EF5108F797BAB125C9A2F09B01F3D572751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419087, "uuid": "c8cde003-53bc-44b5-80b9-9f2aa54c6a3f", "value": "c81a4ec753e654f74c80f5e1c004bd77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419087, "uuid": "5c633843-c7d4-461d-9bb1-8a823bae87e1", "value": "6144:brYXSi8bLXH4pdC4yri05ju3r4f8Yx8KVTX9WViM:b8XStbDgfd74x+4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419087, "uuid": "4d60007e-5d15-41cb-9fea-23523f1d6bf7", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419087, "uuid": "ee38dca4-c631-49d4-8c28-5a5c92294988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419087, "uuid": "04abaf45-ca09-4886-a2bb-358d8f727954", "value": "24bdd2c5c3b058009f563906d4d2cab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfde9b53-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687419093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419093, "uuid": "861bd6bb-03bd-4efc-865f-8085eae94423", "comment": "Malware payload", "value": "67274e089d17fcbdb0a31877d7155622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419093, "uuid": "55504df1-207b-496c-8467-29473f23fbeb", "comment": "Malware payload", "value": "7cc8ef889a24d8be46158ed9525edb3efe4b872709edfe4c565fb562271969ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419093, "uuid": "91e4e5bb-a17d-4025-8b52-8a10c8b99a65", "comment": "Malware payload", "value": "b9dafc265a8bfeaa7eb30a2ba415310235381e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419093, "uuid": "4837ce08-a027-4870-8bf6-edae15404658", "comment": "Malware payload", "value": "8e45f8b7642fa964fe628039040d5d77a7d3f177687a6969ecd000c83826ea4c94e3f6b615a5091da0cdbfe86d183cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419093, "uuid": "a688e9d4-e95f-46f6-b973-b82f165e4fef", "value": "T102C59EE8D06B40D2FC076EC468287AD7073231B3DEE50438276E7A089F7BDA95549E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419093, "uuid": "4e08ff5b-d566-4845-8ab6-2d82841843e0", "value": "24576:jIlK2NYDaYn0o6PuCD65x8HvLtFBqicQT/UC/FVWg/X5YIEYBF1kmXmWLKRa:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419093, "uuid": "c313a8f4-d305-4b4c-ae67-a0d9ead42da4", "value": 2740224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419093, "uuid": "540484bf-cb2d-42dd-8209-0fb55c271a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419093, "uuid": "cdd4cc62-80b7-4527-b6a1-d8f590066227", "value": "67274e089d17fcbdb0a31877d7155622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78295119-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419805, "uuid": "087a8547-e864-4653-bef2-b399744f45e9", "comment": "Malware payload (AgentTesla)", "value": "0933c97ed539248878bb7fd1421626ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419805, "uuid": "be1a3852-5d4f-4215-bb9e-0812308b41c8", "comment": "Malware payload (AgentTesla)", "value": "7d57b6d9aa8435f5d10f3cf672b44e7420334916739938cdfe589de6a3a28d90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419805, "uuid": "38ff2c48-acc7-47b1-9b53-358aa2d23447", "comment": "Malware payload (AgentTesla)", "value": "b7001f5092556b185cab4c1d512812139843a6c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419805, "uuid": "5165139b-ecee-435f-8ea3-e06f8e82d75c", "comment": "Malware payload (AgentTesla)", "value": "03d5ed099dae6d6c43f1be7af1af01aa22a58b180b8fa1e2b84fe819dda099f834c057843c2089484818fd0e3639fda9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419805, "uuid": "563b6700-d5de-4886-9eea-a2ff650d407a", "value": "T108C4230E711274CF8F3777B7E8A73710C2AA0A3D67296A81661E0193858D9DE528C77E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419805, "uuid": "be0dc4e9-6729-4657-8be6-41ce7c4ce928", "value": "12288:Bnew9kAW39nh/u3XiFp/5QHHs2AkXIqFmZu7:BvW39tu3SFpBaHs2AoFmZu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419805, "uuid": "00d7b05e-747e-4902-92d3-7c63aa53ccf0", "value": 579642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419805, "uuid": "b0a74274-c4bd-48e1-a406-b3db09575137", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419805, "uuid": "224828c2-339b-4469-a392-74a265e8b420", "value": "quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8ce20a-112b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687458920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458920, "uuid": "842d48f0-bc3b-4c8a-95ab-26a20fa54c3d", "comment": "Malware payload (RedLineStealer)", "value": "abe838ddec47c60f4da39f64c8c80b73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458920, "uuid": "99c22250-62d4-48dc-a337-e6764a9319a7", "comment": "Malware payload (RedLineStealer)", "value": "7daafd589963ecb11194e8f4398e244b721720125678823eb1c6b9924ae06b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458920, "uuid": "3c2c6d62-d0f3-4c4d-82fb-c3563077b209", "comment": "Malware payload (RedLineStealer)", "value": "571c1ff1120857015c5ce5404730f7251eb23944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458920, "uuid": "0cf88f46-8c6f-4046-b012-40be26f0ac83", "comment": "Malware payload (RedLineStealer)", "value": "c79b4bf2b43f180b0c25e6fefd023c1fd3e481fc80d1a11fe81aca204a89c05c65d6f88d737fb33f5861516b1b55af62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458920, "uuid": "04fd6e88-a916-4ab9-b486-dc324b123b4c", "value": "T10FB4F1CA75404573DF33CDF2C8EFE8DA4A79712107724B8B120D5AF98E462E4A61B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458920, "uuid": "f8fa9101-fcce-4167-a4a3-bd4de2ae262b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458920, "uuid": "09a654da-dffd-4aa3-b1e1-17483d72d425", "value": "6144:pPeJ/PvhLJuqwePpsyJfsSj3cbYelohdVgqvqNrMxVBYoTo5o1dlacEfDRNsGDQv:pPeJHbTey5sa2lCnvGoBKwdagGDQJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687458920, "uuid": "83444a93-2d08-4daa-89cc-4d02e1a15e5b", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687458920, "uuid": "3642c5eb-17a4-436b-8594-5765a4ddedb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458920, "uuid": "ab003097-88f6-478a-8c11-24b0800c0a93", "value": "abe838ddec47c60f4da39f64c8c80b73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edeb0e6-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687442848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442848, "uuid": "bd97a092-ac08-48cb-b1de-4f3a79c3bf3d", "comment": "Malware payload (RedLineStealer)", "value": "4e47bcb35f0b5543fba9d6a57b7b4b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442848, "uuid": "33ffa8f0-4b47-4c56-a4f2-c8927b162d95", "comment": "Malware payload (RedLineStealer)", "value": "7ed5b80ecc7b4ea2809923393df71fbe863c06188635015add8e6ec6ff29582b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442848, "uuid": "a9f65375-770d-4826-99cc-205e20cfef90", "comment": "Malware payload (RedLineStealer)", "value": "905d1a97c4c60e41142b8460ffa41ea9b8ef878b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442848, "uuid": "13151c23-3b57-48ec-9a8e-24a944fc38a4", "comment": "Malware payload (RedLineStealer)", "value": "c4b0b28ecd2b1d243503b00b6fcc70912a51de36811fc51e6cc11a6c4a02743d228c371471a10883a8a414bf4a8f080a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442848, "uuid": "ee269a54-d1d4-44e6-adf8-d47dd0d547a8", "value": "T15A749E027AC0847AED73117349E69BB9073DF8210B7659FBEBC04E2E8E246D167F415A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442848, "uuid": "ca625e71-7064-4c74-baf0-94f705428ebd", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442848, "uuid": "e1cc59ca-2478-4fd0-ae73-baf57f497334", "value": "6144:hzMqKmp7xRWeeIpIoDVyE/QixEAOFKNckZoVQN45VOfE1:hztKe7jWeeIOND4ckZo6yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442848, "uuid": "85e7df8d-c26f-42e5-8485-659c9394e1db", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442848, "uuid": "69ccbff2-e3c4-410c-89b1-3fe40870d75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442848, "uuid": "a0a2f0bd-3ab6-4e24-99d4-8a58588a61a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9880e32c-10cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687419429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419429, "uuid": "d26f69b4-3eb7-48e5-b2d6-f05ffe8cc990", "comment": "Malware payload (Mirai)", "value": "7cb5fdc0517c4318203bd02004292aac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419429, "uuid": "1d6b64f6-fa65-49b3-93bf-944a22db4605", "comment": "Malware payload (Mirai)", "value": "7efb133d16c26d02804fb6f534cb8325541eeda5461fe527b356b1b2acb2d115", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419429, "uuid": "0b108ea4-5f86-4891-b1ec-2a1add95fa6f", "comment": "Malware payload (Mirai)", "value": "8cfa12ac12840e9f117d956c8ecd32146e3a4575", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419429, "uuid": "b96cc43a-3303-48fa-83b6-50de77c6de2e", "comment": "Malware payload (Mirai)", "value": "6e7341c3d1e3d6b2e446b9e9cea5f7b923621162c43b1905dce78cfe04f0b7f40f08d08954bbf20235329932e72b599b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419429, "uuid": "8142f9dc-21fa-4cee-8e57-b524620c02ef", "value": "T1FC734CC19983D8F9DD1546743073EF329BB6F07E2019EE97E39866A3E982B02D51325C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419429, "uuid": "b767f08a-8885-4bab-9dc3-0484a552560a", "value": "1536:iTdRicIVpnm8gxTfXE16BJxs57d7c6DJQwlBtqeS1Sssxu:iTdscI/nxgpfXE16BOdP19PTSQxxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419429, "uuid": "de903c9d-cdd5-4213-adee-5f64af55b936", "value": 75920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419429, "uuid": "3eb93066-9fd8-4797-b858-ac873b979380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419429, "uuid": "61352ad2-6fee-4f68-a7d8-b104cd0e3e88", "value": "7cb5fdc0517c4318203bd02004292aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8201917-1122-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687455104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455104, "uuid": "1f67d27c-21b2-4782-b67f-f6a1916cfb2d", "comment": "Malware payload (AgentTesla)", "value": "a8d2eba5d6f81ffa035c5b7633c3d543", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455104, "uuid": "034d023d-c2e0-4e65-a79d-1bb2b9ab82b1", "comment": "Malware payload (AgentTesla)", "value": "7f52a1b5ed77d701595f1de3543c7c4567b521efcaf5ea12eea93f55ba1203d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455104, "uuid": "85374c97-b107-49aa-95c0-c5c5e531d4f0", "comment": "Malware payload (AgentTesla)", "value": "f5ac40adfba076322c22e6bce4f84475c9da0e1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455104, "uuid": "8c015739-7d3a-44b5-b3f4-1378e8a4581d", "comment": "Malware payload (AgentTesla)", "value": "2c246104f08b8d1b14732f645db32fa11d5baa24a3c886f619f6477dc5b1baf9bdeb51f24816b5b5297ad812f4ee0a93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455104, "uuid": "0685fd66-62e6-4c31-ac95-2ac3b719720f", "value": "T15325D050325D5F64E4B98BF2057042715BF62AABB53EFA494DC3B2DE29B1F018960F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455104, "uuid": "a3f427e9-ed53-4754-baa1-fdc3a43f1532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455104, "uuid": "3dd52143-5f0c-494f-80ac-94f90d08b62d", "value": "24576:C7MyuyF1OSCPwJ1KNoaqMXQKatnh9Ts7s3fQRNv5CcOa6I:C7MyuyT04J1KNopmWN3fCHCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455104, "uuid": "aca8c92c-24d2-4801-a7dd-93186412e40c", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455104, "uuid": "3dfa2f66-ea5b-42e6-8389-5ffe093efaa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455104, "uuid": "c598907c-19a0-4f77-bbad-ba10af4e5928", "value": "Signed Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134063fe-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420924, "uuid": "ead3d55c-7d9d-4f37-855f-1a12fc8fe7bb", "comment": "Malware payload", "value": "613458ca4239638cefbdf9f6bc2b373b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420924, "uuid": "7548fa4d-7940-4122-8246-9251e28d114d", "comment": "Malware payload", "value": "7f6bccc0b11b752ddf7969fa30a7f5577ed7acfeedfe09b1c36fa8adc27f1246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420924, "uuid": "d1676b22-111f-4049-8d04-5a46352c92c9", "comment": "Malware payload", "value": "189a75f218d92c561e4288d46af2c1cb313c23d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420924, "uuid": "e39bcf82-6ba7-4081-aef8-256e2efbce2f", "comment": "Malware payload", "value": "e8bce527b19ad6bdaa226c20c4da0ad40cee559013208d0058fee07b83202f42e98418d91d6b471f81e2fc2c6d4a6a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420924, "uuid": "b1ed35a2-da48-4f3e-9931-dabf159d6681", "value": "T151C533038A992637CEB0FF3D37B6C509069CE56B260ECB041759589F7B2548E1E623B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420924, "uuid": "bf34691f-c685-4834-95b0-9d57241266b5", "value": "49152:vXl1kdmoreTMg5wx2qbl5nD3wcRezbBeLwA+DYfp7Gsk0O:vX/Imor7g5wbbTD3wnzbLLDgOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420924, "uuid": "5186bdf0-21f6-45b7-998c-a8fbdcb2508c", "value": 2601363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420924, "uuid": "6e535d93-10b5-4564-9f97-fa0a4cdc1d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420924, "uuid": "db72430d-4cdd-4831-89fe-372ef5befefe", "value": "613458ca4239638cefbdf9f6bc2b373b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f933c43-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687420971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420971, "uuid": "7dbc84a6-892b-4eba-ae03-5d7bf29b570f", "comment": "Malware payload (GCleaner)", "value": "9e22cb31a0950ff720f4ceab9a55e5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420971, "uuid": "6ce54e1e-6418-49ff-9199-5bc3a5b840cb", "comment": "Malware payload (GCleaner)", "value": "7fa79f34dfd5f683052531361065162e008811aefb4d9e0db727f26ff471e48c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420971, "uuid": "748b3ed2-2a6f-48a0-a368-9f464c631c05", "comment": "Malware payload (GCleaner)", "value": "1821439caeda012ff6e2bb08f57cce639126f4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420971, "uuid": "a85348f0-caab-4215-92cb-d2ef354f2ece", "comment": "Malware payload (GCleaner)", "value": "cabd5a4ab776b3eca4d15d1154765a5b476cee67af810fd188be4db4f7d4ff0e8e0b67e2e8d80e58a721bd1e64e233c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420971, "uuid": "a2849815-b2ab-405f-86c9-e553c324ad65", "value": "T137841A8382E13D54FA278B73AF1FD6E8764DF2508F497B6912289A1F04B11B2D1B3B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420971, "uuid": "90c10a15-24d1-49cb-bf19-fdd5ddbcc571", "value": "17e5230c5cf4f4448b3cb8e448bbcc70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420971, "uuid": "b14183d7-58ae-4383-b324-073cb89f6274", "value": "6144:pVTrDg142nZUu10J5aQURuohh+/wIFIzs:DanR0PavFSTKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420971, "uuid": "890de7c2-14c4-4aa0-98c8-3ac347ec90ad", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420971, "uuid": "8b1365eb-9092-46a9-b57e-dd8b11b28952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420971, "uuid": "9e0bbfc5-324d-44a9-a784-c8548ee2c3c1", "value": "9e22cb31a0950ff720f4ceab9a55e5db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cead933-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Nymeria)", "timestamp": 1687419007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419007, "uuid": "ac72c30b-b141-434c-9549-59f2ea06ab0f", "comment": "Malware payload (Nymeria)", "value": "68749e1f05472d28f9aead6c393da9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419007, "uuid": "849d9658-0f7d-4c23-bdc2-5ed06426df22", "comment": "Malware payload (Nymeria)", "value": "811e59085cb487f0a0f3804b6fb051209d09f31485c6261511c76ae1aef140c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419007, "uuid": "9a3305f3-f8f3-4515-bc6e-e315860ecc94", "comment": "Malware payload (Nymeria)", "value": "008eacd660a50c57c370c28907e75bbd44af2b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419007, "uuid": "ae24abd2-6709-4edd-8eb5-58eb1c5e9d43", "comment": "Malware payload (Nymeria)", "value": "8ff19e4be8adbe91d7d4efb5e9e0fa44adc77e0c7eb515eae1760a5064fda637c5c1f5b37f644a251e5fdf0617f8abde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419007, "uuid": "df6aea33-00a1-4069-883d-0574accf4e42", "value": "T185252344AFD9EC9ACD5EC87360D7CA9A3EB80B124CBC03587554CA1CDEA87077D66872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419007, "uuid": "1a4db131-5aa5-45dd-87a2-d3694e838d78", "value": "b9083dd82a429a49d949568d3647ca0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419007, "uuid": "b9af7412-d2f2-4b72-9514-758e9baad82c", "value": "24576:chloDX0XOf4lLZPs02mOReGh1kLbkZEFK0gmJBphnYf0sO:chloJf6FFOek1kH2EFK0gsBDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419007, "uuid": "917b9574-dcbf-44a3-abe1-5795d1e630c3", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419007, "uuid": "bf435dca-0116-4573-a4ad-0c3c267b6541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419007, "uuid": "b6af4e87-588b-4a58-886f-3508daa318ed", "value": "68749e1f05472d28f9aead6c393da9d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18467cf-10c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687416465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416465, "uuid": "9c049004-5853-44c2-9bca-22993a10f433", "comment": "Malware payload (AgentTesla)", "value": "9754cbf3a0fbb9a82aa7c18185344174", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416465, "uuid": "902d69b0-b4cb-41d3-99be-23d8555bb8c6", "comment": "Malware payload (AgentTesla)", "value": "81690b37054cac73aace13e4f2581af5d20ead5a4a17cfbc6e84e5987ef67ba8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416465, "uuid": "c9047424-ca76-4ff7-93f7-eb958a25154f", "comment": "Malware payload (AgentTesla)", "value": "f464db1468f95966cbeb1be86fab70d39b4d9ce9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416465, "uuid": "4b00210c-174f-4f45-8b95-33ab4a830fbe", "comment": "Malware payload (AgentTesla)", "value": "a3b1db8f3c4ba4c25307de229ce18ed0f7d5fa17cacf87eabda7f074462b981f68f1f2d96baa30baa02d0a2cd821d176", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416465, "uuid": "97f2b6f7-4661-47c3-b0b5-9715e33de19e", "value": "T15412A0CC56E3955EFAD325AA5A7E204A06C0D5B0190C2F4FCB587E6998E20FC4F5E1CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416465, "uuid": "54a6f4b5-dfb0-4fd0-ad35-0ef996f70307", "value": "192:sa0KAJo2irc43ffyMzG0nprJh69JY+tlKaI4LpCUUI8HIYmdOkbGQ:scAJo2+B3ffy0rp29jn5LpDUlHIYmdO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416465, "uuid": "c41a3566-45ec-465f-83a6-0d632e1a99ae", "value": 9462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416465, "uuid": "a556b07c-4203-4d8d-a8f7-dca83a6bbc5b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416465, "uuid": "d7cf785e-7128-4cda-abb2-e507e1c61c50", "value": "New Order_list.Pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c415a6-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Babadeda)", "timestamp": 1687442888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442888, "uuid": "46031845-1420-4f46-ad70-c93ce9125f3f", "comment": "Malware payload (Babadeda)", "value": "8679d5346acf6b0f60d4233c3f01170b", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442888, "uuid": "4648dc84-f11b-4617-867e-e960c342ebaa", "comment": "Malware payload (Babadeda)", "value": "81d4dfb2bc202903d862108267a477e272c141735205283044f95272f15a9605", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442888, "uuid": "383312f6-26d9-499f-a508-ad3b1e880156", "comment": "Malware payload (Babadeda)", "value": "92c39bf4161efe6d3a229087da13b47a857ba098", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442888, "uuid": "1c7c77fa-366b-41b8-be36-8ddd6106672b", "comment": "Malware payload (Babadeda)", "value": "0cd816d5805f8419a70cb35abb5a426cf8cf265480ad39cb427819df59b179285287fc4e593ffdc0002d8bb60b9259a5", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442888, "uuid": "05d83514-e61b-4778-b404-135e71e6b12d", "value": "T17B555CF490AB40D1F9479EC0692CBEA6067335B3DED60834236D7A089F7FD552A48E4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442888, "uuid": "c1c00b1f-e3a1-48fa-b650-df4d2bf8c22f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442888, "uuid": "65d582ba-c880-4c26-86bc-20000da296b1", "value": "12288:HzyfwKwKnmQ3EGySXQvxQmKf3rYIypsxyH+hWDuSJFiU2xsgTAzuBMq5JyAZ6WyQ:VK7rySXQvlv2kqIVH2yqOE5Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442888, "uuid": "518e609b-c3cc-4057-a41e-70939f9f0d84", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442888, "uuid": "5d2d0ec1-c0d0-4ecd-8109-add86a54dec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442888, "uuid": "d8127de1-57ad-4faa-95bd-bb324457aba2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a6f11f-1101-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687440683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440683, "uuid": "b34dc261-2580-4821-8ee6-1d1ea457a234", "comment": "Malware payload", "value": "90b05411f657ffe0d0ef9310b4e5ee9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440683, "uuid": "01e5dd4a-5028-4302-9886-59ceaf3b8b56", "comment": "Malware payload", "value": "830cbbf6e979c13927c96733c166e9ccfbefd7f8e4c1a839ea347b98915daff6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440683, "uuid": "d9aa5fb6-bf5d-4707-8da6-57ad294f8c85", "comment": "Malware payload", "value": "bc24ed13f686ec119b28759ebd29362df39e4ee2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440683, "uuid": "77243fdf-4f89-41a6-80c3-6aee7b750d37", "comment": "Malware payload", "value": "ea1f88c34a18b031b0ce3ce2dc7a2c5b1fe27a95a62ed895d5c4813bc173c4a6e61efa616091abe95b90374e3ceec3c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440683, "uuid": "d63055f8-502e-44ae-baa7-b71b38ab0864", "value": "T15DA4CF0064A1D33AC5BF013189FDD7E70A7DAD750F1479EF63D5283E8AA46C0AA335A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440683, "uuid": "2c8ee597-75f8-4165-81ea-2a7b02a4e6c0", "value": "f3291e3c91eb36f11814906e0f6e67c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440683, "uuid": "11c7a031-78ff-4cdf-b1bb-44676f6d7568", "value": "6144:C756Tx+FXoCG/PtZ1QVXIxhBQpNEKOdOHq9KtO1X6XhUrQ7e7JDX3Q/AOGim3YWF:C74Tx+FX3G/rLKAGtO2Crqg8Yim3YWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440683, "uuid": "b7917e7e-8eab-47a2-ad56-18ed67b6e24b", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440683, "uuid": "68dc1f5c-2786-4bbd-9862-96f30ff0e71f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440683, "uuid": "47508f07-7ce2-4de8-9915-376aeae9351a", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.C7AA1336.3272.28173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04ba445-10ac-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1687404464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404464, "uuid": "b3dd21dc-f989-4266-8218-2492f408dc70", "comment": "Malware payload (PrivateLoader)", "value": "2544b8d77af3812a8f2e85633b0c4fda", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404464, "uuid": "a6e0ad2d-899d-4a20-8b13-de2b6ec8c18e", "comment": "Malware payload (PrivateLoader)", "value": "8360897daed15175c69e04b63b42a22e170264b5e672a56b158ef15cc9a9000a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404464, "uuid": "3d1635a5-d43f-41bc-94a9-998926eb8efb", "comment": "Malware payload (PrivateLoader)", "value": "3cae10340afd6b7f7afd3fdea343db43c472d105", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404464, "uuid": "677a0014-05ab-44c3-99db-9edeeb70693c", "comment": "Malware payload (PrivateLoader)", "value": "f942ef6e26afa6330002b2466cc130300d6152669189de8322743a43df99c7a79eff3bd9b8ba4564baf667c0b667a349", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404464, "uuid": "63643582-6302-47b6-8fc6-a5f78fe4d44e", "value": "T15A348D5075C1C072D9AB2C314574C6B20EBDBC311EA0DA8FA7D8193A5F356C2E625BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404464, "uuid": "d5ff6639-5a00-4cc1-8957-84a13ca6ea97", "value": "b160e82af058a746bb7ff4c92e78e05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404464, "uuid": "699075e6-ee82-43cc-abc4-40ddd37b41f3", "value": "6144:0/l3Kt4fRnA+63C7WlEUJe7R9r92hKs7+LnSkayA:0JKt45nA+63C7yEUJe7R9r92hKZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687404464, "uuid": "c28709d7-ce25-4a2f-bb95-50ad11827d96", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687404464, "uuid": "c4d0ee42-a7e6-449d-ab7a-a3a73e56238b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404464, "uuid": "555a11e5-cdef-4e51-b81a-65ec9dc5e607", "value": "SecuriteInfo.com.Win32.Malware-gen.11358.26550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c0a29c-1118-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687450806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687450806, "uuid": "07a1d2d5-bdd5-4133-a176-24ce1803da80", "comment": "Malware payload (RecordBreaker)", "value": "6c1c971d5de4a316f860689a37eecf3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687450806, "uuid": "de290211-f4ce-4299-bccf-aba0d3c2545a", "comment": "Malware payload (RecordBreaker)", "value": "8367690dbcabb0b6d7906f6c05b05109f286cea2683bdaefff93b04af8f10cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687450806, "uuid": "22ef1f24-f6c1-4a48-9618-36b9a80960c8", "comment": "Malware payload (RecordBreaker)", "value": "13569d24e93aac9c1e591ccaa9ffb246b3d97e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687450806, "uuid": "72b6cfe0-ba7c-4bdd-8a8a-863449ead43b", "comment": "Malware payload (RecordBreaker)", "value": "58121be1661ec7ecdf06db4888187bcd2ed1c57e0b160da46266793c0eba87f23dd77e5cac5ec005583e4f456ee76245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687450806, "uuid": "73676cd9-f419-4894-a409-afe14bbd0b2c", "value": "T13F443C03E2E27C91E516CB728E1EC6EC761EF6608F79776E62189A1F04B01B2D1B3751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687450806, "uuid": "db2820e9-dbef-4995-a971-1e485baf3493", "value": "607afc7727b0ba77b3f8b0e23a0a5865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687450806, "uuid": "e3543c37-127e-4677-9c98-c24197f3d0be", "value": "6144:rchGHitnXDaXMxLQCCI7Go1DDKkxXcjC9mUWp:sCitnhxsCdKoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687450806, "uuid": "d4fedd92-50bb-4864-a5e7-6c6b9382c207", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687450806, "uuid": "e38eb816-e84e-4973-97e1-8bb9ad796ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687450806, "uuid": "1efd39b9-baf8-4688-8146-6e8ea2275d0b", "value": "6c1c971d5de4a316f860689a37eecf3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9495cb88-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687418564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418564, "uuid": "0338aa4d-8495-43d9-b668-9e5d0ae741d8", "comment": "Malware payload (GCleaner)", "value": "087be9f12ae68dfdfe69c681d89a333f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418564, "uuid": "42ac87a5-0bc5-4945-a4ca-068c3b98d13b", "comment": "Malware payload (GCleaner)", "value": "83c7a2ea21f2ed292da8d5e98b72e25aaa91aa28efcc9018910d7ee885311bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418564, "uuid": "8dccdcfb-685f-4986-b906-781065d88b21", "comment": "Malware payload (GCleaner)", "value": "83fb40d1649f3070898d72fe7793c3b1727d21db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418564, "uuid": "e6bd4604-22c6-48cf-aff1-7119b9823027", "comment": "Malware payload (GCleaner)", "value": "f6f2afc41a21592866978295b731ccd67a3cbef5ec933452a35fb3bbce152a8d8bccaee2a568572ed29c930089e99462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418564, "uuid": "60732c83-2726-4f4e-b9d9-adad2d543907", "value": "T19854CF1362E17C70E92617328E6FCAD8365EF6104F797B9A23285A2F09B01F3C572B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418564, "uuid": "d070c87c-1b44-44af-bb91-66f4018acd7a", "value": "3970c2ac69340b703e5040d8d702fb5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418564, "uuid": "d6063df7-e6b5-4c9a-a117-b39c8d37f5aa", "value": "6144:ZIZBrRWwJXKqA4g8BtKixnObDqu1KqXhH6vJ:Z+xRtAqA4gK1WtKaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418564, "uuid": "e5fddd65-958f-4ea2-b452-311d0f829c6c", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418564, "uuid": "df214468-96de-433e-ac2f-1c012ca9c818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418564, "uuid": "291f1794-ffbc-413d-832b-ed6470ba2542", "value": "087be9f12ae68dfdfe69c681d89a333f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cabfd8-10c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687416611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416611, "uuid": "83a7bd21-d7ec-4e26-b158-b84cfa2747da", "comment": "Malware payload (AgentTesla)", "value": "2f76087aeae70994fb8b251697a2ea9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416611, "uuid": "4c241b22-2ebb-4d81-b47a-64c05aef4c5c", "comment": "Malware payload (AgentTesla)", "value": "854623b1f911f5e12845afa5e64332b835706d3ffda127cdb32e51139116729f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416611, "uuid": "6ab32950-b971-435b-9a80-8f9438b7d683", "comment": "Malware payload (AgentTesla)", "value": "9b37890f969159e7d5c8003665698acbe75ef12d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416611, "uuid": "aaed7c70-98df-4002-bb24-3e9bad91ea7f", "comment": "Malware payload (AgentTesla)", "value": "04957da332d4ae09d3aeafc23661f27aa830b5a68c6d877fc12c30b09c52c0daad4969b4ec8bd6d45f2b28eb22fbe69f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416611, "uuid": "2b399406-57e4-44e7-8c5e-a31e63739db9", "value": "T182C4234D14D74F152CD1C63670AF77261A823A1A0850FC6B7DCAC255BB853AF128BBEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416611, "uuid": "bbe7ba53-97d8-4ea5-98d5-a4dd6f29952e", "value": "12288:WyKXNJsOb4leA9H/jy/9WaJBslQuMVHqcNDgJ1YVqED31PIbD5ic9q48Za8d:uQOb4UANu/filQuMVHqQgNE5Ib8h48Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416611, "uuid": "4fdb42bf-ac29-492f-8a71-8574216f9153", "value": 592668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416611, "uuid": "d26380a7-e876-469d-864f-2dc882e0afbe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416611, "uuid": "f4236e89-ae6f-4bdb-b9de-1640fa77b451", "value": "PO-230102.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06a9202-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420838, "uuid": "8ffdfd0b-296d-46a7-8e4f-d2d2042d2c57", "comment": "Malware payload (AgentTesla)", "value": "0c0f9dce14b769a438939d9e149d5db3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420838, "uuid": "63fc6dd7-b472-42f0-808c-2ab3f2d6b4a0", "comment": "Malware payload (AgentTesla)", "value": "85c5b8ce343047febb9f3313f1cde4e1a37dec4a776addf9d4d6db10758c290b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420838, "uuid": "0c848b13-d987-487d-94e8-c8bbc82b908d", "comment": "Malware payload (AgentTesla)", "value": "a59e757fd9411c2fefff722da9c01efb0a74e35f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420838, "uuid": "20496762-8f46-4118-8c04-30f49ae3c5b4", "comment": "Malware payload (AgentTesla)", "value": "59342690e3b6f5094931617a74edc95e64726de811aa497e2ed190bcb925ba8d75cfb2666a10381c36d735693e04bc53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420838, "uuid": "00e3eed4-dbe6-425d-bb06-752c7b561814", "value": "T19D25D050326D6F54E47E8BF2096042715BF62A6BE43EFA494EC3B1DE25B0F418961F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420838, "uuid": "33b9d6e3-4a0b-410a-aaf8-2a3aca6cb2b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420838, "uuid": "5e029cc0-ecda-4b29-98c8-2a79e9fc10e2", "value": "24576:q7MyuyF1FHpuwJ1KNoTVaL9aO0xsqhBosaTR5wOYduBB:q7MyuyTTZJ1KNoZ6B0xxopRlY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420838, "uuid": "233374db-e0eb-485e-8274-64ecc2e93a26", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420838, "uuid": "f54e006e-726e-42e9-bdd5-9b77df2c8bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420838, "uuid": "9cb3195f-adf1-4aae-ae4e-c3a0868ab1dd", "value": "advance payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bf0d08-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687413328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413328, "uuid": "fa278e0e-86f1-4bd9-94a9-76c997d43c60", "comment": "Malware payload (GCleaner)", "value": "6b9ef9bc0c271d57ac84a6f39ce61990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413328, "uuid": "ed9dbddd-d4d3-437d-8118-dcf0da6c731f", "comment": "Malware payload (GCleaner)", "value": "865e3657bf4e8885b9e424a86ef1cf24cb4104d388e94396a6f3d2922c7b3ea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413328, "uuid": "f7bfa0cc-d7e2-4e17-8935-0bae88f041e9", "comment": "Malware payload (GCleaner)", "value": "612af464271aa75bdf08955c4b8421067a3c340e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413328, "uuid": "e0d11610-1233-4e48-9efb-9b7e3741caa9", "comment": "Malware payload (GCleaner)", "value": "8a80aa74160e23f902b008f2ee1cab01d4a19174fa5a182c58d74ba13577d9c5e822bb6390679a6e3e6a7b77dd1d3fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413328, "uuid": "8e12fd2a-fbc2-46fd-8335-6355bae4a097", "value": "T1F354BF1366E17D71D9224B729E2FC6E8761EF650CF297B56223C9A3F09B01A1C9B3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413328, "uuid": "541b9787-2f1b-4cf5-8276-277f66fb6b77", "value": "3fedbff9d4d02ebd21aa6777d872bf95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413328, "uuid": "6588100d-0581-45b2-95df-6772a8954fe0", "value": "6144:x/i8pNNsoMl/JSmbA3A6JJxxiHiDSo9TtoK73:x6KNKDBJPbAw65xFSut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413328, "uuid": "63ffa8ab-1eb4-41a0-a505-2214cfc7c2e5", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413328, "uuid": "4ff4c78c-601c-4187-a6c4-ca164e8e3a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413328, "uuid": "ca13c91a-088e-4a87-b4d0-3dfcd667cd93", "value": "6b9ef9bc0c271d57ac84a6f39ce61990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77716b8-111f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687453814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453814, "uuid": "7a0c8a31-2f7c-4177-a93a-939ffaf4ca63", "comment": "Malware payload (RedLineStealer)", "value": "b7fe7a2030596d8e06ac762ab5084a92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453814, "uuid": "d6895d86-5539-45c6-938c-a0537f95994d", "comment": "Malware payload (RedLineStealer)", "value": "86674ec221ca410677a2016269365c8363a861681329891922d2d97a478f3da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453814, "uuid": "d140d2a6-8c05-49dd-a065-3cec44709168", "comment": "Malware payload (RedLineStealer)", "value": "a5337dde725a95bdd46a866180d146098ed349c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453814, "uuid": "f2992583-8f76-4af7-999d-e31da5babf73", "comment": "Malware payload (RedLineStealer)", "value": "799efacf6b6926a3e4544a63fc4026a1215e1a7795227fd5a14355555b74666a231784d67e53edb9d04f7a738897c7c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453814, "uuid": "a9d9ea15-7763-4c8a-bea1-c66a649594cb", "value": "T1B2B4F1CA61404877CF63CDB2D4EBF9D74F7A70210B628BC7124D8AF64E015E4A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453814, "uuid": "9a730a37-4989-41a2-b99b-6ccb1e90a50d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453814, "uuid": "1b8fc37b-72e2-4ece-9f6c-e176ef40bdfc", "value": "12288:ShkvHATey5sR7XZRnKl91uG5CQO2P8rjIZNgQJQmZ:kkvgTey5sJ65n5DOA8rjID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687453814, "uuid": "9ba37c14-2a58-461e-b64e-6001dfe073b5", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687453814, "uuid": "47b268a3-779a-4d20-b695-4e08ba36d50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453814, "uuid": "e5c7b6a6-a805-4188-af4f-ab3f1a3518d6", "value": "86674ec221ca410677a2016269365c8363a8616813298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b95a6ba-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422629, "uuid": "4ce7aae8-88ee-4c4f-8c50-a456571879fd", "comment": "Malware payload (Mirai)", "value": "990916f9acbf76723444e5978a3f7087", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422629, "uuid": "0045ce2f-59c3-4f48-b0d4-11bb86503c0d", "comment": "Malware payload (Mirai)", "value": "86f37bd49554cea04bfcadfb9a7b7d751acc78b5e59437084ebbf4c4760c8211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422629, "uuid": "988744cd-0df9-413e-933c-81427977d6b4", "comment": "Malware payload (Mirai)", "value": "255b128b95c5e847cc88850c28d32da3d35583da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422629, "uuid": "88332723-60ac-4cf7-8b72-1118be13a5d0", "comment": "Malware payload (Mirai)", "value": "9e2eba1baf3c519eaa3d5d038c3511cf7ac8a25aa78f642a5c4bb56f7f963e6227cc750dfbb32b3a94904ae32fbe2265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422629, "uuid": "3c2e4c02-8bab-4b14-8689-2eca1cbc6fe0", "value": "T10D4308817881A626C7D05377FE6F018D3315A798E1EA33539C291FA47BCAC1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422629, "uuid": "482aa798-4988-42a8-8980-a76a2683d391", "value": "768:GeI1ekFMSpevMSzscSlgUeXt1vSJdcmC4XAFPAFE2pGltryoZaLwCVy/Jx+5H8ha:w1vZkMm0dc7rZltryqweZW34UHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422629, "uuid": "02a20baf-1b02-4cb5-8476-c2a3158dbc3c", "value": 55708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422629, "uuid": "c60cd09c-9778-4714-987c-22dcab454800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422629, "uuid": "cee041d1-3127-4e6d-ac03-7d34d28c33f1", "value": "990916f9acbf76723444e5978a3f7087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffe8964-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687456808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456808, "uuid": "ed326818-c189-4d41-9db0-6f726d4df623", "comment": "Malware payload", "value": "45a2d79b36fe8ddbf8752e261912b7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456808, "uuid": "d17393e1-f06e-4faf-ab87-0787a3f57129", "comment": "Malware payload", "value": "877dce06405dd615ae9b838d206e5b549ed269ad98190721dca6731da830a9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456808, "uuid": "bc545642-cd74-4cc7-9b98-02b17e65dd51", "comment": "Malware payload", "value": "9f671a055d0f8ea03bca51f957b6385b84754bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456808, "uuid": "a9993a37-09c4-4915-9442-64edc8edf090", "comment": "Malware payload", "value": "39c219fb478871d743b26ce5fa984ba1d27bc3d941f7f550ab244069dd8459a5ae3ebfc6b4f64654026ac45761025882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456808, "uuid": "49fd4c19-cf7a-4471-91ff-50a5e0557fae", "value": "T1BCF4F11070818C32E87315324FFC9AB8672AB951176579FB23D44EBE8FD97D2E132A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456808, "uuid": "40456f11-e994-409b-a64c-5f200f4a4f90", "value": "0330cb8599ebc8e2472474ca94c4c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456808, "uuid": "3f49a5d2-87cd-4be8-9d74-9289f44058b6", "value": "12288:/BsQymkTPsu+dK8T5t1V/mojJBCVCSb1AYOwB/CXWxgZ:Emdu+4UzlmoNQJW4CGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456808, "uuid": "e1f35426-d782-4831-a9d2-d85264fe9ff1", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456808, "uuid": "7fab5c53-00ab-4ba5-b228-aed3418ea73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456808, "uuid": "3c96349b-6964-4440-8984-11e8e7bb3735", "value": "45a2d79b36fe8ddbf8752e261912b7d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d55e6bb-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422229, "uuid": "06b8e80e-70b0-48e0-afa4-a56c2f84a03c", "comment": "Malware payload (Mirai)", "value": "0469ab8cd08e85c393694cc289f7fc3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422229, "uuid": "c6677085-6fc7-4c8d-806e-47c6fc6197ad", "comment": "Malware payload (Mirai)", "value": "87d9a02a8ad076f9001d16d6dfe403272431ede363470c8354aa21cc6f6c7edc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422229, "uuid": "6dcbc60e-5595-4f4f-8730-998c961a97ef", "comment": "Malware payload (Mirai)", "value": "7d7d3e315211e9ce2da48113546fc3f08b7c53f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422229, "uuid": "2f68aac5-3566-4ced-a0e0-6fb644f1704a", "comment": "Malware payload (Mirai)", "value": "475c066daad6911d09735c792cf002236f5a05687f23cf647a918cfa5de9b5d84f2a5cb1748bb0b04a5f2edd670a0d0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422229, "uuid": "a162e1ce-2a95-4ecc-9adf-34a6cee91490", "value": "T14FF33AD7F800EDB9F80AE33748530906B130BBA254925B376257796FEC3A1D90977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422229, "uuid": "52a7d4d5-b961-4fc8-ac8a-54befcb7762b", "value": "3072:gQM/yUAwb+QoxoLW69g14iu/F15soUf3aVfjbi+LYPGdey+AgJ:v3Tis4P/Wbf34LYPby+lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422229, "uuid": "03cf449c-4eec-4ee2-88d8-c3368d39ae0d", "value": 164780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422229, "uuid": "5f6d767f-20e4-4cd2-83aa-105c15ba580c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422229, "uuid": "2c77190a-f461-42fc-8746-58b20d4c948e", "value": "0469ab8cd08e85c393694cc289f7fc3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051d884e-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687459125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459125, "uuid": "a2fb6fce-c3d5-4788-bfd2-1ecea599c3b6", "comment": "Malware payload", "value": "d55dd4e79ced52edcbcf5603db6f91af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459125, "uuid": "b6eb2c7c-d5f6-4a00-9fa3-8533c13ce798", "comment": "Malware payload", "value": "8a415368c69a027023e15cf76a5b3901ab3681fe66f121a32fb8862f72afcaa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459125, "uuid": "026243df-5b60-4a2d-8005-635a42963d3c", "comment": "Malware payload", "value": "2d138cc3c0c906386808ab3f9c1a96609df671af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459125, "uuid": "dbadad36-6624-4f89-aefb-6c7b97b94a83", "comment": "Malware payload", "value": "e7d26786218affc285eb04b62fec8e5781d1e05ff5a3717db547c36c34849af058295ec505ff2dce27568d0474eddd51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459125, "uuid": "be4f34fe-263b-41b9-8109-fcb24a933608", "value": "T116F4BE31F680A037D2B315B98E69D36A143DBB301B2868C7B7D46E7C1D382D25A7536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459125, "uuid": "8285fe0f-6ce0-4b9e-b507-a8549abdd6ad", "value": "2f727a975c44a2925ace416e4a5ad2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459125, "uuid": "968f666e-192a-4fa3-9a94-d03159518a2e", "value": "24576:geNt8okNsr/fLpbnmjdP/ZW5AvZEj5J5:jNXgcnlG9U5J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459125, "uuid": "d1de07f0-2c84-4a77-85f8-953699fc2f60", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459125, "uuid": "e9dcc558-fb98-42a9-b8d7-9f9780f70154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459125, "uuid": "f61ff36a-5f46-42a2-8db2-2d1933de6a5c", "value": "d55dd4e79ced52edcbcf5603db6f91af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2c198e-10c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687416701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416701, "uuid": "cd48d096-5d76-4f31-af93-4d8417818b70", "comment": "Malware payload", "value": "622160f29b427a78b392004cd3d232f9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416701, "uuid": "edb35f0d-2be8-4330-8f33-c39ff872b68b", "comment": "Malware payload", "value": "8aeffad4812f0886a805d58122f8a2cd7c9ab27a37b46fa9d6d63d7e20a71a65", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416701, "uuid": "743b3b2c-3ad6-4f42-a373-7e11720683ca", "comment": "Malware payload", "value": "3c71dfe6e7d98790867724357b6cf7921322037e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416701, "uuid": "859a0e40-00b1-4cd6-ac5a-ffb41491b783", "comment": "Malware payload", "value": "0c666c874e1d70545b403b164f587513dfe9aaa04396a5b3469d0292a2bf4c9181834050e02086c9b78e235b5430cdca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416701, "uuid": "7967d55c-5dc2-4315-8be7-0ded46698e1c", "value": "T1B377337CC0A1639B1D7B6831B5F1B0DBC86681B189535E2792BDA633DBCF3D1A178089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416701, "uuid": "9095ccca-d180-4ecf-9fa4-a409cd17fc53", "value": "786432:vfTPmBTW7E0YaoUO/pmrW9twEvaWH36l96t+eOhWYPOzn:7CTqzYxQKh36mZYcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416701, "uuid": "3565060d-f461-4985-b29a-e6793bbafd36", "value": 33305465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416701, "uuid": "9529d283-88ad-416b-8b6d-97c1616fe9da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416701, "uuid": "fc24a19d-ec23-4d69-bcee-e4be9ee217f8", "value": "622160f29b427a78b392004cd3d232f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36404d0f-1127-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687457060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457060, "uuid": "f6b2d71c-03d9-44b9-838b-34e4474e37ed", "comment": "Malware payload (njrat)", "value": "c6df2c26322e44916640ae5c45365717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457060, "uuid": "03ca5c56-f9e2-40d0-8eeb-03f9987c3666", "comment": "Malware payload (njrat)", "value": "8b9807fbe4bb55b9818215ac035afdc2ac36fd528229e760a1b8ede16b2a9d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457060, "uuid": "c1292f0c-52c3-453b-9323-6ce9bd788e0e", "comment": "Malware payload (njrat)", "value": "dd0766aabcb9814cb3ce3e7013b3836c92ee6307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457060, "uuid": "abb58627-a8ea-418c-9fca-f2cd1f069761", "comment": "Malware payload (njrat)", "value": "ab3ef24de8ef7f172851c900606870305895f0320f6ff76f9f350cf4fb86586e378b43b70d2ea46b40f8d8328c953b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457060, "uuid": "75378b2c-a5ea-4f28-8adf-a54643890d14", "value": "T177E208067BE94215C6BC1AFC8CB313214772E3838432EB6F5CDC88CA4B676D04245EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457060, "uuid": "d3b3f659-aa74-44cd-a1df-e32318ba4164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457060, "uuid": "1a8f7eaf-eb56-4fed-b59b-9d43d3c4eb74", "value": "384:X0bUe5XB4e0XmOSSYw0Q0mS03AWTxtTUFQqzFgObbF:8T9Bu1Si55d+bF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687457060, "uuid": "1b49707c-1a75-4879-9133-3847c7860797", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687457060, "uuid": "09414500-66b1-4847-af73-22cdd012217d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457060, "uuid": "227e6317-e2fb-468a-8ba7-a661ed479f3f", "value": "xJ0XrL24WnzC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbf5821-10c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687416918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416918, "uuid": "ab10e4e6-0dd2-4282-9970-5a9a5e07c4c1", "comment": "Malware payload (AgentTesla)", "value": "5478df931597bdec06122acb85e0ad01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416918, "uuid": "fbaf3135-1db8-4af2-aad9-6d7c85aa686e", "comment": "Malware payload (AgentTesla)", "value": "8bb37aa7c45ee81d6e3e1f2d37422c97834835f0591b785558c535e3536ea0b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416918, "uuid": "254b0fd2-ea82-4195-a76e-ecb875ad08a4", "comment": "Malware payload (AgentTesla)", "value": "f96e87f0e03a4d68ffa609fb5961c96f0af415e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416918, "uuid": "209b57f5-fa5d-4817-b737-56c179c23884", "comment": "Malware payload (AgentTesla)", "value": "9fb16fb7678aa672bfb9c929aad096574a4440e4ed3b4274714dada20485e4e0e898fca0184c45ae9f658bbe22d713d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416918, "uuid": "4a934b11-e26d-4e4d-bef4-dbc87657dfc2", "value": "T1BBC4234D14D78F152CD1C63670AF772616823A1A0850FD6B7DCAC245BB853AF128BBEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416918, "uuid": "c8666f40-1f3c-4a44-bf86-dec8962cf1b2", "value": "12288:wyKXNJsOb4leA9H/jy/9WaJBslQuMVHqcNDgJ1YVqED31PIbD5ic9q48Za8z:oQOb4UANu/filQuMVHqQgNE5Ib8h48ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416918, "uuid": "17d8f2d7-90e4-4fd2-b377-12ca22b3795b", "value": 592712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416918, "uuid": "40bd3282-8b36-497a-957d-aefff997ffaa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416918, "uuid": "51d1e16b-de77-48d7-8b27-79cad6d472e2", "value": "KB-7103-VACCUM MUG-PO ME-625923.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cff739b-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1687414041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414041, "uuid": "d1a016b1-becf-468f-916b-e69a95c3bb50", "comment": "Malware payload (AZORult)", "value": "6600a72fd5d02c1320c5089d07b3353b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414041, "uuid": "a681b94b-d27d-4544-aa9d-a642a56ea169", "comment": "Malware payload (AZORult)", "value": "8bc44267a36df18fcd02676cabaab5a82156ceca8abfd373192707a3b554f38a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414041, "uuid": "b89116b2-2403-45ed-96d3-26e51f14ed64", "comment": "Malware payload (AZORult)", "value": "68aaa5b59742f4ab6e916475ef0774c584efba75", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414041, "uuid": "5a9a0b38-b499-437e-b9a8-d6ad6ccbaa09", "comment": "Malware payload (AZORult)", "value": "46a482e89529904b37bb6c7c1a8369bd60a65d21dd0e98aa2e8b3ef17f8429e8f81632e4802691d2b5929c35a8ce6b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414041, "uuid": "b10b6be1-1f8d-415d-9700-b79fd267c555", "value": "T109F4231927E4C933F61382F0CD7B6BB3B99ADE1069340B4E77650B8BED0938665C9316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414041, "uuid": "678d5f07-7bb6-4d47-a290-5ba41b2dd74e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414041, "uuid": "77b2cc87-33cc-4c60-aa6e-47043cdd6e03", "value": "12288:gMwR5LgTASPyjenGXtxZ162EVShywiWtkI7T9B68NSOV+BYiTgRUKNMCW/3K:gMwR5LgTASPi5d1hyqGI7xBHNSRBYict", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414041, "uuid": "ad490eff-47bd-41b9-bd80-dfe070591cf2", "value": 737188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414041, "uuid": "8055c2c0-c206-4bcf-9b6f-8f7d218538d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414041, "uuid": "1de0bc98-9752-4f1f-a683-cdf32816d664", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58059af-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459529, "uuid": "ccf72b91-0463-4d8c-8703-5f2a472f97cb", "comment": "Malware payload (RedLineStealer)", "value": "fa6d47d1d2addc6c1bb0b68862edcbcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459529, "uuid": "ddc085db-9c3a-421d-8804-e195a9421b20", "comment": "Malware payload (RedLineStealer)", "value": "8c484389f21afcc5ab195990806d614b405c9105ffda70bb49a3e1343ddbe5b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459529, "uuid": "f0d1c9f1-9ce6-4891-ba49-8482288b8324", "comment": "Malware payload (RedLineStealer)", "value": "f0120596021c3607d9f389cbeb3699b65034b6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459529, "uuid": "04dbb9f0-74bc-42ff-bd37-fd9b35dd585f", "comment": "Malware payload (RedLineStealer)", "value": "e540d4059b15a7e22095861362a59453284c87bb140ceb2e1c60bfc7e156461da0ef236608dea02f83de9ad9761109b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459529, "uuid": "85ac6143-d194-4798-8d41-636081853a2d", "value": "T1D9E402C771408933CF67CEB294EFE9964EBA72310B6207C7120D49F54A06AE4E61797A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459529, "uuid": "138973e2-e0a4-473a-a3c1-6b2cdad992f7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459529, "uuid": "b6efead1-496b-4605-b374-35e68dcf36d5", "value": "12288:te+6UTey5sFaTfILOPopGVPTnwhKI6+NDp+J/2266L53DQJQmZ:te+TTey5s4dopSpohp+J/2z6Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459529, "uuid": "09322513-aafe-4651-aab4-1dd445b60558", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459529, "uuid": "57a15646-21e2-4c0f-9f13-0edae251bafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459529, "uuid": "b84f22a4-a44d-4e5a-baea-cbcc2c70c6ab", "value": "fa6d47d1d2addc6c1bb0b68862edcbcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb37949c-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687423434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423434, "uuid": "c26c800c-6fd7-4dd9-82a2-b4c987d24761", "comment": "Malware payload (GuLoader)", "value": "356723eb1bf1809303d66d8cf61e9147", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423434, "uuid": "a9f810a8-255a-4dc2-b85e-e3a6f2a7d454", "comment": "Malware payload (GuLoader)", "value": "8e3197d866f1eac2e0c5790770b0f06b8529a5b3a7146bcb5a29621d7e77a168", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423434, "uuid": "3415f126-8bae-4b74-b429-9f6f61d4ab58", "comment": "Malware payload (GuLoader)", "value": "3efa5d22185c22cf773df8d14580e0cb29f1f996", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423434, "uuid": "0f3d1fbf-acf5-4ca3-96e6-2ec3ab23bc8a", "comment": "Malware payload (GuLoader)", "value": "2e2c6b0b31c3527d1a8e67ee1d5c22e6f56fe9ccb90c1553fdf2cdb2db9eddab057220e7624f8964108e82b2d0f270ba", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423434, "uuid": "9354b0cf-c20e-4231-a7cf-3ed1214508a4", "value": "T1FF45021623C08CD5FB16A23185219B79B7ACFE3D177652373BED2E5E7B3D2804A1A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423434, "uuid": "c7dcef53-543f-4e15-a342-e7f28d514797", "value": "12288:zO/hjnBgEMv+LmrHrL8HbwAYJvybQzG95ONqeglJBy:zOjBEj38UWDmmJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423434, "uuid": "03619f99-c829-444f-a3c3-9e98c14d84ac", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423434, "uuid": "ca3a484e-8653-47b1-81db-196cd7aa24ed", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423434, "uuid": "270fc649-14e3-41f3-9cf8-dadc9acdfa46", "value": "Nr.21594772 Technische Dokumentation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9be4a4d-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420827, "uuid": "90142ff4-2171-4294-af9f-8b6d87824bbb", "comment": "Malware payload", "value": "5f964844d94630795abe82f064df9431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420827, "uuid": "a83e743b-0152-4b20-89c9-cb7e5f3c21db", "comment": "Malware payload", "value": "8e491e78bf7cc20475b01defa68ebe2846490d5ab2fd04fa9172a7918eaaf5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420827, "uuid": "f350d2ab-d850-4df8-ae94-76f1b3b5fd3c", "comment": "Malware payload", "value": "4a705aee927dab028fa6d82fe98093e662110f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420827, "uuid": "4438e5eb-c033-4fc9-af1e-d8c625ed0bae", "comment": "Malware payload", "value": "c1fac630c957e1947d97c74ea72d95e00b8d30b420393aa2619c85e70f1ec9f6f5fb331375ee76a7b2d68b3914672400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420827, "uuid": "5d9f1197-e3c9-453e-9bb0-7dde6542a16c", "value": "T19826331A6AC2A176DD7F4C303471A43609B7BDB13F78DE9BA3D45BA806305C0933EA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420827, "uuid": "74c2e4f5-285e-47d8-ae4f-f6771a3cc548", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420827, "uuid": "0463e812-a2e4-419a-b5eb-eeb3068acda8", "value": "98304:zMBQincG0v42FfxF0PJrGTQcSkoCRzslGbAZKojp6h276JBN/2997w7D1epEWh:zrIWLrTNSgx+8AtpM2Y34M7ZepN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420827, "uuid": "b374cc5b-d293-4d68-bbaf-ddd6500d6583", "value": 4834359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420827, "uuid": "91cfe9d1-ffd6-4242-939f-0c17512b4642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420827, "uuid": "a9f9e334-a174-4665-b3b2-dcfc1392bf02", "value": "5f964844d94630795abe82f064df9431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f7f6d2-10c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687416476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416476, "uuid": "31a3a953-515f-4cd7-8575-96dda5e86526", "comment": "Malware payload (AgentTesla)", "value": "844d85867d7ac966c7d5b5c1a1cd0406", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416476, "uuid": "b69e94f4-5885-4c0a-9bf6-0083826010b3", "comment": "Malware payload (AgentTesla)", "value": "901cf5414cd5a2ef5752c7d1b960eedfc72758c9df50eea8195a88fd96a0a596", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416476, "uuid": "8ad57f05-39e4-4c50-8097-985568e290f7", "comment": "Malware payload (AgentTesla)", "value": "65bc0f6a1c0abeb725499944f85b7cb1b293d7fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416476, "uuid": "57d1589e-42f8-4f06-ab2e-7994a1fc2eab", "comment": "Malware payload (AgentTesla)", "value": "b65cc839072939002211a8748bb91ef17207de7c1d1a8f47ba36a175290cefb77c446e8e9020e2273c12e9b625909320", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416476, "uuid": "a0c2d893-3d6a-4ca1-803f-eb98caa8444f", "value": "T14092F65977C9D32AC3BD037898F1160217F4964268A8EF196CD019BB5C277882EAD1EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416476, "uuid": "f99a56f1-3aae-4d53-87dd-197cecc3d2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416476, "uuid": "187dda0e-ad30-4b25-8a78-b63c6d093cd5", "value": "384:cFFEoK/O4bZWAItgZAKsMl+LXH9+XtimlHPiz2W:QEz/O3AItgZA9+XtJAiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416476, "uuid": "f07dc615-5ba8-412a-9d82-4f39a3dd4d6d", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416476, "uuid": "4bb2d90e-4922-4f57-80d5-b1fd76437682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416476, "uuid": "3a575ae7-8ded-4eb5-b37b-3dd63c684db7", "value": "New Order_list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbe93a6-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687418388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418388, "uuid": "40d0c917-e4b9-4307-8d78-ef7eeca40a08", "comment": "Malware payload (AgentTesla)", "value": "6a77df57d5e6d13611b5cbd281e3eccf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418388, "uuid": "d3e01715-9575-4618-9d79-8deed2a250ab", "comment": "Malware payload (AgentTesla)", "value": "90ddef4b0f308db2e11b47cd2bf01a4a3d5ae66b15154f5dcef1173785118342", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418388, "uuid": "3ed4cd7e-63b3-479d-ada4-a80ce051d9c7", "comment": "Malware payload (AgentTesla)", "value": "3140b1753f19f59d4db448b47060b2f5ceb39758", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418388, "uuid": "c4acce9e-3571-4c31-905a-da4ca67bf529", "comment": "Malware payload (AgentTesla)", "value": "8a155057d6a04d119083a251551ebf9c4a4408abb6393eddb1a04a1168447ac66f89669113030eccfedcde32fdaf20d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418388, "uuid": "4f856abe-9105-47f3-83ef-307dc7efba37", "value": "T1E2D423353054746EF998BA8234EB8B7533E1A72844695144E77D6E38726B3CBFF1D012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418388, "uuid": "e715f303-0988-42cc-b93b-20b346dac9da", "value": "12288:waV22VCVsAAz/6NkJny70A3j4xPlwCh1KjfjFLHw37rHGuY7qK0RziLrYzS+UypW:wWMizAYQUwk1+jJQ/mEKRHYzUp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418388, "uuid": "5b6475a4-953e-4eae-8959-5fac35be3654", "value": 599032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418388, "uuid": "0bd46077-adbd-4dfb-b298-a427e14fc7bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418388, "uuid": "12d91942-7130-4ec1-9321-49407cf16a2a", "value": "New-SIGNED_INV-Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e50bca-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687442893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442893, "uuid": "ce9dbf22-dca2-45b1-97fe-ac95714ff534", "comment": "Malware payload", "value": "9ffccbdafb469f35c85ad38f640e89ec", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442893, "uuid": "30bfda8a-af87-4537-8b3b-d574c92bc1a1", "comment": "Malware payload", "value": "90e21d55cdfeec99f864caeeef27ad5ddbb4f10cccb20fb96271a359fd7d27d6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442893, "uuid": "938c4cc9-749f-46f5-a285-b974ca4701a3", "comment": "Malware payload", "value": "8860eb050338b633d5dd7469047c23036d6e1eb0", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442893, "uuid": "abc25624-2b38-4572-bf4a-fcb69373bf34", "comment": "Malware payload", "value": "1c13d04fbe27d34be896a20a8fb5d49f71e1595bd4a71b6534f7f9e36afebab6fe177f982dde9a273d58518c4d3a25e3", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442893, "uuid": "db996498-01a6-42c5-8b21-150022c83bd8", "value": "T163623B19A3DDC237CC5E87769C6112800736EBAA7503AB2E5BC429961D133909777BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442893, "uuid": "b52baa8b-fca7-41b4-9070-ace71fbc0faf", "value": "384:5wYez012W1co0AoSBRwH7a2net5Pnxg+41JaZHDqfmY+YB:5P1US+r+YCW+Y+YB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442893, "uuid": "df23a8d5-5314-402d-9455-768bbdaececf", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442893, "uuid": "ff1c527b-e046-4e70-8444-be61d7f9b707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442893, "uuid": "5e5a8c20-8a4b-41e0-980a-a50049ac949d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc22fc8d-10fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687439353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439353, "uuid": "7440bc39-ab6e-4224-b278-380fc6490403", "comment": "Malware payload (AgentTesla)", "value": "1c39cc0297f34ef9a16855e533776c81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439353, "uuid": "d371bbb4-e0b5-4e01-9906-c48bb8631012", "comment": "Malware payload (AgentTesla)", "value": "9160d5bf9da57b8baa00455a4db770d895f83250f6e707d3437622a2e42dda60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439353, "uuid": "b4e41ede-3d5d-45be-b4ac-2016ade0e781", "comment": "Malware payload (AgentTesla)", "value": "013f87b0638ef1a8da0941e6c11cd140375297b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439353, "uuid": "57141fef-99dd-4963-9b5a-587958eeb6fb", "comment": "Malware payload (AgentTesla)", "value": "6e49a588a0e062d3803183fc5a479166db8b06d50fa8d0cf1c5c639605d17bffdd2010b37c6567da8d87cbd0e536c91e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439353, "uuid": "fe1ef08e-5a56-498f-b728-6315a37914be", "value": "T1EE25E0403659AF60E4BA8BF50920527057FA6E6FB03EFA094EC7B2DB25B1F414961F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439353, "uuid": "cb19dec5-6af1-4640-b29c-3f775c9cc83b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439353, "uuid": "a7d7264d-9661-461e-a477-3111e0644245", "value": "24576:67MyuyF198fwJ1KNo8wul31gInR0NB0kvl0vB1+NKLN:67MyuyTOIJ1KNo1uXgaR0rMIN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687439353, "uuid": "939d59bd-1df3-46ce-9b44-fe3e9eebcb26", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687439353, "uuid": "d0cac9d8-1e59-457e-a064-2d596814b899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439353, "uuid": "f5523c2e-e6c7-4699-ab37-0a502f43578e", "value": "7057 DRAFT-7947963 68379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bbfe3c-1103-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687441807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441807, "uuid": "6cd14a8b-0c34-421e-9de4-4603b97d66a9", "comment": "Malware payload (Loki)", "value": "a6767f4182d512a07b258fd91dff5267", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441807, "uuid": "b24ca74e-323a-4ffc-90c1-ee93d5fed59a", "comment": "Malware payload (Loki)", "value": "91ac06377918b5aca1dbf64a3ab426ab8f5576c7c806929fbbdc9fd2f0af5e17", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441807, "uuid": "bf6aff19-f1c9-4df0-b1b6-a0affeea9969", "comment": "Malware payload (Loki)", "value": "0868ebe5b8c10e42add8beddc838d1e470a6f7a4", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441807, "uuid": "e2bc484a-86f9-45d6-8e72-79d63c1cd6d3", "comment": "Malware payload (Loki)", "value": "5877bf7c140fdf62e726587ea16b9ab0659af29bd1c5e0d2e3424a4aa9face8157d0e2a8ce7d1ae0b557efe28eabbc97", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441807, "uuid": "78110f50-9bd7-4354-8a45-ff7cb6c3a837", "value": "T18615D05032695F60E4BA8BF6096042705BF66E6AB43EF6094EC3B2DA25B1F118D71F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441807, "uuid": "676eb080-7880-4cb9-9b71-c16e68be57dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441807, "uuid": "c55e418e-d310-4748-9744-7e8edcc56aba", "value": "24576:g7MyuyF1Jo5wJ1KNol8ejIOKH/OIivTQSh5dtelVORU8:g7MyuyTGWJ1KNo5MfOtLRn6lVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687441807, "uuid": "482ef05e-1100-40c7-bd57-2e42197bb2b1", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687441807, "uuid": "f9fe9dd6-72cf-4152-b32f-ac180032e042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441807, "uuid": "36deea1b-6094-4374-abe2-6da924a027f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfadaa76-10ac-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687404463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404463, "uuid": "067e5029-eb75-44d3-b1a8-559e04939d54", "comment": "Malware payload (Formbook)", "value": "7340e3440038c266c66c23224a71fc72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404463, "uuid": "c16cb28d-4fb4-4e7f-9355-ac83bdbdd771", "comment": "Malware payload (Formbook)", "value": "92770f64ffd8bd959b6dd9a052faba19f483b29bddc0904036896b62958abcdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404463, "uuid": "f04b1179-8737-4643-b559-4a52417beab2", "comment": "Malware payload (Formbook)", "value": "c54ad0cb61a49e0a28e41476ed8a36fc8e3b7a70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687404463, "uuid": "816914e5-7073-46c5-b802-f13c01d36c4c", "comment": "Malware payload (Formbook)", "value": "0b33a3b6d6a99610df315082c14e5750b352810fb7eec27129267d8614a1c02f9bdd143b491319edf62262fde95aa814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404463, "uuid": "a33b6823-d335-46c0-b514-e4832da9b4a3", "value": "T181F41210B76E1013C91B5FFD49A026B2073E759BB131D2DB0DCBB2AAE9A5F065A10B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404463, "uuid": "6aca096a-a4aa-4e9d-9121-a4e4f41bac13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404463, "uuid": "c3f76020-e12a-4fda-930c-f1a5f42b3c4d", "value": "12288:DVXpM1JCIQfNsVcuoQHH0s2TyNb8wwZtIFkkV/ivuGLarSefig/eYMmX8GwX:DI1KNov/6tf+SefigmYM1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687404463, "uuid": "4fc7e936-68fb-4489-8f9e-0cd6228da7a9", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687404463, "uuid": "cdc0b5ec-fadf-4c17-a190-2ea60138de7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687404463, "uuid": "44109465-cc5a-4060-959c-742561149969", "value": "SecuriteInfo.com.Win32.PWSX-gen.4335.27687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f2c00d-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687414063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414063, "uuid": "b0fc565d-9c26-45f0-8bce-01866d42c998", "comment": "Malware payload (STRRAT)", "value": "66e7309c30d55f9102671a834e949e63", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414063, "uuid": "fac1e3fd-efdf-4afa-a3cf-52ba06181573", "comment": "Malware payload (STRRAT)", "value": "9291fbf0bd2d82742c20901fd068e9e36fc7e8dcc644716f8efb863514cbda8e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414063, "uuid": "ed03f7a1-d1c2-42f8-8870-d2d1277e3665", "comment": "Malware payload (STRRAT)", "value": "caebd51236950f7cdb371bad87c722ba555bf2a4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414063, "uuid": "7b748eb9-15f4-4ff2-876c-54ab7ffa3188", "comment": "Malware payload (STRRAT)", "value": "bd26662480f86df5a8820ece3b8cdbc9155d8e06fd3a50289cd167c134c97a11d1e6715cae7c84e88749124f57d1a4f6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414063, "uuid": "7f7b3f72-f974-4678-afb7-e409a0a9a91f", "value": "T17A24018FEC9AABEBC12F1032114A81769F0D9295C1431A1B66EC1E982D74DDD1F43E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414063, "uuid": "6570392a-d8b8-4dca-b6c6-ee13ab0fdd18", "value": "6144:hEw1+EZBz60uvSx/q7odBgvZqsTS+YkPpx625M7iRAeqW6Ke:KhEZ96FvX8LgvZqsTS+YkPpQuM7SAeRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414063, "uuid": "43d7be26-c5e1-40e7-9350-6e9d61ca6bd1", "value": 223513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414063, "uuid": "e267353b-2315-4e3d-8dea-12f7c458ac67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414063, "uuid": "61d14dfd-cf45-4fd5-b94c-2b6ea714187b", "value": "PO 7648.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6889e285-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687430086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "9deb3523-d942-4946-be76-3bea092f73a8", "comment": "Malware payload (CoinMiner)", "value": "4f9ecff924cb68f11ceb7871eb1e3cc6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "25ed4d72-2075-4d97-9205-18e7ec733dbb", "comment": "Malware payload (CoinMiner)", "value": "92af4af2f69e4483dfc37894d1f5cf1f2fc3cfa343af82a54eb1b3307c09e91b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "80c85fc4-0bf4-4da7-a97d-944669fcdb28", "comment": "Malware payload (CoinMiner)", "value": "20eae8ff10ac165896d860ae43e914174d534c65", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430086, "uuid": "3bc3872d-4216-4a50-9fc4-2eae2098be60", "comment": "Malware payload (CoinMiner)", "value": "293becbf1e2a79b176bfade9b918d02d418ec332ed5f792507a39fce1f1c91bee523b895ee68dff98cbb1e2b4134b3a8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "1d11677f-92cc-445a-b1f2-8b1bb53d7d8b", "value": "T1D716DF587A421C9ADD5513F3E96706081E90098B0F59D96C3BDBA7CB873D6E3C9CE28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "5bc3429a-2918-4680-98ff-1d5dc5e8c539", "value": "98304:OX8iDfhu4gMReIneNbp8SEP6vyT4gbki4:OsA9gMReInui8Wj4i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430086, "uuid": "6587b331-db68-4b80-911a-751ee19fae7c", "value": 4171440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430086, "uuid": "b7696ab7-3f55-4e03-bba7-acfdc7043492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430086, "uuid": "2fbede39-adb0-4e67-b2b5-634ebc65c924", "value": "4f9ecff924cb68f11ceb7871eb1e3cc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbcc6f9-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687414073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414073, "uuid": "60bf41bb-d5b2-4e9c-bf1f-8f2c68a10f52", "comment": "Malware payload (STRRAT)", "value": "e7c35bd671c7385027e52cd1c3f7ec54", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414073, "uuid": "c4d662bd-ea3b-418e-afed-0a5dc7ce5407", "comment": "Malware payload (STRRAT)", "value": "95449adf7e325172ef356e96a8c69758d7ff503a313f7cc1b1d2a6a288989212", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414073, "uuid": "863fa2b3-17d4-4319-9be6-35bc3fb86606", "comment": "Malware payload (STRRAT)", "value": "2bc143eea58f2a4347979544677f4bfdd725b424", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414073, "uuid": "a82b53c0-aa54-409a-b830-f172f2f4effb", "comment": "Malware payload (STRRAT)", "value": "1d50f870fd8d34568294b5144ea878ca59252b7108d45e1d5f68b311d5aa21b2136d6ef767f32bd13f76faffb75d8198", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414073, "uuid": "db350f71-be49-4997-a288-69302c15fa2f", "value": "T19324F13B79DFC5B5D01B80B20484E622A25D11ACDC2AA12B65EE599B2D71FCD4702FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414073, "uuid": "5dce1452-10fd-4ef4-915d-f79623eb7f93", "value": "3072:H/e3r5c1RYevQi9eFsSHLwSwuIjUt84RzEV7CIFkYNed7rxhj/iX1aUq8:G3r5c1NoUeFFHqHIj4VnFEhrxhjf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414073, "uuid": "47c91c04-e223-4248-9863-df69322fc356", "value": 209548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414073, "uuid": "b4549f47-5770-4750-ab8b-a7341fe7ba86", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414073, "uuid": "cc9af8ba-428d-4dd7-91cd-fbfa7476a55d", "value": "INV_PKLIST_BL.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7075cc-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420989, "uuid": "53cd9868-c4b6-41af-8ffa-cdc7459657b8", "comment": "Malware payload", "value": "5b26d45ce6e588cbb9221ae55704a5d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420989, "uuid": "531d16a8-6154-4e96-9f33-6ec7ecdec032", "comment": "Malware payload", "value": "9577d824e89b104c425a286743c476cd67b2ec6408d12000c126b4d56848de7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420989, "uuid": "4223c253-f49b-4abc-89c1-800298970cb9", "comment": "Malware payload", "value": "e7af06c555fa086172b595631de59bd006aae2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420989, "uuid": "d6ec01ef-f0e7-4b3b-8e82-e555930abc92", "comment": "Malware payload", "value": "d56d60d4c3ab72dfd08884fd111b836b468356076ffebf0b1d59864839ba1dcbe5a0db030864995061cf4a8caa74d265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420989, "uuid": "fd747f60-0740-4f86-aeaa-c7e0f35caa82", "value": "T13244E053A7D89073DCF4277058FA02D31A317CA18EB4836B5782AD5E0C72AD4B93576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420989, "uuid": "144431d2-97fe-4650-a06f-c429ba37a764", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420989, "uuid": "1156fb4e-4a33-4a0e-a22f-b07eaf5929a0", "value": "6144:Kfy+bnr+Cp0yN90QEtt9+FrqxveyRmJXRRhD0XQxDEnPqRYs:xMr+y9019uQ2JZDCQ5ELs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420989, "uuid": "a21de5b4-f95e-443a-80ea-db4e70439b46", "value": 267487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420989, "uuid": "751ae41c-5ac9-45a7-bda9-3e962bad9ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420989, "uuid": "a73bc3a6-f80e-4bf2-af22-066be660b718", "value": "5b26d45ce6e588cbb9221ae55704a5d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2def4d89-10f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687434283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434283, "uuid": "ca4a5433-fb53-4be3-a286-3e4c20af3df4", "comment": "Malware payload (Stealc)", "value": "31ab2bd3548d88dbe55c3b29bb508a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434283, "uuid": "d3a78d8e-d032-4a0d-9de2-d5ad7055d05d", "comment": "Malware payload (Stealc)", "value": "96e7b111f5c981f0649ecf886f42578147bf79133d387fa0b400f18ccdd14249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434283, "uuid": "653eaa47-b285-4ab6-9f5a-5893d8898b1a", "comment": "Malware payload (Stealc)", "value": "891aa1a9232a84b1c9326e167ae3c85990ec4862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687434283, "uuid": "4eb9ff02-6b98-4c36-9916-b7c04bbe807e", "comment": "Malware payload (Stealc)", "value": "c70deee7e9ecfb7ddab5095cd65dde8ebeecb35f8af8f9f7a06142fbc39c1c360436f33af6db605f33e8671d08cfc08d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434283, "uuid": "36e7bdeb-f06e-4b26-bd1e-d7758089fa02", "value": "T1ADD63317B9C545ABC9C5A2BECCAE453122B6D26B3726D70D353E7F0801B23A99D490F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434283, "uuid": "3ace5a39-2b4a-4641-804a-046cded83f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434283, "uuid": "35aa02cd-246f-4f4a-8ff0-f989e666d52d", "value": "393216:nOLD8oSqcY1vn2eGJ25bd+PRdMOTXY+o1:neD8o1coP29w5KdR7Jo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687434283, "uuid": "383a11d4-c6e8-426d-83a4-2e6bfcb69689", "value": 13733888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687434283, "uuid": "9bcb69b7-0b82-4e52-b3cb-21168368a70c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687434283, "uuid": "85b9c2c9-2316-467c-91e0-b46fdf182794", "value": "SecuriteInfo.com.Variant.MSILHeracles.88976.31002.14248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bf68ea-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687430132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430132, "uuid": "36c6b44d-1aa7-4284-b525-50a9acb78c36", "comment": "Malware payload (AgentTesla)", "value": "ddf58cf7888a97fd914c45aa3c0d968e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430132, "uuid": "a0893168-34a2-4b79-b6b6-8160230e226c", "comment": "Malware payload (AgentTesla)", "value": "987a4d7b9be473efd2aa0ff7f0958414d64e0fa058bbaadb702c2024dbc9562c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430132, "uuid": "6fe1cf1f-8bd4-45b7-b17a-c3146b56e6f9", "comment": "Malware payload (AgentTesla)", "value": "43465f7653fba854ce4352e3a94b3430826774bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430132, "uuid": "1c61ba03-a3a3-4020-ac43-70751e6f283d", "comment": "Malware payload (AgentTesla)", "value": "6a42b14f7544991730eb36344d09dc4eb9c8940825954e2167bfa05c7c98d5588d0535a984946da6d5ad8734c75b7d7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430132, "uuid": "09748ced-b15a-44f4-9b3b-ff36a23f5ba7", "value": "T1C645E140325A6F61E47E8BF60921427057F66E6BB43EFA095EC7B2EA15B0F118970F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430132, "uuid": "715c7340-a41c-48e9-9de1-ef7b8f684d51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430132, "uuid": "466d9b32-54eb-4163-a27f-d5debbd957b8", "value": "24576:H7MyuyF18VpjwJ1KNoyGm+wj3LNYJlzlO86R3noJ7BjftcPTeD4L+RZwKJzw:H7MyuyTW0J1KNo/mRbn3JoJFdJzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430132, "uuid": "829436df-2cb9-4c87-b4a6-f6f8eb82908d", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430132, "uuid": "a8d42c7e-5191-485d-9242-02ae327a3f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430132, "uuid": "1d3852cd-fc0f-4bb9-8dfe-4b0fcc101345", "value": "ddf58cf7888a97fd914c45aa3c0d968e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4264f6f-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419073, "uuid": "0c529212-113c-4688-8157-a4635531feb3", "comment": "Malware payload (AgentTesla)", "value": "dfadbc955569424735b58044fb3179dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419073, "uuid": "b16821d2-6700-4b28-81ea-10f7ce865f30", "comment": "Malware payload (AgentTesla)", "value": "996802dcddf7a2afc542a0d2eab92d8243a3126dd2f9a8c6e8cb9cebc09e8d61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419073, "uuid": "ff7a3218-d48c-4566-8286-9045aee236c6", "comment": "Malware payload (AgentTesla)", "value": "be6416baa4e5e7717d2b4fa92802038837e4d13f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419073, "uuid": "5b2c9106-31aa-4a70-b226-8759b31f9f15", "comment": "Malware payload (AgentTesla)", "value": "1d0e86dbec1c0694c687e4fc0b46e84974133d16794d8fb467e8dbd3ecfc1cb26b876c2e1ba37af8ddd0f5db9df20693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419073, "uuid": "a60304de-d3c4-4be6-b6e1-b6c6b2e576e3", "value": "T143D41219382B1711D9B64BF411132E7083BF5EAEB022D31F4CEB70E69929F1A4692F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419073, "uuid": "c1659cfd-c372-4de5-b475-72f016f98091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419073, "uuid": "18126537-cfd5-4a1f-abbc-719099906048", "value": "12288:RpdvDhH62MmgPFkrRvBPNFT6QS7qTvs8a44qM4+RldW/VwJ5tkTjq1swnxf9:TdvDcAw2RvBPNFT6d7Mvs8a44nnNAqS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419073, "uuid": "fd76dce0-c1a0-4c32-866f-885ea0458439", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419073, "uuid": "82612c39-4a08-4c5c-a4de-14042c181f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419073, "uuid": "d121d1b3-c675-4ff1-9c8b-64a8aab2cb85", "value": "dfadbc955569424735b58044fb3179dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60cae5f-10c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687414003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414003, "uuid": "5f1b9c4e-9bdd-46a3-9cf0-85b21c463ed3", "comment": "Malware payload (AgentTesla)", "value": "723eddc3ee5191312480f0874b356fd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414003, "uuid": "74283a9f-07bd-4153-89a8-22d7d42ba279", "comment": "Malware payload (AgentTesla)", "value": "996fdb5a25f89426e241f02094474706fafd567fcc5980a07ac7a38efa8625ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414003, "uuid": "ac1af15e-dd75-4bb8-98e2-efa7aaca6816", "comment": "Malware payload (AgentTesla)", "value": "5adbb8b9913119f794423dd913ee7c169e929d98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414003, "uuid": "cf4d404e-7148-4aca-9087-0824e04f3ab7", "comment": "Malware payload (AgentTesla)", "value": "dcd97a6271d87f8d7ff11fba98d9794f3f8669c1e7d8600b09f7888683cbec34e197778e65929f662c709aa5e8c32509", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414003, "uuid": "cd0c2d95-5a15-4843-a14f-9b49b44f89ce", "value": "T1DAD41214723F4B11DAB25BF14A111630437EAD2C7532E36A4CEB30E66AA9F5D8663F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414003, "uuid": "48001701-06db-46ce-8a3f-4b6fc1fdb617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414003, "uuid": "81debf7f-51cf-42ad-ac1b-b1c91e6c2d7a", "value": "12288:KpdvDhH62MmgPFmmUqH5wIJNeJMC/j5ag830uvsfcENo17XoVRsMI:QdvDcAwEEHmi0MCljlPyMDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414003, "uuid": "1bb7e106-e7b4-4444-8ad1-d536a6f4fff3", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414003, "uuid": "3c9f6ade-deeb-4654-8035-fe040f093fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414003, "uuid": "ef5e1a6e-5674-4ebf-8071-312554a50131", "value": "Orden de Compra -046798.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b96bb7-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420951, "uuid": "51f5fb2b-2416-4f3f-9b48-7b4ca5877442", "comment": "Malware payload", "value": "ed54723caac31190fabcdf7372596bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420951, "uuid": "d86b4342-efa6-4405-8db2-90ea1401db1f", "comment": "Malware payload", "value": "9a8d730a07ba848a7ebc882f5d22985756dc8c5fdef8e4159733149bb792e2fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420951, "uuid": "f8002381-bf47-4cdf-8486-f39415cc7330", "comment": "Malware payload", "value": "423e2129c291fc69b3bb975d081eaff079cf77ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420951, "uuid": "93b928bc-3939-4521-b5f9-fd0f0d2fc9cc", "comment": "Malware payload", "value": "3373f1e5d0b80a14bd7ad734af567096383f15614f82f12125820015f4a4b4d8610b17f441b25a1c5d68e1133b9594a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420951, "uuid": "f8fd7137-f424-496b-94d2-f257e3e0efce", "value": "T17414D053BBD88173DDB52B7058F702D30B367DA09D78836B1792AD5E0CB2694A83172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420951, "uuid": "372c05a0-8fc4-42f6-9813-635a1788705e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420951, "uuid": "560c0aa6-2888-4ab8-b35e-e0487cd8d142", "value": "6144:Kxy+bnr+fp0yN90QErMqq1xAkQwI8yLwBzZU:rMrHy90Sqq1ON82wBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420951, "uuid": "2e0d4fdb-9221-4e89-9bea-1c00775031fe", "value": 201041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420951, "uuid": "10ef7a79-6a69-4598-bddd-c928daac4653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420951, "uuid": "af83f48e-0afa-488c-8166-6bad10d1a5c0", "value": "ed54723caac31190fabcdf7372596bce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc97434-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422206, "uuid": "42aa1cb5-7943-45f0-9878-015a8592e222", "comment": "Malware payload (Mirai)", "value": "5f4ace9f6d5088560e3997189104c085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422206, "uuid": "182fa0a0-cb2f-4117-a290-e699814d3e12", "comment": "Malware payload (Mirai)", "value": "9af1f0cee45b1dabc566786b84be1a963ab3cfef3ceb40fd694ccc7abe2ba47e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422206, "uuid": "82f59908-f6d6-4b7d-b211-63859f822728", "comment": "Malware payload (Mirai)", "value": "20b3419c0b47597ce4861015f46a7b7c4f91eadb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422206, "uuid": "22441baf-05b3-44d6-8ec3-657242b2fbec", "comment": "Malware payload (Mirai)", "value": "3e78947b8c95e93ddb5ac9bcdafada681f6eb0e447693a1b48d32cd43f493477863f74fe2c12c38a3e094f4324600d3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422206, "uuid": "ec29ec9a-bfe9-4933-a93e-e78bd70489b3", "value": "T1DB030982BC93996BC6D023BAFB7E169C736763D8C2DF3313D8101714A68695F4D23A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422206, "uuid": "f2a95184-d553-4942-a667-577f6869a1b7", "value": "768:DeeO3kiYI/z2EkG5m++I8pbd7K0h4LPIXzp6IKoHkGVQogq9vkMP6nz3a:qdiI/z2LG5mp4LIXsIKVGVTZk86ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422206, "uuid": "3f1c0c27-088d-44a2-8710-b2652501c8d1", "value": 40436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422206, "uuid": "18646791-e1ff-4668-8ee4-76f0053c43cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422206, "uuid": "66200c97-80e5-4734-91b4-b212d9466200", "value": "5f4ace9f6d5088560e3997189104c085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15eec900-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687430377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430377, "uuid": "e3899ef7-35b0-41bf-8ac1-2557f9da2478", "comment": "Malware payload (AgentTesla)", "value": "56aa331bddc7610a7d5faa93e37f09c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430377, "uuid": "18cadefd-944b-4c2c-ae01-f273221cb4c8", "comment": "Malware payload (AgentTesla)", "value": "9b41329934970c166c34f86d83d5812c15c36c0b433150597598d78469a48514", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430377, "uuid": "b68e5aeb-944c-463b-a04d-29c6e99cf71d", "comment": "Malware payload (AgentTesla)", "value": "69496b93b3b49cf23982d4e97ee9a714715330dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430377, "uuid": "927873aa-3bca-420d-84d2-44d0ea27b6fe", "comment": "Malware payload (AgentTesla)", "value": "f3e7255312b90cb1786b59da24555ab04669f23ee663716377211dcd240cf9d33bb2d9d488bae0d2bbb0c7fb99cb01d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430377, "uuid": "7702830f-592f-436e-9c8f-1fd9b256f044", "value": "T15DB42349E1A81FBFD8CA567E496023001B7AE5F31319E79E63C234BF57152A8A30E167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430377, "uuid": "113b188e-e846-48e6-92c4-9affd21f4376", "value": "12288:LzzzluBzg1tc/HAUMDx2fSq3T6mWpWgQB1n0zQ2BlcThvZzzzzzzzzzzzzzzzzzX:LzzzluBzgM/Hq9ET6mWpWgQB1nKVlc/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430377, "uuid": "6a7bde1b-2f13-4ccc-9d99-e17a15479a5c", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430377, "uuid": "0b5396aa-d59c-4892-b288-950214841bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430377, "uuid": "7f5fd31a-cb2e-47b4-a6af-bbcc69d9b2dd", "value": "remittance balance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f10144-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459523, "uuid": "e0fb812b-1ec5-438f-a62b-e9cbb15b21e3", "comment": "Malware payload (RedLineStealer)", "value": "4cf6af34dd4ef73a77ca8c4aa86cf20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459523, "uuid": "a0bfcb06-f665-46bd-a6b7-0cae0b13cfac", "comment": "Malware payload (RedLineStealer)", "value": "9bf4fe113d9d646e58cd2facb609c9793e02517f0ea95a86940dcb0f6d916804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459523, "uuid": "878804ab-02b8-4a17-87d4-a494fb46c5f7", "comment": "Malware payload (RedLineStealer)", "value": "8adf4c6b1beee2d403de75b63274d957c8edb45f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459523, "uuid": "36e9e657-e46d-4f68-bd30-9c5a2773181b", "comment": "Malware payload (RedLineStealer)", "value": "bc30172ec1b750cada57af948b3dbc1053639c2021d39c0adb19d69c176ca9eef4c95573ad1a8bdc39aaba582c6be884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459523, "uuid": "40623ca2-4495-4d42-8660-6102eba01e08", "value": "T1FBB4F1DA26804933DF73C9F1D4EFE9868E7971314B704BCB121C9AF64E001D4A61BA3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459523, "uuid": "f2415e12-7fb3-43c7-b842-b7c187cc630c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459523, "uuid": "6ce611b1-451b-4b66-b2f7-73ac0018d531", "value": "12288:FVeeetTey5svI0FJUXM4xcEy0NhAudGEc5QJQmZ:FVeeWTey5sAKJUXFcEDNmudGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459523, "uuid": "06ad069a-8628-4d81-b4ef-58bf847feb8d", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459523, "uuid": "3ff308a0-a32d-49f9-8418-7686cb0eea3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459523, "uuid": "2a1108f8-9882-49cb-8798-d0fc7d618e43", "value": "4cf6af34dd4ef73a77ca8c4aa86cf20c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124778ab-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1687414050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414050, "uuid": "51884ed9-5451-4f4a-8e45-367d051f9eef", "comment": "Malware payload (DarkCloud)", "value": "b49293d78cc176b2167e2344c83d6f69", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414050, "uuid": "42fa4cc1-0718-4945-87ed-5d8574c31a6d", "comment": "Malware payload (DarkCloud)", "value": "9c5bdf30f12f3176e6bd39ebc0898fea8fbe093af34a6894180ceaa78af5f192", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414050, "uuid": "86dfa311-7a7d-443a-adb3-4f9356865668", "comment": "Malware payload (DarkCloud)", "value": "81c432c3e18b690059778b7d6a357b68db5b6124", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414050, "uuid": "5f5d7c03-316b-4ebb-b758-1cb8b5d5465c", "comment": "Malware payload (DarkCloud)", "value": "98ac7be8fbe2d83d1790c83bcaee321f762f5cd8db719dcdad820fc41ee3df48942dc76cfc8e936053b76d0ff1d71565", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414050, "uuid": "07be7b1f-5577-42d9-ab65-9df58d7769f4", "value": "T1FAB42379EFE3F44BA38834145DE062C5DCC72C65FA1C4B688EA19DC05ED0DA1AC9A6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414050, "uuid": "c5333c9f-9311-41aa-aa42-7be80b1d3705", "value": "12288:Kt/7qGI3wEpNFfu5eE05k1Cce4W2NyYq9NbXC58q+mzp0hJE/6:Kx9IwxIMW2sYq9NO83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414050, "uuid": "9a2010a6-0730-40c8-961f-e6400cdab588", "value": 518014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414050, "uuid": "43671b76-a579-4511-a702-60d2c0a76175", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414050, "uuid": "d9951db5-bce4-4afc-afcd-4c2cf338576b", "value": "INVOICE.213223421.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9710da9-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430249, "uuid": "bec8b4b0-61fc-4d02-be09-4b57c7ee0fa9", "comment": "Malware payload", "value": "22adfdedaf7b6f28a2daaaa66e2a1115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430249, "uuid": "7a3dc496-9476-45b3-95f1-0089b4a1d806", "comment": "Malware payload", "value": "9c5f8a135e8ccfb39dc834cd68e0a03e55748996afc05d79a20797ea3139093b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430249, "uuid": "847cb9ae-4e14-45d4-ac09-22c64700005f", "comment": "Malware payload", "value": "456a2fb564eb6a77076653ed43f9c525841b95d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430249, "uuid": "a2a7d9f1-8d17-4f86-82d1-9173a99cc352", "comment": "Malware payload", "value": "de4e1a0f1ea969880d950c5a688579bf3a97352d79eb30317354c9ba3ef5b5f3124a9ed3fca68136e1a961fe26a822e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430249, "uuid": "92a81e2c-8bf1-4a28-a116-9504536a2af3", "value": "T1DD3601320532BDFD8B5C389194051B452CED5C27534ADFACFA4414EF29A1738AA7FAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430249, "uuid": "e1bdedee-fb3f-488c-b581-c4b932ef66d8", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Yu:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430249, "uuid": "9301d355-22d3-444c-abe2-438e6b294a9b", "value": 4955171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430249, "uuid": "590aacb1-89c3-4e1d-b9df-d707413aab62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430249, "uuid": "073b8d12-58c9-4b87-aa52-ec9b44f61f2b", "value": "22adfdedaf7b6f28a2daaaa66e2a1115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc2f2af-1156-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687477580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687477580, "uuid": "3928e303-1bf7-4e17-b160-1be9ca6e7ede", "comment": "Malware payload (QuasarRAT)", "value": "a9db2789f14e86e7d66d97ce42bb3d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687477580, "uuid": "ddf4bdfb-7fa4-4c50-9add-107397702f04", "comment": "Malware payload (QuasarRAT)", "value": "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687477580, "uuid": "c7bcc67e-64f6-4624-8fd1-5b772f840d14", "comment": "Malware payload (QuasarRAT)", "value": "e3c4f4dc3aada1cb7a98d3d73edf3d58c64f6f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687477580, "uuid": "d443566b-437d-4300-a215-f0eb341d09cf", "comment": "Malware payload (QuasarRAT)", "value": "0ef195ce1022622c782cb0eea99385d691dfd0609a59c4f9dfdd01943799a617abd5037390fe0169535dad557f88de17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687477580, "uuid": "b1c2a306-2bb6-4797-a7a0-2c2c00eadc53", "value": "T17CE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687477580, "uuid": "e2a7f8fd-b9c8-4cc7-89ac-19bbfdec467b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687477580, "uuid": "ffcf18ad-ef33-4fac-86da-40376bc6a86d", "value": "49152:DvUt62XlaSFNWPjljiFa2RoUYI0SRJ6qbR3LoGdBTHHB72eh2NT:DvI62XlaSFNWPjljiFXRoUYI0SRJ6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687477580, "uuid": "f521fdaf-3ddd-45c3-b575-7a4263f2b6ce", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687477580, "uuid": "f8ca0e85-f86c-490d-aa8f-6af8d6ac8ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687477580, "uuid": "be99c08b-12db-432c-8916-5644c36a6801", "value": "a9db2789f14e86e7d66d97ce42bb3d79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6ba47b-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687420377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420377, "uuid": "bb1a012e-03f6-4756-a3fb-aa3d28a5486d", "comment": "Malware payload (SnakeKeylogger)", "value": "654e3d588dd1d5030d147d68c42fee06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420377, "uuid": "26cfea08-3965-4644-a1dc-54ddfa3cee01", "comment": "Malware payload (SnakeKeylogger)", "value": "9d3b203f9301ae7c6943e12c62db105761ea10f6b6a0fb3993805c50b4a345e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420377, "uuid": "eae89a21-f690-4141-a475-e237cf2cd95e", "comment": "Malware payload (SnakeKeylogger)", "value": "c09dd150890a7626da3716675885a6830f7f7616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420377, "uuid": "cc90c9b8-1168-4362-b248-8dbeefed0a9f", "comment": "Malware payload (SnakeKeylogger)", "value": "c393d390fe06bd48deea99d06792530c9b464093a3499143e4fc6e2428a3e4b8e05638cd7a7f0a71f0eb14c1ce1ce443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420377, "uuid": "4f87df72-fd92-4882-9a56-9a99488be351", "value": "T15125D050329D9FA1E4BA8BF60561527057F66E6BB43EFA084EC7B1DF25A0F018921F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420377, "uuid": "4aa72374-9979-4a45-91f9-991f3e9da89a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420377, "uuid": "40405dca-2aea-4fbc-9d93-0107c9bc1e21", "value": "24576:Z7MyuyF1eS11wJ1KNo9uc7QmehQlg37m/:Z7MyuyTHqJ1KNoQcsmQQG37m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420377, "uuid": "ac2779a7-25bb-4652-9df6-cfab6802d9ce", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420377, "uuid": "14915225-2907-4103-9f97-78c36153a847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420377, "uuid": "255f4c88-c92b-4de0-86e3-1d50dca8d6dd", "value": "Payment Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159e8413-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422646, "uuid": "967e7d25-8f3a-4317-a789-4eed375c8d79", "comment": "Malware payload (Mirai)", "value": "729ce7c2e44c8658a721d978daf145ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422646, "uuid": "925d97ab-03f7-49ba-8a59-d9e5928c77e1", "comment": "Malware payload (Mirai)", "value": "9ed51c4e27ec9466a95fa1cd1d8a18a25c070cceac0863b45308b99f72a49e69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422646, "uuid": "211817b1-f651-46b8-b976-3cb90555820a", "comment": "Malware payload (Mirai)", "value": "9030c735062530675abcb7eac830b31ca09e0246", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422646, "uuid": "0cf38f1d-def4-4504-b72f-79317e40a830", "comment": "Malware payload (Mirai)", "value": "45a5c77f5d1bdee1631faf606a650965303864d99f9d04eb552047196cc59379769d5b20350ebdd129a4f5e42d7df827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422646, "uuid": "00608f48-b36d-4b61-aee5-d3d3e21de0e2", "value": "T1DC932A45B8C18E11C5D823BAB92D118E331667E8E2DFB223DD111F6077CA96F0E7B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422646, "uuid": "27455cba-60da-4120-986b-1e1ab9f22f69", "value": "1536:stnHsePF8gaHKpE5B/PYvFZOVq6vdSiz5kuA506MlO0r7i1KAoGT02zrIBi3Fes0:OsePGYE55YdZOV9lptXEcVr7i1K0UsEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422646, "uuid": "508fe773-3e5f-4d3f-887c-cd15035a8b29", "value": 95536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422646, "uuid": "47b94e0d-1083-4d19-8ad7-1834a7a258d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422646, "uuid": "c76f6b10-34f3-4c7a-bc0a-8be8339f7b56", "value": "729ce7c2e44c8658a721d978daf145ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14ac516-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687413485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413485, "uuid": "38088682-7bb9-4e98-b8a1-c7e90e8ae8c1", "comment": "Malware payload", "value": "ebc740b14026b8f52afa6f7cc19cfa0f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413485, "uuid": "dcd5422f-2412-460b-b330-7a7859bb4d76", "comment": "Malware payload", "value": "9ee70d9f24ac1a6e01511a4e7e932ac0f0f4c54c5062fb31733f8e82bf4873b7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413485, "uuid": "a1250c2c-ada0-41db-ba3e-bd871e86305f", "comment": "Malware payload", "value": "1155dfae4284e713be0c25e52182b9d46dce1d7a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413485, "uuid": "9379a79e-4da2-4093-83f5-102a69c0c473", "comment": "Malware payload", "value": "6375ef369e59e5631104a5024633d2c27b1177bad63236955da155e4343d6df8c6418acc2bce782e0bef14e883f9140d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413485, "uuid": "b83e98ca-45ca-40fc-9db5-c2c5066f7b05", "value": "T13624F723B907CE57E52087B43BE6F9610343AE137D595A962AC3B20E17F734068CAD5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413485, "uuid": "9ed20046-8d19-4fd2-a0d9-d56b4c05c5ef", "value": "6144:gZ+RwPONXoRjDhIcp0fDlavx+W26nA+YaFFkKzDHU7MRW2Ch8NjKJk212/X2WaHA:VaFWKz5RW2Ch8NjKJk212/X2WaHLiFx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413485, "uuid": "abb642f0-faf6-48c9-b1c2-e0d7f7bb15dc", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413485, "uuid": "a4aaaff4-6df3-4f3f-81fb-1f7c07bec535", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413485, "uuid": "8f07c8c6-6e59-4d0b-bdb7-cd30ea193251", "value": "INVOICE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db17fdca-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420830, "uuid": "c8abc7bf-e8a4-48cf-a058-d4a811963c53", "comment": "Malware payload (AgentTesla)", "value": "1fbe15cfcd0547acbb56d5d4e2d9f633", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420830, "uuid": "2ef34774-8765-4ad5-af5f-1ea514f44089", "comment": "Malware payload (AgentTesla)", "value": "a33386722e1ca47e58e3486682dcd2e1dc5e2c7d7b40a210d5902f98f3fdce7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420830, "uuid": "65280cc6-156c-4723-969c-2e71d0710614", "comment": "Malware payload (AgentTesla)", "value": "450806fb580ba2290c537be2a66e00ce4d753c85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420830, "uuid": "b0d03574-bce1-46a6-861f-67d75357faf1", "comment": "Malware payload (AgentTesla)", "value": "040f81d3f9ce9601e9d1327b8f9fe06224dd1298e20232cb96c0be926231972cc8a351109a7e5d1e62dddd044c03af2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420830, "uuid": "2c9eb2f6-ca18-4e13-8e05-b1530592bfac", "value": "T15C0523E392786654E31FDCD29B13E972FA0401A2D6622FF18135F9061170EDAF90B6ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420830, "uuid": "c0a52973-be14-4e65-80a9-807a5c2c2677", "value": "24576:w9uGU3CaM/TDXBg5RisussXuhBoPtR5kcydFJ3Bg:wXDRKdushoFRRyNBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420830, "uuid": "fcf88ae8-e030-4bf2-b63a-f74d392084a6", "value": 810758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420830, "uuid": "8fbe310d-7875-4ae2-a2ae-d088bee0e833", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420830, "uuid": "d3c24c9a-6d94-4b71-b3ad-cc9517efd6c4", "value": "advance payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a22cd60-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687413285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413285, "uuid": "1332f4c4-26fd-460d-a7cd-731547d53333", "comment": "Malware payload (SnakeKeylogger)", "value": "deab5181607827be82e29e7e299f6382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413285, "uuid": "481d0136-239f-4b69-a482-c1711bb671dd", "comment": "Malware payload (SnakeKeylogger)", "value": "a3430608a12c28da3c2f2dbcf65a08fcfde288a8bd99c6ea3162abef4dffaba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413285, "uuid": "d4c29aed-299a-4359-b6e5-a18d6c9c271b", "comment": "Malware payload (SnakeKeylogger)", "value": "b84c5ab9e6fdf128e06523c6d6720573120cd828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413285, "uuid": "11318901-21d8-4325-8531-54a463b7570e", "comment": "Malware payload (SnakeKeylogger)", "value": "7531b8914755c546212e2a944be3b87e17cdf0d16f62f2eda1de2f6d2c3032609a167427bf2a42cf5c7933efcd2ff73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413285, "uuid": "0f63c34b-e57b-4a8a-919a-94b61950610e", "value": "T1B2F4CF907BED0B54E9BEA7F58934623503B27E1E346ED28D5CD270DE1971B800A62F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413285, "uuid": "6075f329-5e6d-46f4-a242-637693cb64ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413285, "uuid": "b7e36090-c355-45c4-b9e5-f85bd490d452", "value": "24576:vg7UmdvDcAwVweYwpoFqJxsLi6/V5RXsPlQ:47UmdvQRVNYwwnG6t5RXstQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413285, "uuid": "338804bd-0efa-4922-98bf-5ef4db887a28", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413285, "uuid": "e6734242-f190-4f9d-ae1f-cddc6e1edc7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413285, "uuid": "a42acac0-f801-469f-b8f9-3bcad19561e0", "value": "VESSEL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d404ebcd-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1687419959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419959, "uuid": "02dd90a4-fb8e-4018-95c8-3b39d170d792", "comment": "Malware payload (PrivateLoader)", "value": "67ecad90f956a001f8943edfdf3af990", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419959, "uuid": "0853b2fa-0bf4-4d5c-91e9-7894e6395b50", "comment": "Malware payload (PrivateLoader)", "value": "a38579567c1fb5ca9774a9fed97860aa7d0badc64de69e4da3e75b6b842b96a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419959, "uuid": "56deee22-c052-48d1-8c49-79b592c6b9cf", "comment": "Malware payload (PrivateLoader)", "value": "64dc6e76deba35c8f303cb3163b33efcda8f9dff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419959, "uuid": "0d78fa3a-488f-4b2c-99b5-df2e1f61aef4", "comment": "Malware payload (PrivateLoader)", "value": "74002291aa048fbf6178f2797a2ec3543444459b7caae4461a3f24f634fb021b289b626692ed71283ba918d8c2293c96", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419959, "uuid": "7abf0c9a-5173-451a-8107-57de88575575", "value": "T113348D5075C1C072D9AB2C314574C6B20EBDB8311EB0DA8FA7D8193A5F356C2E625BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419959, "uuid": "dec09c59-733a-45e5-8b51-5cbecf22c023", "value": "b160e82af058a746bb7ff4c92e78e05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419959, "uuid": "34b579da-5d81-43eb-8847-48bede04a9d8", "value": "6144:Q/l3Kt4fRnA+63C7WlEUJe7R9r92hKs7+LnSkayT:QJKt45nA+63C7yEUJe7R9r92hKZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419959, "uuid": "7f242686-5bf0-4871-9a92-6f57f127b910", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419959, "uuid": "8ceaf001-2784-479e-a50f-08c3a5203a2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419959, "uuid": "d760f9e2-37cb-4bb0-9e35-c9b7a8e0ccbd", "value": "SecuriteInfo.com.Win32.Malware-gen.7216.23369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1870f5-10fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687437712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437712, "uuid": "3547faf2-9026-40f1-9879-e2bb868a4c79", "comment": "Malware payload (AveMariaRAT)", "value": "e57bba2b63d77745a1d9bb37e108b982", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437712, "uuid": "7859d559-cd2f-480b-b335-477883b1a4e7", "comment": "Malware payload (AveMariaRAT)", "value": "a5202fde9f9922792ddfb540ddf4aa409be00a762cb4b9d2b2a22d36e0713952", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437712, "uuid": "a79d5c77-1a28-431b-8a5b-26865213dff8", "comment": "Malware payload (AveMariaRAT)", "value": "6f97d223d867b0eb68e1d2307e569c569118dca9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437712, "uuid": "d14eecb6-3b0d-4e51-9418-306dcb3d73b7", "comment": "Malware payload (AveMariaRAT)", "value": "1caede1c0020d71c7e645240d0b5c31a55a54efddf7eacbfdc9c55b42ff492c713dbb663fe956fa6cb2ad6c9fb32076b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437712, "uuid": "ffc5bc9a-b850-4637-afa6-e293a2e1964d", "value": "T168F4EF14327E2A93E57B0BFB4C52267747B2D686347ED6CE0DD274DA26E2BC50B42183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437712, "uuid": "3a475dcd-0ab6-4859-85bb-acbe505ef4c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437712, "uuid": "6a99e940-cb3d-48a5-9ec8-3110dcf6bd77", "value": "12288:kOO48pdvDhH62MmgPFvLlZex4A+WQrXuLEWr4jFfD9QIFYODPoT:kJ7dvDcAwVLfe2A+bruHr4hfelQPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687437712, "uuid": "441d40d2-26b5-472a-ad4d-3e7bd5c0c571", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687437712, "uuid": "f91a6d3f-196d-410e-8ff8-8bfb38e03754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437712, "uuid": "7f8f736b-b214-4535-9e1c-12c17592edc9", "value": "Original Shipping Document BL CI PL-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed8a843-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459222, "uuid": "58d40f5b-549e-44f6-bd00-21928a4932e7", "comment": "Malware payload (RedLineStealer)", "value": "30a9c81f89c3256c30bfa77593849e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459222, "uuid": "14602a46-da6a-40a4-8423-cc174bb9c0af", "comment": "Malware payload (RedLineStealer)", "value": "a5a5076eeab65c1e316b67e2741d2cbb94afb702269f895b07a541504ad69d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459222, "uuid": "8a678eb2-91c8-4dbc-9f1a-227b9cbf8686", "comment": "Malware payload (RedLineStealer)", "value": "788b4af1dfcdcca4b60fc6555e22bd340ef1bc7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459222, "uuid": "392ac66e-2438-438f-8bcf-a00500482968", "comment": "Malware payload (RedLineStealer)", "value": "d59b8af789da219b988e8608e80df4364f1a2b7f126c10b9099ac9a072e839588b8c1299e641a7f63ff4992d5e888692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459222, "uuid": "08ae1a3a-3a0e-46bf-ad75-f5f44a69c1da", "value": "T134B401DA254049B3DF73CDF1D8EFF9D64A7A6121076247C3120D8AFA8E015D4E60BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459222, "uuid": "9525f0c4-1b7e-48a5-a3e4-2eb6f6bb6b58", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459222, "uuid": "5237fb01-0101-4022-8124-1f510b46dc47", "value": "12288:F+tSODTey5sDmGwzAFxqZcHmixO8QJQmZ:ItSoTey5sDHwTZjiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459222, "uuid": "7f13e33b-ebb8-41c9-85b8-b4d6e35c4cc2", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459222, "uuid": "6e558b8e-f9d7-4da4-bc3e-a60c47b13013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459222, "uuid": "be3367b2-d5ce-4de2-89fa-3a55ff8ea268", "value": "30a9c81f89c3256c30bfa77593849e29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b130e-10e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687426568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426568, "uuid": "150b873b-de6b-4620-8cd1-44515e9b5357", "comment": "Malware payload (AgentTesla)", "value": "2538947abd25e5f6a2df9066c5d645ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426568, "uuid": "16570d7f-62d3-4402-b060-009a5195a04b", "comment": "Malware payload (AgentTesla)", "value": "a5cb5ed5237d5e446dd4c461b4673283bbe2339d513300f19920c1a86a45f6b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426568, "uuid": "04e4eb41-eed6-4360-be44-67ee9eeec2a4", "comment": "Malware payload (AgentTesla)", "value": "27438b2f6397011b20a8d3ffba6ad2aa24d0ed13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426568, "uuid": "8c40d730-e2cc-4943-8996-5a91dcf71f20", "comment": "Malware payload (AgentTesla)", "value": "5f6a9bb2ba57ad957bcac521dd5690f66493fb67bf571c464828e6fe02bfdb87c93034102c71b7b1311ad79b9c864488", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426568, "uuid": "38c07cfa-3beb-4d98-81a4-3ade47ebd7b8", "value": "T1CC25D04072695F50E4BA8BF5097051715BF52A6BB43EFA094EC3B2EE29B0F018D65F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426568, "uuid": "d899fd4d-2238-49e6-a4a7-e7a6aca5fb83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426568, "uuid": "ec4f9def-5b7c-4fe4-8867-ec54fb0566d6", "value": "24576:Y7MyuyF1ZcLBwJ1KNoUn/JXZh489Cqq3Lvl3Q28MCE/UFn9Mcw2:Y7MyuyTS+J1KNoUnVZmLvFQ2JUFnKcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687426568, "uuid": "adf7585f-c612-447e-9804-26a012af890e", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687426568, "uuid": "f3da32cc-ca9f-4aca-8336-a4ee04d01033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426568, "uuid": "da8c9c0e-9895-47da-8106-9fdea0a79794", "value": "001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75361232-1142-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687468762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468762, "uuid": "dc967e76-d3e9-443a-90b2-7bd728f5bf52", "comment": "Malware payload", "value": "0cf3d1816184b338dd8708dc2deb25e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468762, "uuid": "666fc554-b82b-4139-b085-a9d324d567d2", "comment": "Malware payload", "value": "a7587e3bc67e9c2ba8bedecf5b1cc8788503fc1a7327c7bf422ee1387934f9a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468762, "uuid": "feecb9a0-14ee-40a2-bdaf-e44f28d11f00", "comment": "Malware payload", "value": "81e965bf7a9b910c7391b7b6653348c9784b3100", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468762, "uuid": "dfd665bc-1e29-4abd-8bd4-04911101ec77", "comment": "Malware payload", "value": "b41a2f32f3fd7463597439733cf42dd4ec9bab362ca7854fb45093f3f932f804bdf66d8c4aa5128ec83951cb09672f9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468762, "uuid": "172b2673-5a8e-4916-8234-7ca9b1e8b6e9", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468762, "uuid": "a35e9bc6-839c-4093-bec6-414de9fb50f8", "value": "3:oe/phJoEgVVZX7W:oeRjZiV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687468762, "uuid": "ef62b20e-62f3-4541-8bef-2bf4ea784405", "value": 45, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687468762, "uuid": "937d7faa-83b2-4022-8a8b-4a7948ee4941", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468762, "uuid": "36bae853-ae39-4c67-9873-fb29857980ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a704c3a0-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419883, "uuid": "f2bcd6d9-a923-49d6-bfa5-d5d779bbf5b3", "comment": "Malware payload (AgentTesla)", "value": "0fdda67a2395305bce4aee6eb17f13e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419883, "uuid": "d51fe449-b32d-460c-9331-7b77caef0949", "comment": "Malware payload (AgentTesla)", "value": "a86cd9d9db4daa0470d95a86ea5087e34f7d6be580a0d841ef11bd7e6a1921bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419883, "uuid": "bdc985bf-0697-45a1-8611-6c8d7328d26f", "comment": "Malware payload (AgentTesla)", "value": "8b7d03b95364a91db3d82faabacf0abbeb59bb76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419883, "uuid": "3e3c97d3-c971-4678-a3d1-55e505ec5a7e", "comment": "Malware payload (AgentTesla)", "value": "0550084f0cc3b2db3835f3676539997da0f0ec33ab48cf0cbda14fd9740b8f8fc2fef1f7f1121d61b5d58b66d883c4b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419883, "uuid": "88fba69e-5cb3-497e-a435-c6c55f471b18", "value": "T165D433260553ED6F0E7CE2B9BB2939BB4872341D4181176835C28E3ADA5BAD434329DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419883, "uuid": "8fe73cac-8491-4145-bff7-5f9c60fc5bae", "value": "12288:spwb/Iq2yGBZnkyv75lMyWDeZdccSMN3uGDvSBH:s2/V2yGLKDDkdcc5TqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419883, "uuid": "97f15bb7-8368-4f78-8317-4010ae6fccc5", "value": 638719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419883, "uuid": "6bc4d943-7d46-45a5-ab5f-605997f0669e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419883, "uuid": "4eff45cc-f1cf-4bf0-bf87-91c36de23187", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b4d9d4-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422220, "uuid": "b56d4b2e-4dd3-4d3a-97de-78a2885b3722", "comment": "Malware payload (Mirai)", "value": "4915b4b3186939482739bfcfd3018b75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422220, "uuid": "66c03bc0-8108-4c3f-9e60-5fee7631d8e4", "comment": "Malware payload (Mirai)", "value": "a8cfe22e595e6e13007a1bc805e5fe6fe6bd951c44f3ab05e4f72b93a26d398a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422220, "uuid": "d88a56f4-657b-4dd2-9890-842ee1ef2232", "comment": "Malware payload (Mirai)", "value": "53be3e029a86ada99d3edd1d8ea191cf8507b204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422220, "uuid": "536f96d3-ea47-4523-8a1a-87ee6e713681", "comment": "Malware payload (Mirai)", "value": "d316271a42d73ebd593d7354066c13b1859a617d04f890010377d82ab3a5d33b36b2d60cc67eb23ef9582b739e4569ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422220, "uuid": "e63f62a3-e452-4a82-a86e-3271f6cdbe90", "value": "T16014B51AABA10FFBD8AFDE3706E9070635CC950722A43B393674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422220, "uuid": "8e713202-1cb9-488c-9e7a-a9da6e0ffa30", "value": "3072:nnQiR1fmvs/0QJDNqymFzmMmQNt6AtwPm7:nnQYmvsc+My9Ru69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422220, "uuid": "4f341aae-2654-4640-a51c-0e087f499e31", "value": 194152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422220, "uuid": "1a433970-9836-4d28-9b3b-cd28ef18a9ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422220, "uuid": "17793894-c263-4286-9de1-40b75dc2d8c1", "value": "4915b4b3186939482739bfcfd3018b75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ddc341-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687430156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430156, "uuid": "9627290a-42ea-491f-aef4-4513bf065b7f", "comment": "Malware payload (GCleaner)", "value": "3190234f0fdd098ad05902251ad4bd30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430156, "uuid": "8ba9ba08-079e-415f-804b-222eaeabd801", "comment": "Malware payload (GCleaner)", "value": "ab81c10814669ba793d630ba4dff251bd659e9bc58884f29d87672f6e741fddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430156, "uuid": "ba33cdba-851e-440e-b239-c11ed22e9971", "comment": "Malware payload (GCleaner)", "value": "7af4703111c1046e96362a182ff9f897196a5500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430156, "uuid": "a5154d29-8ca1-4e4d-a584-38ab939e8cf2", "comment": "Malware payload (GCleaner)", "value": "90d37a5c3461b7f4fbce536cafeba3e32b2cd1086d48e6abf2056ea1c01c96c1d6f00cf51955cbdffdf400968fda55f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430156, "uuid": "0a88c309-0027-4949-90b8-17085d750486", "value": "T1EF74D01136D0C032E42665758172CFB15ABFB8B626659ACF7FD81ABD0F356C0EA3434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430156, "uuid": "351b8ad3-3a57-4620-8991-4504a5ee45c5", "value": "4c7f209181ee40b674200cb9d1c76dd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430156, "uuid": "fb7cffc0-28ab-4eb4-9de1-d85ea013eb02", "value": "6144:u+w2uwaT+XBT8/SbntZHKv3VWQyjX/HBItpTPcUInA+mG:uIuwo+RT4gfHKIPBITTPcDnA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430156, "uuid": "6f63883f-1156-4008-a61a-23499f905639", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430156, "uuid": "dc620e3d-073d-4cf8-b115-782265683ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430156, "uuid": "32df98b2-fc61-4adf-8ef2-deb0f6b30584", "value": "3190234f0fdd098ad05902251ad4bd30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862575d2-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1687413386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413386, "uuid": "53c3df02-81a8-4230-9ec7-d7ab11927931", "comment": "Malware payload (PrivateLoader)", "value": "f812648ad8ea0cb95da3d4e3f2c0c38c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413386, "uuid": "78518969-e821-4c77-86b7-097062b16477", "comment": "Malware payload (PrivateLoader)", "value": "aba6ec88328f609451b9ee7a1134f7bfa4011ca0ed286493aea4d7fb90fc2a94", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413386, "uuid": "15bd59f5-49f9-4202-a6f0-5b14fc853487", "comment": "Malware payload (PrivateLoader)", "value": "05708f72c182f21563e4bd77e15c162aa2975795", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413386, "uuid": "0b401a1c-723a-4101-b4ae-6fdcb76214a8", "comment": "Malware payload (PrivateLoader)", "value": "173dbbdc6bd5c68a9491264cb9419b9504b365965044de805087b0601274435db0ae5686aca71a2b279a76d63319e15d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413386, "uuid": "8be15cae-bbd1-4800-91b3-ed1a8f3b1eb3", "value": "T152048320FA47DCB6FA11063577A5F16202466D63BA59CE162AC3B20E03F7B507CB9D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413386, "uuid": "2add4fdd-4568-4cd0-93a2-af68cdcff4ce", "value": "3072:vkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAjXN2zHPHbRhBmu8mOmymmgVx/0Qw8wA:cZ+RwPONXoRjDhIcp0fDlavx+W26nAjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413386, "uuid": "0f85b663-948c-44dd-b2f7-d22eda4e8b31", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413386, "uuid": "d448b2bd-4345-4fc4-8c11-0a1c0a7ea1a8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413386, "uuid": "2b2f0fec-7e81-4c04-9aad-1892ab703a93", "value": "revise invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacbc625-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420319, "uuid": "075cee01-9ead-4c2e-8650-e22b2556853c", "comment": "Malware payload (AgentTesla)", "value": "ca6edf7025270d9dde5c570d68f1b8ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420319, "uuid": "b23e8136-aafe-47cc-9749-ca91381e7262", "comment": "Malware payload (AgentTesla)", "value": "abf28b7d6bbd007ec70287503abe5e01d90aef2125b1287c98c6aaae0cdc4180", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420319, "uuid": "b4feaef5-ca80-46b0-aa9d-68327593536e", "comment": "Malware payload (AgentTesla)", "value": "a2808a83e32b5517b8ec2b489ef0528d400ed93f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420319, "uuid": "83539f4d-6f01-4686-9732-8b2461d1422b", "comment": "Malware payload (AgentTesla)", "value": "a9a9f688fd60cc90bf4b49b4cf4ecfa44b44a27503f0dcfe5d9b260555fda5e79e5d3814f79c7e5104c189b474d63f57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420319, "uuid": "8d48fbc3-45b2-4e25-8d2c-3b8440ddfaf3", "value": "T182953AE8D8EA44D2E407E9F05C38FAA10532BEA3DCD90C243F2DB5455F7A95229B5D0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420319, "uuid": "6073cc1c-0603-456a-9101-b0271593162f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420319, "uuid": "421e57a8-8d47-43a9-921f-cab6e3baa20c", "value": "24576:isM5YKm643Y++Ly117OyyEi+81B2ujfFYbFL3+:H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420319, "uuid": "c0263945-a80b-4b6b-9201-80c95ad3894e", "value": 1895424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420319, "uuid": "53907665-3757-4bb1-9bc0-22d6ad1e2d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420319, "uuid": "e2c1e7e0-ec86-4f5f-a4bf-0b7eff5801f4", "value": "IMG_1376092pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d34762-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419963, "uuid": "27ebba94-16f5-41fb-a4a5-69cb8fa1c948", "comment": "Malware payload (AgentTesla)", "value": "fb374beeac9dbd0ce642063538e54cc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419963, "uuid": "3853bd16-8ac3-4976-a326-c4e5b5c60c86", "comment": "Malware payload (AgentTesla)", "value": "ada8b68992f2e54fecfd3a003562da77b9d643f3cc1acb1fe1f2560a32b593db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419963, "uuid": "506d6fed-5228-42d4-ae16-c306662f626f", "comment": "Malware payload (AgentTesla)", "value": "60f2040da623c0335fc2a1d6d581ba23ef8c196a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419963, "uuid": "7fafce60-5217-412a-ae70-eea0732091da", "comment": "Malware payload (AgentTesla)", "value": "793bc6521d4af34c8ba25f199e93b688484a8d23ef46434419b0aac71f4ebbc73219a803a00c96bc12966f88452fa9aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419963, "uuid": "d23449ad-bb7d-4cd3-bc65-cde97fce3d20", "value": "T1AF842274AEE4C2B7EEA445B34B7D4775BBB2D32500B9538A4764275CABF2087EA0D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419963, "uuid": "c66baa76-7bd9-4816-a4cc-9e62716a5fa3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419963, "uuid": "b868662a-b591-4fc6-b988-d95d633ba0d8", "value": "6144:/Ya6kJ79gRGpOEbepDpo5R5oQIK0uZrvFeq/0GHSUs9S3PEhQqpUJcFb9N:/YKRda7o5Rb5rUats9qPEdycFbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419963, "uuid": "48a8e052-fe55-4d37-9cec-dd6f1c29a5aa", "value": 377633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419963, "uuid": "9391754f-fbed-4c5b-a81b-02bfc24c6246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419963, "uuid": "16695367-cdf0-4a6d-8cb6-d33298b0f75b", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22775.16398.31863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a809c134-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687430193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430193, "uuid": "1b00d0ef-19e9-4cf4-b84b-bf2815188c27", "comment": "Malware payload (GCleaner)", "value": "edbc697da2627b9bbb6ac36ce3ff4473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430193, "uuid": "fe153414-f018-4a61-9f4a-e744c4edcc74", "comment": "Malware payload (GCleaner)", "value": "afaa0cde6c466dd1943a52fe9e4ea16f718c2a4e061f82219d840ce173b7e4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430193, "uuid": "a85dc268-9588-4b25-ab4a-59af19160785", "comment": "Malware payload (GCleaner)", "value": "c94c291a3640468bf24b47f8a7e3e97f2212da56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430193, "uuid": "74d8c3b7-c5df-4b78-8a1b-47a01c045119", "comment": "Malware payload (GCleaner)", "value": "423e1bbedb969e50a6313111fd150a41689b9278163493fc05d40d291503c3d82253719b1fb734071dcc2a66845c3b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430193, "uuid": "b4e46bf7-f80d-4dc5-b3d9-09c8a7c422d5", "value": "T1E974DF103A90C032D42276764575CBB15A7F78766B259ECBAFD81AB80F347D1EA3138B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430193, "uuid": "6fc1c503-d503-4d0c-8a43-be41294de0d0", "value": "89980fe063a1b2bc0b7b32e49a2c9e4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430193, "uuid": "976a9e5f-ecc9-46f8-925d-c3436689b3a0", "value": "6144:0nyvJ+VRwhhCL9uZbD/udqOLRXv6D6IFg3cT:d+VGfCLs/udHRXv6eIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430193, "uuid": "d9d41a2b-c0b4-4fec-b30e-7a6dfb35f986", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430193, "uuid": "8e2851cd-7b87-4ba1-bdbc-ece03139333f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430193, "uuid": "14d4d385-513d-42af-8113-9632e8d087a7", "value": "edbc697da2627b9bbb6ac36ce3ff4473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3601f78-112a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687458559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458559, "uuid": "e7d2ee2c-13d3-47f4-939e-36c6213ac599", "comment": "Malware payload", "value": "1afce18ec89c84bad21f1bcfec5c1a58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458559, "uuid": "58f80929-4499-4aec-b17a-77818b7f4006", "comment": "Malware payload", "value": "b038378503ca759a999700a060da6d8ae44e1ccd3182101fe21b1405b9c9c204", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458559, "uuid": "aef6a45e-149b-439b-acd2-6c3fa11eab6b", "comment": "Malware payload", "value": "6c727f115006f45cbb86334351f8c9184e0a90dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458559, "uuid": "0945be95-d556-4582-8640-2d0e94f3236d", "comment": "Malware payload", "value": "37e8731d11897ace8485de31ff7cc47d45660024172502c6d96d40c9f1d86bc2ba35fc60f831c34a9c7b3d565d823c70", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458559, "uuid": "15f9adde-32d8-4236-a075-80d15f0f2b6e", "value": "T1C7558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458559, "uuid": "2be40177-7bb1-4e06-b46a-4ca07a33274f", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458559, "uuid": "535f0afa-fb79-46aa-a82c-51b830dca350", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yZQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687458559, "uuid": "cba7e66b-0e19-4eaf-a458-a0c2cb1e08fa", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687458559, "uuid": "8b6ce526-2998-4c5e-b3b0-357bbda87099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458559, "uuid": "ae1dc380-16bc-4e1a-8eb9-0461a622945d", "value": "1afce18ec89c84bad21f1bcfec5c1a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03963ccc-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420897, "uuid": "875cf351-b32f-41fd-be3d-6556909b37ad", "comment": "Malware payload", "value": "a0a98211ce6e7fcdcd2063e9a2352dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420897, "uuid": "ad55ab62-da6a-4a0a-ba5c-d760f5662f19", "comment": "Malware payload", "value": "b0a921079fc1d5656820c576b3e9175bd8656f047f2de3b569a0f9d08130ce66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420897, "uuid": "392bd77c-1131-4b6f-aeff-af6d104d6203", "comment": "Malware payload", "value": "b562803fa65bc60a77602dc6373a7d511e69a931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420897, "uuid": "10d47d10-a40a-4eab-bc2f-a63819284651", "comment": "Malware payload", "value": "302f54b19e67c766115a0825318cdbce58536b783cb779c7209bbcbc2a19274a7ad21a8614a9de46688d2ffdceabab2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420897, "uuid": "9c5184ed-f87a-419e-bbc6-da9bcdf4ac8b", "value": "T19306F0320532BDFD8B6C389194001B452CED5C67635ADFBCFA4414EE29A1738AA7F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420897, "uuid": "5cc6a91f-5dae-410e-a42e-771f97649fe6", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73kU:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420897, "uuid": "41210a09-aed6-47b6-ab17-e3f3fedeb048", "value": 3807471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420897, "uuid": "f39a0ca7-2846-4fbb-a494-a9dac8371348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420897, "uuid": "5ca98adc-8f11-49a5-8e39-e1391bb31e60", "value": "a0a98211ce6e7fcdcd2063e9a2352dbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa34b8e-1103-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687441802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441802, "uuid": "a2074bc7-3f26-43b3-83f9-36612874dc2b", "comment": "Malware payload (Loki)", "value": "383fbd1b1fda45e9fdf6e625a53f0382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441802, "uuid": "34fea106-b6ba-4983-9114-5348bc6a9674", "comment": "Malware payload (Loki)", "value": "b4e77135a79b0b79c838f8bedf30ce24e0600267cdb622b2c85b5e9cab5fbfde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441802, "uuid": "294d8c1f-8e04-4aa3-afc6-1ca9aff0f197", "comment": "Malware payload (Loki)", "value": "bceb323d9f34cbe3adca83b4c50e35f05e7a7bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441802, "uuid": "2bca8457-f9b8-4fe4-bf7a-5edc66301ed3", "comment": "Malware payload (Loki)", "value": "6b33afb21bcd42ba8b64aae3dd62a5dd96cb4d9dd8f39975fe1b8a3f9bbcb1263486cb9869cd09b3a3fea7fcf904627a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441802, "uuid": "c37b15d6-6514-4117-80bc-400e0e659b55", "value": "T1BD54AF14225BFA66F304F938345FA6EFABB86EE9C5348C76F1643B1E3176580654CE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441802, "uuid": "fa11e5a8-56a1-4e59-9b43-22ead49fe460", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441802, "uuid": "f25308df-b919-42c2-b52e-6d58a3ccffe3", "value": "6144:kUj/wJYl/IP72zQvYfmccP/OowFmy3qLqiPZ:kqKOQvGyuVShZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687441802, "uuid": "72051ea9-4346-4bff-8ad3-a00635fbcdea", "value": 303535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687441802, "uuid": "2c1cb81e-0ff5-4ef3-973b-4aac8c66fe4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441802, "uuid": "c8feff90-f628-4fba-9e6c-e558f8a7c9d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b90fd72-10c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687415864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415864, "uuid": "eb7f4c46-f382-4be8-902e-ab65c1330cdf", "comment": "Malware payload (AgentTesla)", "value": "37b418b14ad3491d55e1e3669838ab69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415864, "uuid": "6d15b6a5-c44c-4047-9e79-b7e906840a14", "comment": "Malware payload (AgentTesla)", "value": "b5e595f70f317fc0c3916b7f0294681db744ec05ab7013cfb770c1f656018c8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415864, "uuid": "8aeb46a0-45d6-4133-9a62-b6e75f29e798", "comment": "Malware payload (AgentTesla)", "value": "67db39a82a7c4c930482ac74dd768d57b9ea990c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687415864, "uuid": "268b224c-66ee-4438-866b-87e82e26e775", "comment": "Malware payload (AgentTesla)", "value": "759c731061fa44462a2a982297655a39af7bb7edeab06faace975bb1a8b33e4fb0b37568e2c5418ef8407913d99248ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415864, "uuid": "defb3073-d4ce-4e82-9ed6-3dc90d1514af", "value": "T15094BED5326F1F12F03DA3F90621204A27F7091F79A6D349AEC618D704E9F185692FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415864, "uuid": "ef6a8c62-bcde-49f4-b2e1-279f94c4419f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415864, "uuid": "94f58d62-7de7-405a-9696-c1cdf1325896", "value": "6144:jTjPJaPJaHJamfaeCaTq9j10dx5tPNtbusqfIRzmzT9w4KRKIdcZAGiW:LJ8J0J/TqR1MtPb6sqmzmzxeAILZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687415864, "uuid": "9c9824d6-1754-4618-86cb-a10aac926177", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687415864, "uuid": "efee7dfe-48a7-4c36-8f1f-4b3995174260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687415864, "uuid": "11327b2f-730d-47b0-9e14-cd8d9765405e", "value": "SecuriteInfo.com.Win32.PWSX-gen.24120.29781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc5ba83-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459220, "uuid": "87a15037-be34-486e-892a-c91f51a3678e", "comment": "Malware payload (RedLineStealer)", "value": "3bceca67ab3358474ee307f5f53bb325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459220, "uuid": "ff72a7e3-760b-4166-a8f7-aac079592d7b", "comment": "Malware payload (RedLineStealer)", "value": "b6dcdc6a8ee3fcb6c24128a13d0d1ff10b29e18bad3ef1a279ba7751adaf2801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459220, "uuid": "99338500-18bd-440b-8dfb-4f1c76410c53", "comment": "Malware payload (RedLineStealer)", "value": "b18b53524bcef5fdb0865dac0f7bb92d84b4a8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459220, "uuid": "fa39435d-4760-432e-9df2-dd2a822f4162", "comment": "Malware payload (RedLineStealer)", "value": "613988cefce71acc67e0a8c98a55b6e35de42c5acc4b699db016aeb7e0671f11a9fea5f2b7f2be2b6a21e778b187d195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459220, "uuid": "c1a33a52-c8a7-43cf-892d-d63f955abb35", "value": "T1E0B4F1CA62404573DF33CDF1D8DBE9929E7A60210BB5878B530D8AF54E051E8E60B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459220, "uuid": "c7469de6-49d6-438b-afe0-e4258ffe2cb7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459220, "uuid": "de1c7c84-5bcd-41d7-b289-4d803cc3ae54", "value": "12288:rUTURTey5sc9f3Uo7sQgVIYFSPCOJcC6vsMQJQmZ:rUT8Tey5sUzsnJSPya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459220, "uuid": "205b6e78-e354-491e-9ffe-f0556a9dca24", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459220, "uuid": "eb815bdb-5fc6-4154-a7d7-f8f949f3cc29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459220, "uuid": "55fa3ee3-fe7d-4351-8621-6fd3f4295873", "value": "3bceca67ab3358474ee307f5f53bb325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f377fa4d-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422588, "uuid": "f95b04d7-a65d-4274-bcb4-ef66425c40c8", "comment": "Malware payload (Mirai)", "value": "2f6409fde29ed3d08c51c47b80940b26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422588, "uuid": "6682354f-0537-462c-99a2-8496a6d2e928", "comment": "Malware payload (Mirai)", "value": "b7f133e1cc2c1b6b926e0ddf2681c4e52c9cd580c45413e0954485d90f08421d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422588, "uuid": "04bf6526-0ab0-4154-9253-32532b81375a", "comment": "Malware payload (Mirai)", "value": "e0bcffae82db64ca21e75e227b09b5a4a20cd9d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422588, "uuid": "f75cb7a9-fc58-4981-8739-139cdeedee7e", "comment": "Malware payload (Mirai)", "value": "7cfb746383c02948445b8dad324411dbc69d6ef3a69836aafd7261be560e89c7c536dc4021a332c6521cd06d7be8e2f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422588, "uuid": "78333b97-dc08-4725-aa37-0b60aa9c5e34", "value": "T1F563A406BF614FB7E86FDD3709E9170524DC551B21A97B3ABE30D818F60A25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422588, "uuid": "93c1d2ed-20c8-4917-8179-dfb73e006251", "value": "1536:3ic5mAk09TobL0JPNuBSBsL3polf+FXaf:3P5rlKIJPNRf+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422588, "uuid": "1eac3226-6744-42b4-887b-0b3a819f8946", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422588, "uuid": "c101b2b0-8012-4d07-b7de-4295c1d9a93c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422588, "uuid": "d08116c3-4acb-4f91-ab99-dde2661285a7", "value": "2f6409fde29ed3d08c51c47b80940b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a07bd6-1103-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687441810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441810, "uuid": "790da28b-f27a-4472-95de-973fc2e170f3", "comment": "Malware payload (Formbook)", "value": "01d712c97d3a09c431e0b361c61c6eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441810, "uuid": "e88daf1d-e77d-41c3-9ae5-aab45086ce0a", "comment": "Malware payload (Formbook)", "value": "b86a1eeb60c805df78a60ab0a6f79065a667a6d6c85f53d7a0fe1f2fa6ea9667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441810, "uuid": "ea10ce64-5ee2-40b7-ae4c-e71ed5bcbe7f", "comment": "Malware payload (Formbook)", "value": "4bc68dea7ff9fbffc9d68bbd5a952cd552c3bd35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441810, "uuid": "53252063-d7dc-4c19-a23c-8d4e18dc20c1", "comment": "Malware payload (Formbook)", "value": "3d4bb2d01f535b37bc8316f8a0a339b757cd2fa97bf10834cce4dce5dae36305a60eef9385469e36593c9adf2b3a1c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441810, "uuid": "c404f2a8-da0a-4d3d-a090-20c1ca125c5e", "value": "T10474125465F4C17BFCB35272AA32586A36F997065CF60F0E27A052BC2E32662C70D739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441810, "uuid": "5d92527f-afbf-4f7e-b515-a9e258109e45", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441810, "uuid": "39dfd691-563b-43ab-9222-e991f7926f22", "value": "6144:/Ya6G8S3JhnD2OJ6DnP9K18d6X6t/t+eiZTPXnZpXPEpNPUFPLaIyO:/YI8CzxQDVKSAX6R7i9vnZt8pNoDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687441810, "uuid": "93cbada5-ca66-45fa-82a7-a2b9493e6fdd", "value": 356380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687441810, "uuid": "4ddc699b-b29f-47aa-b75c-4d3ec495d2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441810, "uuid": "18889e6e-11cd-4034-a5d9-1f4feec00a86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb4d616-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430333, "uuid": "1086564f-3fdd-4ef8-a8fc-f3a4e0105ef9", "comment": "Malware payload", "value": "99e01c62ae10d00f376e5b265bb0308f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430333, "uuid": "4e26efaf-ed4f-4a77-86bf-76158573fe8c", "comment": "Malware payload", "value": "b91cd447a756f6bd45a70cab76407376168692edb818319a1aadf965feea8755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430333, "uuid": "b870a6c4-6564-42e5-be10-4c025bb47863", "comment": "Malware payload", "value": "0f75772a993dc45a57cddfb158ba293834857ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430333, "uuid": "7bc04ae1-6133-48c5-83e6-334574a5c671", "comment": "Malware payload", "value": "8a97a078f5b9e48833a64d2afc0174d1a6bbbc72de86f894da4cd52d677e3589a89d5c2f6bc720129ce838d35da0ba5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430333, "uuid": "b73a8e08-a76c-4882-ba14-1f657964ed57", "value": "T16A351201BAC1C4B1D97124351AF7D730AA3CBC706B7689DF97606B6D5E314C1A236BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430333, "uuid": "8457492a-5696-490a-b0cd-48c0a04b9e53", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430333, "uuid": "85efd832-1519-42ff-9411-cc139cf46a74", "value": "24576:VJr8tEZgHqD9CnL5ACQmVd6wfHiQPrssZ8JNALUcI:VJ4oDCVACQmHJrssZ83AfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430333, "uuid": "026953e6-6895-48b2-ac82-f776905f4c0b", "value": 1084824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430333, "uuid": "d80e330a-6119-4468-8a52-965e3b064420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430333, "uuid": "e33352fc-d74d-4707-bb3f-780d0664a3d6", "value": "99e01c62ae10d00f376e5b265bb0308f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814c21d4-1101-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687440865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440865, "uuid": "c9ec98bc-61c8-47cb-9d9b-c965ca05ba3b", "comment": "Malware payload (AgentTesla)", "value": "9d950a0c11901e219bd33aee246ed6be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440865, "uuid": "6c05c7e5-674c-42a7-b6e4-134c326456dd", "comment": "Malware payload (AgentTesla)", "value": "ba6d8a98caaf4907734541ee182f796f3badb5caf2186def620afdf2a7e8048c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440865, "uuid": "93f99bbb-a3ca-47d1-b280-1684ed7f6e05", "comment": "Malware payload (AgentTesla)", "value": "9a2d674b9d1deb09ffc15ab98859bf012d2a88b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440865, "uuid": "b8616806-666d-480b-9629-68ade1e5df35", "comment": "Malware payload (AgentTesla)", "value": "a2c903d71ee089f1ad1018dbb6768362135d4230f78e6ba19a240bc6cde9e41f996c0548f7a2fb7250f70c0836d2fdb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440865, "uuid": "2b814050-27c4-48a5-bca7-00d2e4087d22", "value": "T1DA1593BC695026AB9CB7E7A24152044EF27F7122B2538D7826D716C5863285E37EFC0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440865, "uuid": "49f55454-59fd-4d37-b045-43484f424a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440865, "uuid": "8cd4832e-0197-4054-9858-e5378091b6a6", "value": "12288:i6iVGHmsMPzI/Z8NeMvnWLsJKdocYWuwfZxVd8Ghc8pjWdrS:GLI/aeMvnWLBdo7aZ51Kdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440865, "uuid": "d486f588-b07e-4cb7-94a6-fc3fd811e763", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440865, "uuid": "aa625f95-4dc8-4f22-82c3-04f9d8b809b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440865, "uuid": "3b3089d1-6078-438f-b4a9-85669ff19853", "value": "rIMG_MVHOVERLAEPDAREVISED_SOAAPRILMAY23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a679fe95-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420312, "uuid": "112db647-9948-4ba9-a698-6356e88fc804", "comment": "Malware payload (AgentTesla)", "value": "2bfdf798235026ade8ccb4117c6be953", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420312, "uuid": "d108dd00-f351-4de3-9f6d-7e84df5cb452", "comment": "Malware payload (AgentTesla)", "value": "bb751eb04ae7aa257cee9012a1f20eab6cabd1881724d2b840bad65f01ecf950", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420312, "uuid": "1bcb1f86-59a6-4960-bbb5-35e3185c800f", "comment": "Malware payload (AgentTesla)", "value": "a509ef7f25404fcfce25a4a6cdf9e06ba1d79c03", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420312, "uuid": "f75eddeb-212d-41cf-88cc-32029ddf1cd0", "comment": "Malware payload (AgentTesla)", "value": "8c47ae9796a81f22d48b752dfb8eccba2db4cfaab230370b41c203f8c237e34b9a89bd17557621949eed1aa0d6c8eb95", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420312, "uuid": "036e9a46-8899-49ce-ab86-5496d5019c32", "value": "T14EE423695B9CDC77E7934360848C7336A9B228E0737911F6942C9F287A48BC9FBD6710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420312, "uuid": "5eef09ea-39c6-4286-820f-33169cdd290b", "value": "12288:aiSYIsdp+YMv20YV+xnKpKz/hR4weNDCLyANN0rjznZVp1pTcLJRV6zf0:adwMWVSX+DC2ENYjjZ7bsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420312, "uuid": "2e2fd5d0-82a2-4dd2-913a-f7521eb0ed9c", "value": 663136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420312, "uuid": "fbe52fcc-e6d9-4d71-bd3b-ad4a30160614", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420312, "uuid": "746204a5-5614-4ecf-9517-fb83427c6315", "value": "Jayant K Ltd - Invoice No. 67515.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4ad892-10fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687439245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439245, "uuid": "09f4ad72-1098-453e-b39d-7ee69d5a72f2", "comment": "Malware payload (AgentTesla)", "value": "f28b3d77202e308cb120a5fa7f399cb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439245, "uuid": "bc522268-4d90-4b5e-85a9-dd84c2ff4814", "comment": "Malware payload (AgentTesla)", "value": "bbb301f4dcc603a5995bdf179b4d129f976b9ca654093e92eff080cc583b0d7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439245, "uuid": "c90dbbe7-3cdf-4d28-b76b-aa7d4795b379", "comment": "Malware payload (AgentTesla)", "value": "47c4ab5ed965187fbad6369191f47df010e9cc4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439245, "uuid": "ea739219-2c53-45c2-a9e5-ddeaf5fe780b", "comment": "Malware payload (AgentTesla)", "value": "6f5447440fa4ee27d5f329fefc9b091aacfb3eee13f900ee52201a8226c59f57efcd56a925c15122a367c57c640ee223", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439245, "uuid": "19d0a6da-1f2c-4582-8a12-2a54d336e6f5", "value": "T1768422053AA0E4B7CA16C5736F7D2477EEE8E0065021D55B7F017B2AB9A3253CA2D7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439245, "uuid": "9f9b2aed-b950-46da-ad3a-032d18749354", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439245, "uuid": "2619dd0d-0337-4a0a-8143-c7e67f38682e", "value": "6144:/Ya6Qvqo5DHEAxwI0ndJ4jUkpTKVp6SKldr+m3z/5bDhOfG0Y7dGbalxiXx:/YuvqmEA61fxRKlNBDlhOj6lxih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687439245, "uuid": "5124294c-ebd8-4f67-a43c-ddd34e13893d", "value": 374888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687439245, "uuid": "40ac0d59-c943-420a-a0f0-6198f03f35fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439245, "uuid": "a7767bcc-2e81-4dcd-aab4-85ee71c84f80", "value": "SOA-April--May 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b91e76-113b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687465646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465646, "uuid": "112dedcf-44e1-4019-907d-237b5839a28d", "comment": "Malware payload", "value": "c338c8b3ccce1f5535784ca9444dd1e9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465646, "uuid": "cd816cab-3bf1-4d71-91f7-eb96a7276898", "comment": "Malware payload", "value": "bc031700ccc30951e230955f4e9db543156a6135414572f975a9248e7c46e2dc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465646, "uuid": "108fe482-d9a8-49a0-b3f7-7c3fb1bc9889", "comment": "Malware payload", "value": "6a7e2c45a3ab133125395cca3df23e5f72546b7f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465646, "uuid": "48c28395-7fe3-4d68-a984-63a9764481b9", "comment": "Malware payload", "value": "baf00cf0df09131caae0a49074b8bc5d09733148684558f058bff74d2cbfec1f656db723536b6db0b644a85afc8f47a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465646, "uuid": "ae85e78c-dabb-4e7f-bc08-e6482e05020d", "value": "T1D377337CC0A1638B1D7B5831B5F1B1EBC85681F18A935E2792ADA633DBCF3D19178089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465646, "uuid": "490cab03-a916-4a85-867f-57b50953db11", "value": "786432:2FfTPmBTW7E0YaoUOqprzW9twEvaisY0896tteOh9YFNV4:gCTqzYsdiyY0EqYF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687465646, "uuid": "1a6f0bbe-bf19-43b4-998e-bcfd135d5bde", "value": 33346060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687465646, "uuid": "fc6b0241-3155-484f-83d8-db49094f1bfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465646, "uuid": "aba72357-6190-4dc7-83d8-d2b13eae4c47", "value": "c338c8b3ccce1f5535784ca9444dd1e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3403573f-1096-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687394779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394779, "uuid": "08af999a-91be-4dd9-a5ff-49363e6aacea", "comment": "Malware payload (Amadey)", "value": "c43885e05be12a02d00b60555754a0d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394779, "uuid": "350eea43-bbb9-4b63-a84c-43314653c4d0", "comment": "Malware payload (Amadey)", "value": "bcf5157cb913dee02e6af79aa4fd3470b17f49e2cc06169b9f9b900cf4f0f9f6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394779, "uuid": "3a32ba00-856e-4964-823c-dcb5daa5230f", "comment": "Malware payload (Amadey)", "value": "9d405a2b006c98024bff9ae8ed3c9dac073d2561", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394779, "uuid": "775b0b93-3829-4423-9e77-1776b412be1e", "comment": "Malware payload (Amadey)", "value": "ef947921bbf7dea578ca48847ffa08d297fa20e62cfbe340bbc11161befb570835ed31130dada274cc14cb49328ceab3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394779, "uuid": "07f3839c-4fc6-458d-95b5-af292746881a", "value": "T171E4E102B7C0C436D57B253609F09F78853A78110B6519EBDBD80FAE4F206E1ABF659D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394779, "uuid": "90f3d63e-0406-46e9-b6b0-f32610144b55", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394779, "uuid": "8b5ae7f6-ade0-49ee-8133-ec59ce9d4569", "value": "12288:jztKekjWeeIO5sPnWJSn/GW1FO7xmEVfxCbUwTG0e21jK2d9lP:jkueeMn/J1dEVfwowTf1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687394779, "uuid": "7449abab-33d5-4988-b8ed-db6ec37a614d", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687394779, "uuid": "748de2db-776b-4bb2-994d-355257d7e1d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394779, "uuid": "eaf7b433-aba4-4407-a512-b14ac1183703", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baffa129-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687419058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419058, "uuid": "568fa244-5eca-48ef-8029-c7b42ad54e88", "comment": "Malware payload", "value": "8fbe4ece2edeca935a99448d64602917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419058, "uuid": "56140bbc-dddc-4d33-9829-c6bbd5cf8ace", "comment": "Malware payload", "value": "be5c89cf54a2929922a19aebc263d928394227f5c08e3f9995a6c76c3fe18e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419058, "uuid": "f0ad06f3-7552-451b-8e1a-49bf10fd9437", "comment": "Malware payload", "value": "39a1350bc90ce3da844aba287d67d0f23b910c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419058, "uuid": "11a365d6-eb27-45c9-92ad-b62060dadee8", "comment": "Malware payload", "value": "40f0a6a5cbc1aa515f0ea3ada50b2eb7190cba4ebea9608052e78765e6cb0d06605cccd32fee15cebf3e1eabef7d98a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419058, "uuid": "b948120d-6406-4bb8-a87f-a225f67bb923", "value": "T152A5BE51F223DA44C2295375CA81DAF017B1BC09EE129E1B7999BF5A7E733C03B21792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419058, "uuid": "bddc21ff-3871-4129-a0c3-5052c896844b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419058, "uuid": "0f671575-b3b3-40c6-bbdf-7282c79a44ea", "value": "49152:9yFjIylGC+wzZAElWCaPbGZfkuR6C3bLQt+HObUJJGy:9yyPC3A2WCaPusuLQt+ubUHGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419058, "uuid": "5e07e856-9b84-4ce0-a02a-a6eee126be8a", "value": 2071040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419058, "uuid": "9aec24ea-fc73-44ba-9cf1-2093e951ef9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419058, "uuid": "a340ad84-2337-4a6e-b458-3c27295e04de", "value": "8fbe4ece2edeca935a99448d64602917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112fcae-1140-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467789, "uuid": "745a0923-1eb6-4d87-94ec-76bd99e82372", "comment": "Malware payload", "value": "b6c538d8c6b3900706fd478e223221d9", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467789, "uuid": "a0e77600-b4c8-46d9-9e0f-5fb387c72ff1", "comment": "Malware payload", "value": "be9820e009b92438f954bad1330c0380fff2a58e762045784444eb50c9fbd1c4", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467789, "uuid": "78b59729-822d-4cbe-aa6c-ae9204a7534a", "comment": "Malware payload", "value": "8e1dc093589c435fe2f029c0cd58f557888c1bc9", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467789, "uuid": "10908103-241d-4ed1-ae52-de5d1166d400", "comment": "Malware payload", "value": "20e294cf7f2eea48f806d20b5741c55099cc344436fd8684181f6c11078377e758eab94b3e3e070c7a4af95b3b771718", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467789, "uuid": "0e60963f-da1a-40ab-ab44-504bd31e325c", "value": "T1C2D34BAC988CD588C979EBF2F752F4CAA14D733B4E8A94B671AF0FD61243D15E943801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467789, "uuid": "068d8406-7ed5-461f-88ec-1b0f4f59a5fc", "value": "1536:xxUcsSL8csOUpcssqcs+c9csmcsHFb2Aa24ERLYm3RT3MSLVMXLHtSR1GWBZD7pg:1vsGGYLrMeVoHtSXGml6niAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467789, "uuid": "e553d276-3b96-4c04-a541-7fa3fac36320", "value": 131711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467789, "uuid": "37335640-89b5-44bf-8377-110a9fd630cb", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467789, "uuid": "93ad54b3-5426-480a-9f32-031380b0c344", "value": "qbot3.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c94ad9-1150-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687474902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687474902, "uuid": "837e65b3-eacc-4886-a3a0-eaf2f2d9b895", "comment": "Malware payload", "value": "0e18ec4c36c1860be29130f7a793e8ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687474902, "uuid": "c1a6f8a9-a91e-4e95-85f8-6959b5e3d952", "comment": "Malware payload", "value": "bf5a45924b41b569b5d46794089118ed750fc0c56b01d843415aee87f23ed436", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687474902, "uuid": "005cab6d-134b-408e-aec2-12ba6bccf1a3", "comment": "Malware payload", "value": "a17b999ddc201304d403462ba88bcbbe73e9dea0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687474902, "uuid": "ace750fe-9e50-4ad5-9042-96911c2551ab", "comment": "Malware payload", "value": "25bc0000fe5624a9ee9c203b54c53f58251c4d8b0beddad24c597ae9fee95559707c8bd38678f6850579e4caae43c11d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687474902, "uuid": "a0d8f51f-6bf9-45b0-87f9-c522a0ad5d4f", "value": "T1F8353334AFC7E625F9529A1FB8D4DBBB5963B7B0221BD221FB332E4328604548D539C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687474902, "uuid": "b9509613-5577-47db-abdd-8fe961de4de3", "value": "24576:8540WeDMkjNHLGYXHpgagTFl1RByaxnxu4NPzUBh9smniz1Mzigvi:8nWwjNHLGCHpgZRRBdxENBnKupa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687474902, "uuid": "3b4b5b6e-9909-4faa-8095-d30307eed938", "value": 1122230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687474902, "uuid": "4cc4b123-1d07-42cd-826e-09ff94b23f39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687474902, "uuid": "a2c69206-9a28-449e-bbaa-11be7d2b7423", "value": "Radyab.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1431e577-1096-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687394726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394726, "uuid": "d994e52e-6da0-42c9-8b18-e715aa7ef77e", "comment": "Malware payload (Amadey)", "value": "c065ab6b2c4a8b5d51105a17c989919e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394726, "uuid": "6ab04d96-079c-4fac-89eb-a0ad3a172843", "comment": "Malware payload (Amadey)", "value": "bfa09378fbf5c19facce069caed42b282e1a137e9c0570b10196bafebcb7bda2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394726, "uuid": "0b737753-9434-4159-872a-08cc0b0d3429", "comment": "Malware payload (Amadey)", "value": "98fe84037a62cfe162a3470c8d698e0ec2fefa5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394726, "uuid": "d539f6ea-bf5c-4037-9c7a-73513e372b5c", "comment": "Malware payload (Amadey)", "value": "300b8d9d79c181766c026c91667aae41203a31e62eeac6655a4fb7848f34575ca3281effea83333736b6ba2940c93cda", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394726, "uuid": "6e68c66c-1855-4a70-9be6-c3f846d18686", "value": "T150F4F102B7C08036D4BB357609E0DF74857A7921076519EBEBD84FAE4F215E0ABF21AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394726, "uuid": "caf43b9b-5676-44df-a535-eebcf410be93", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394726, "uuid": "bce33ede-a6e7-4f31-b7dd-9e398f6d88c4", "value": "12288:gVztKeujWeeIOZoTKWJSn/JdwGbmqg7NzEUNO5u3+0u4woiucCWkjXJw8Z:8k8eeNn/h6VQUQ5u335ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687394726, "uuid": "f7e2334d-f7c1-4b5f-b382-f3aff2e9df8e", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687394726, "uuid": "048e27e2-cdab-4f4d-ba82-ed637d26411b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394726, "uuid": "c8b4fdb2-32f1-4ea9-bc7d-e5b9b194d8b1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161f072f-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687413198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413198, "uuid": "3b133d05-8e7f-4237-9e8e-67d4f24771aa", "comment": "Malware payload (SnakeKeylogger)", "value": "047b075c22b21388cbfd483b5ac9c08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413198, "uuid": "27865251-6ddb-4ea7-9430-bb171685ac0a", "comment": "Malware payload (SnakeKeylogger)", "value": "c11df3f962a103fb7d2640c2788461926d8ccda282fec1b46c35d9bec4187573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413198, "uuid": "6dd331c6-9986-4d0c-9c8b-9fd066324bc0", "comment": "Malware payload (SnakeKeylogger)", "value": "cb5649161e644a32467642775ab2dcc769a13a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413198, "uuid": "41340ee2-1693-4c25-9eb4-9206e7714421", "comment": "Malware payload (SnakeKeylogger)", "value": "a61dc5ab8a9f946a723d5b8d5c3745b02e5a222c4b77d2561aba0d56d9c22125796bf1606c559340e50c5998cc4de43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413198, "uuid": "9eaa21a8-1686-41af-9bdd-c945443b0110", "value": "T187E412B577AF0013C54B43FC44605671133B7C5A7512C28FDCAB76AEA6FA7854A24B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413198, "uuid": "c3a2f832-f1de-4e91-b8c6-273d058c61a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413198, "uuid": "61719873-8297-423f-ab31-0658ed71545b", "value": "12288:MCXpM1JCIQfNsVcuoQHc0snxNsG8VzmLGlBWGNQlR53maXfvENe:A1KNow2jsGNgmak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413198, "uuid": "2deec080-9993-4319-a42d-f1fe2d45babd", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413198, "uuid": "ae2927cd-8dcf-4d9b-9525-a34a6282c154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413198, "uuid": "50236359-f5c6-4275-b461-d5f6186fcabf", "value": "doc 20230600390019002010091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd5ab4d-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687430092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430092, "uuid": "0729cdde-bb91-4066-b1e0-8947dc0a85bb", "comment": "Malware payload (Stealc)", "value": "cffd6ead2f066ee6c9e9921b8de9992e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430092, "uuid": "7a98694e-4953-44b0-9a9d-21614501385c", "comment": "Malware payload (Stealc)", "value": "c137028a66bf3a6f449e578ff2e096f36762dc55d65bb06252514d8d92704f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430092, "uuid": "de814c88-f9d0-438c-909d-21fa176963c5", "comment": "Malware payload (Stealc)", "value": "89044e5fd771d95f7c40a67e3de07637c179fbae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430092, "uuid": "717e68f0-26a9-4904-b462-4170ad9046cd", "comment": "Malware payload (Stealc)", "value": "3f1630e6b5a12bd5c6fbd9ca7acc862d7108c6a053a8fbf80c3a1e85373facd99517596c21fe14ea5f2d8f53db2511b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430092, "uuid": "834ce6a7-b1af-43e1-8857-edf280a75189", "value": "T162F633C2C8F9876AE755ABFA84F537D0676E09C55FCBED2DCEC04552A94020A313C4BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430092, "uuid": "5c9ee2ba-daf1-4da0-bdb0-147a45a56af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430092, "uuid": "6e8db16a-29a7-4687-b126-3f16fca74aea", "value": "393216:rpTicKq7rLf2gS9PdwYHdKbUijTFNFrUAnW6:rQQrLfc9PdjcbHjxgof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430092, "uuid": "0e253574-bccd-4c4c-a303-70f93d6a52c9", "value": 15765504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430092, "uuid": "2edc8ef2-64c3-4766-bcdb-9b72a1a5409c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430092, "uuid": "e219f7e9-0648-464e-a454-a2adc4fb2bcb", "value": "SecuriteInfo.com.Variant.Marsilia.44577.28867.21656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d587b44d-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422538, "uuid": "fc427721-c6f5-4019-9053-5505f58c4488", "comment": "Malware payload (Mirai)", "value": "d7d0c9deb8071016ff9cc42313c74317", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422538, "uuid": "9348de7d-a44e-4ac4-8420-1db9344cbae3", "comment": "Malware payload (Mirai)", "value": "c14fbd1e5f16e55f02fded85e6d12f78f6d4502c33da1532df575244b1c8a952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422538, "uuid": "0fd85a58-ddc6-494c-aa7a-3b68d38d2257", "comment": "Malware payload (Mirai)", "value": "53fe4fda89db6d38c741a0eb470ca4f8f0448fcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422538, "uuid": "59ac097d-d9ab-4569-8588-777217ed744a", "comment": "Malware payload (Mirai)", "value": "c2bd95a97b0b41834a5f22d8eca92dfa857c640b19c3741274940b2a25ba0f348211ecce63f636af5a132df92909f745", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422538, "uuid": "0664b865-ce71-4fa7-a0f4-a79fe6fa92e8", "value": "T16B53F881B8819A25C6C557BBFE1F018D33069758E2DE73129D245F647B8BD2F0E2BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422538, "uuid": "8f08a419-da54-4dd0-bf27-a92916e210cc", "value": "1536:YdnN3laIcTjKGo5Q/oNPAMKiYDLNIHiOataQyA:+AIG+GYQ/sPXvVataQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422538, "uuid": "fc790b39-030b-4070-ae66-ef210f6bc6a3", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422538, "uuid": "87e9c31f-1766-488c-8835-366adb78a931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422538, "uuid": "75552cdc-3537-4463-a501-32bf59ef4e35", "value": "d7d0c9deb8071016ff9cc42313c74317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a10e61-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687459530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459530, "uuid": "43ad8fa2-a937-4c33-8174-589edd0bc0b9", "comment": "Malware payload (Amadey)", "value": "89aa3ca41750383176f30ed6db149e0d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459530, "uuid": "c4d012eb-6d4b-4d63-8f20-b807f1818ddc", "comment": "Malware payload (Amadey)", "value": "c16a9b6d2997107b08b137880a4c3dece11f41c0134332d1c978e6a9601a3b67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459530, "uuid": "0f109439-af87-4962-bf44-3199e32f81a8", "comment": "Malware payload (Amadey)", "value": "62fdc6fd3aee3e7fb50014e3da85c88ed7f0e48b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459530, "uuid": "2c66b5f6-2af5-46f5-9a0d-81016250d571", "comment": "Malware payload (Amadey)", "value": "c090540936a4188ad8dc7f9cec9e7198085bf1b42bf7440f8e94f3e30eb73ee0e49306ae3a062f0375371155b4b09ec8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459530, "uuid": "af7aaf2b-58a2-4f14-b06c-357bc0ca1a99", "value": "T1EFB401CA26804977DF63C9F2C4EFE9D64FBA70200BA04687130D96F58E456E0B61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459530, "uuid": "455492ca-f26c-46ba-b208-25d01b9680c9", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459530, "uuid": "d74bbbae-81f9-44bb-850b-32e727022063", "value": "12288:RoepFHTey5s12udO3wYxLjJuV0MZzPv+Tv6arQJQmZ:RoepdTey5sFdoxKnjXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459530, "uuid": "bf9ab8e6-e641-404b-89dd-99f750cfd937", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459530, "uuid": "311c56b8-976a-4447-af3e-17b108f7b9c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459530, "uuid": "0d920e04-8a87-4cfb-a399-e691ef5c7b5d", "value": "89aa3ca41750383176f30ed6db149e0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2bcf9e-112b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687458981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458981, "uuid": "18576919-ebc3-463e-89cf-44350edbc908", "comment": "Malware payload", "value": "722d410b90a62bc604735798be197140", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458981, "uuid": "ce008aa7-9014-487b-8905-09a2a4636903", "comment": "Malware payload", "value": "c283201cdd77cc0b2f888b6f41ec42a75c7a05e2df6a60805ec07800a1c53331", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458981, "uuid": "cf028ff1-6ed4-468b-93c3-adf8cb0e8030", "comment": "Malware payload", "value": "a98ac4acd5c5bb03f8fd57785fa6551957a8b242", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458981, "uuid": "92bf5f66-1626-4702-bd2e-6cbf321d64e9", "comment": "Malware payload", "value": "c040385410633ea2fa8c4d62336890ad37d483d48f182bb8ef64e3ec94ba1f4fe69f0325b9d52bc6ebcb241a256b4f48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458981, "uuid": "5651e00d-f5e8-4f35-aa7a-d914692f233a", "value": "T1C174496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458981, "uuid": "271ce7ae-9ddc-4753-a277-c34794eda69e", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593C:fIS1xbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687458981, "uuid": "ab87d590-f174-4fc3-90d9-4a0a8ea30692", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687458981, "uuid": "4479f100-b007-43f8-8b83-174ba5b38e24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458981, "uuid": "8f9d258e-2309-48d4-805e-1fa5810bc8dc", "value": "BSN-1633565570.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971764b9-1101-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687440902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440902, "uuid": "1bb621cd-bbaa-4715-9a02-a925f64e7324", "comment": "Malware payload (RemcosRAT)", "value": "7efa1ed82ee8af1ed80a418ebac61993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440902, "uuid": "a22d30f8-68e6-41ae-a67d-f236a0c516a4", "comment": "Malware payload (RemcosRAT)", "value": "c37fee102ae48bf968d4b5dc39c907328634deec504300e622b30ed2fc1bf6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440902, "uuid": "ebb33491-2c5a-47de-a913-9f8499296f93", "comment": "Malware payload (RemcosRAT)", "value": "b17f49c28ff21512eab0e2d9870b563f19c50c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440902, "uuid": "2efb498a-ac56-4a9f-9572-59332cfa40bd", "comment": "Malware payload (RemcosRAT)", "value": "f9f06a8245eb2ba5bb4ec7628e4f2e95105ccb6130f1e6dbbf3d1e39f168e617c6dbee8be203c5a327cdd0a18df55bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440902, "uuid": "02b17d80-8626-47b6-bb0f-43555783c5ca", "value": "T1B4B4231923F5C0FFE5155AB501AE1B171E76905209E406177B84BBA8762B7A3CE0E3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440902, "uuid": "0f34092e-dc1f-44dc-8f15-7c725227dd9f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440902, "uuid": "ac2fa849-703b-4d5e-8a3a-67501cb869fc", "value": "12288:XY1ZW7L1ZhcQ5daqf6rU3VdvPjNfdp6gm6gBC52/LAO:XY1ZWdTRaqfrVR7VS7mAL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440902, "uuid": "4b835ca9-23d1-45e7-88e2-c8a0816c9377", "value": 511780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440902, "uuid": "d1d3488a-587d-4e3a-904c-2534fd8cbfb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440902, "uuid": "2bc1f910-656e-450e-bcab-77f1a116e91e", "value": "rOriginalShippingDocuments_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1becaa30-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687430387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430387, "uuid": "24e11898-49b3-45fb-b1db-86d87390a9ff", "comment": "Malware payload (AgentTesla)", "value": "603eb947c50d8e706e9276faa4b6b87d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430387, "uuid": "ed9760a5-564d-4c40-979d-c5a668bf7c56", "comment": "Malware payload (AgentTesla)", "value": "c51f56e565c236b2e669c39368924762a0cae2461cdfb5fc86ff2030ea81e9e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430387, "uuid": "d4b0c1ce-f984-4f65-968a-83eb7ffe66f1", "comment": "Malware payload (AgentTesla)", "value": "4c9cf3066de1f99fd70e52e7677d2bc84194bd5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430387, "uuid": "2349bc66-6d85-4d84-a094-04aedf867c6f", "comment": "Malware payload (AgentTesla)", "value": "2d2cc3d96ed09a57a4cdf86b28b4a630fc4cf5a40e3ce248fa413edb775db6e48567b25d08310c06f1bfaa5214d03994", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430387, "uuid": "8ea2a95c-c159-463f-a4a6-57aa4596c9ec", "value": "T1EB13D25EE78F02658F450272271B1E889ABDB63EB35145B178AC837433EDC3D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430387, "uuid": "83ffc0af-ed4c-4125-a111-c6ab5ac22f78", "value": "768:VFx0XaIsnPRIa4fwJMUqaBVGkmkakCWnBXPeriUYkAWDzVJzvbpjj757DNmRE:Vf0Xvx3EMU9zgkCKBXPeWUYkjzVZRj7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430387, "uuid": "6f6e6e1b-85f3-4760-970a-a891c07500aa", "value": 43948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430387, "uuid": "d7e50915-0eb6-488d-bc27-1153e5c65b02", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430387, "uuid": "e2e908dc-341b-461d-9ecd-7a822f49505b", "value": "603eb947c50d8e706e9276faa4b6b87d.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b5d130-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422564, "uuid": "514c70bc-b2d1-4d62-b8dd-c7bebcfb45cd", "comment": "Malware payload (Mirai)", "value": "dd06f47495d16b79d8c60b46bb2a8f37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422564, "uuid": "120a1fcc-e1fd-4791-8bad-c9f540b7162b", "comment": "Malware payload (Mirai)", "value": "c527892183916c34b14b079ce69f4dd70ba927485ba19cda6655f0280b956e68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422564, "uuid": "8737a8b3-91e6-4b18-a193-618885dc6048", "comment": "Malware payload (Mirai)", "value": "c001c72c58188482ddbd6e1acffcea073d6cc1bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422564, "uuid": "fc70aeb2-947f-419a-bb1a-4499bcbc69bf", "comment": "Malware payload (Mirai)", "value": "add44c26ccb514b2799809d7cf4fe53f428341872a87ab8ac43b0701ecbee48c53a1d2d5535ffcb8a43a33693c4e6328", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422564, "uuid": "f4ebaa96-8100-40e8-8622-01a9121e0146", "value": "T160734B0232680F47D1960EF42D3F17E583FEE99121E4F689290F9B274635E77154AFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422564, "uuid": "041d7954-6479-4baf-a867-166028e48812", "value": "1536:bTeA81yGo1HFoGwbi1d1CgzLkN7KThmOJvYVD/2Xg:vePSvrwOnq76LJ8Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422564, "uuid": "24a6f0ae-5e6e-465e-8b39-0c63b2853a09", "value": 80200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422564, "uuid": "77386843-a02a-42d5-859d-776d3e5d967f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422564, "uuid": "f9f34607-5ede-4603-ae15-7728eb747b3d", "value": "dd06f47495d16b79d8c60b46bb2a8f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426e847c-1116-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687449779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449779, "uuid": "2f886ca1-56d5-40dc-8935-e5c2be018d5e", "comment": "Malware payload (Rhadamanthys)", "value": "eef19a1ded4b055516ed0979afa0ad98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449779, "uuid": "1add6670-99ae-444f-8ee7-c4329c3cf290", "comment": "Malware payload (Rhadamanthys)", "value": "c7b81f7cf58944192fa5b90d3e6300f2c50a37060d6081668d6380436b382b0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449779, "uuid": "dc00afdc-1448-4c7d-9e0c-fc7572e1583f", "comment": "Malware payload (Rhadamanthys)", "value": "a795823566f779eb48f80ed376c31e0323682427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449779, "uuid": "7ee7160e-20cf-483f-972c-5a5a0925b5af", "comment": "Malware payload (Rhadamanthys)", "value": "6fef1d2f6ad7560834a998e041aa35fdca7065f2888767a7458175c1c5bea20665b48fb579914f65bcfcf5fa38355c3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449779, "uuid": "80313cf2-d111-4736-9aee-366acd1d2f68", "value": "T16515BF226DB18872F032A93780D775609259B84059E89EF3675D1A2DDE239C3E61F33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449779, "uuid": "b783d89e-dae7-4a88-8d62-93896d6d231c", "value": "477397aff3d43108019a0f5607e1e17a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449779, "uuid": "f18f923d-cb15-44ee-be33-964b91e21be0", "value": "12288:yDPwBlS3eyqrIfHUrm2l/MzCvSY3Ok8VAvE1f5pTqg/MVfJGTe:z2OuMp3OkvvE1f5Qfo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687449779, "uuid": "63df218a-6a97-438e-9f30-3d493f279463", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687449779, "uuid": "192b27d1-08d2-4da4-b42e-113332130631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449779, "uuid": "eaae3e63-6943-4c16-b1a2-03dc4a0103be", "value": "eef19a1ded4b055516ed0979afa0ad98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c3a9ca-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687420544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420544, "uuid": "f3f91a70-8054-4fc6-89f9-872bf799bd27", "comment": "Malware payload (GCleaner)", "value": "0404a1815fec2f187d4b634fd0b2b908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420544, "uuid": "aeab4042-8051-4e05-b1f2-27b7608d160a", "comment": "Malware payload (GCleaner)", "value": "c8badfa5d7b3e9708c380ff4194574b870bbc68a93c41530705076606f5f4d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420544, "uuid": "23be3404-b3f1-4999-ba53-d70e454ae7ee", "comment": "Malware payload (GCleaner)", "value": "7b284196c34b87b70158800e20fd972efd468fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420544, "uuid": "fe0c8424-ba4a-48c1-a3c1-4ebcc3a597b3", "comment": "Malware payload (GCleaner)", "value": "8b4f43cc0351f0ea787342e7df5c66b260d08fbc773234d67e39b236631de3068b71d51d361600ff1a92436ae9432b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420544, "uuid": "ef03a8b1-f471-4fc3-989b-d76ec4b83043", "value": "T13164CF1366A07C71D5264B728E7FC6E5761EF6108F2A7B6B263C9A3F09B02E1C572344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420544, "uuid": "5515c3fb-2870-4fcc-b5ec-3b1ff9197b9d", "value": "926c66cb85de976302e3e83b19ac7ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420544, "uuid": "47084e6a-65f7-426d-b36c-bd8efaae6c9b", "value": "6144:g7tRy4OpQygFUlr84eltRtNlr9eTzz5O85:g7jy4hygmlnqntvqnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420544, "uuid": "0528a6c9-4ea7-47f4-acec-d8e9d1f68be8", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420544, "uuid": "f6234ad2-77b0-40b0-8d6b-8f4286e82f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420544, "uuid": "caf3d432-066c-4c85-a69c-a800d04f0e0d", "value": "0404a1815fec2f187d4b634fd0b2b908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1ea4df-113f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467428, "uuid": "8489e24e-983b-4652-8306-356af6dfdab2", "comment": "Malware payload", "value": "8edd439d07deb5ad3387d88e8d504a0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467428, "uuid": "db1984f9-b6b3-4967-b69d-a7ec2fefded7", "comment": "Malware payload", "value": "c95d96f22a48ae275882265e30343454fa610baaf2844e2422eb0514e515a132", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467428, "uuid": "8d889250-187e-4ee1-a4d9-aaed9bb9468b", "comment": "Malware payload", "value": "81f341750f38f61756be5642d35f309d130b0d1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467428, "uuid": "64093037-d63a-4b89-8367-5e176e616ff9", "comment": "Malware payload", "value": "e4e5723b18e72ee8591b92ea4a4879dd8a8d2881b7fc0d7a2b9b9888784f6de6fd7a6f193d83c68d5be2d4c8a630b4b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467428, "uuid": "d64a41bf-2f0a-4a80-821c-d59ea329f723", "value": "T18974496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467428, "uuid": "52f0706e-871b-47d7-b053-813d49cd9bf4", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593e:fIS1xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467428, "uuid": "cdb5b75b-4f7c-49a1-afa6-e53adf54ca63", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467428, "uuid": "09e1e03a-2038-4769-9b46-6baf5721059b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467428, "uuid": "2129583a-1fc7-4b56-92ad-e32e2234f294", "value": "BSN-227629961.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf51bb03-10ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687410475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687410475, "uuid": "dfaf6b46-57c6-4b79-a0df-262b42115927", "comment": "Malware payload (AgentTesla)", "value": "a7498599d114b42b2deba2b694f65eca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687410475, "uuid": "092add28-30ae-470e-ba70-450705ee628b", "comment": "Malware payload (AgentTesla)", "value": "c9c228746d9d6082dc35f586f77c60d95fb5de9a7dbd3ca2309f7505a70ed06d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687410475, "uuid": "6bb61090-af8e-47eb-a93c-ced7b86a63b2", "comment": "Malware payload (AgentTesla)", "value": "5284ec829368042a4f2071b9da696a56e98f58ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687410475, "uuid": "b68f88cb-6ac8-4ceb-837e-66519de56a44", "comment": "Malware payload (AgentTesla)", "value": "fcd0b2b0465a04a52011ebe354e3e5ea5937e6394a31536d690e47f30bd14a76fbb45e3f372def86396156dcf65fbd40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687410475, "uuid": "426b05d5-b625-4ea8-b893-0af5a3694e50", "value": "T1B0B412083BE96D23DB5D89BAB455120D03BB9A65B513F3DE4CE174FA0D7AF40C20261B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687410475, "uuid": "a55fc5e0-834c-4517-9643-ef778d9c5af2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687410475, "uuid": "c2a1db4c-8305-4365-aafa-d018d3e6baca", "value": "12288:8Gf/YjZd2ZcdDyeeQWRuo/E/b9XmYaViX3MzJSaMtPpoPK3T:/K2Z2meeZcT/5m3iy/MaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687410475, "uuid": "c213b98c-f461-4b1e-b2de-13ea2f09f141", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687410475, "uuid": "cf506392-4b51-49e2-a9fd-155339b3f136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687410475, "uuid": "cf48ea69-85c9-4502-ae09-842141fb2d23", "value": "a7498599d114b42b2deba2b694f65eca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974e6c10-1094-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687394087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394087, "uuid": "f60364dd-349f-41fa-a497-df6ba85eb315", "comment": "Malware payload (Amadey)", "value": "b00610a2a912123cbb74d8dab219799f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394087, "uuid": "b6b9558d-92fd-4dfc-8804-d961f2e9401b", "comment": "Malware payload (Amadey)", "value": "c9dbc567a9764bc8e3daef054db96a7b8074b1855370f558d2ee5d859e705485", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394087, "uuid": "e1ede77c-a94d-4bd9-9d3c-9f791cbaffac", "comment": "Malware payload (Amadey)", "value": "d8923489857cb7d686a5d859f21e59cca7a5bf0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394087, "uuid": "988b7998-4868-487b-a26a-3c7fa5dda1ae", "comment": "Malware payload (Amadey)", "value": "1d4a13afca6938f8494455542177f05de209fd15b0a026b4e3c55429077af4d5e01e853f2220b05991fc13fe3d4d83ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394087, "uuid": "0b7fccac-9a0e-40e2-a876-11258d70fc5f", "value": "T10026CD701DA3D2118EF7CD2FA9E56ED2949493B93E09DBBC8055C1AE164FBF0DA20E44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394087, "uuid": "2acde475-6161-43ac-a5a5-f1b57673b8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394087, "uuid": "237a0e69-e65d-47f6-8342-09f34ef6b33d", "value": "98304:2SQMGZ9LjldUO1owqGRRyxjM15uRUSzRWfy:a5LJ9a1MDuRn1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687394087, "uuid": "0de8f654-66fb-4b6c-9eef-24f0cebd93a5", "value": 4534784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687394087, "uuid": "9d0be1a0-31e3-458d-9b04-715dc389a788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394087, "uuid": "7197cc4f-5f1f-423f-9ff5-3f563de5b275", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ef0ee9-10e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687426673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426673, "uuid": "4788cbb4-dfbd-4064-86f7-d167102153cb", "comment": "Malware payload (NetSupport)", "value": "f6401312ab74a1d000e0c2e5b5d57fbb", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426673, "uuid": "b8f9a9f3-cd56-4d16-8129-8df9783e7a8a", "comment": "Malware payload (NetSupport)", "value": "ca6a29f26fdc38e2611c658b9870ad99220cbe7e451258ea678850dbe4343e53", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426673, "uuid": "10a0c6e0-830a-4acc-b2f5-f3a163eb9750", "comment": "Malware payload (NetSupport)", "value": "e688315f13c2d99c961254ad6f01bf7bfc9b9a8a", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426673, "uuid": "49427692-fd22-41a8-9d06-f74f6cdd402e", "comment": "Malware payload (NetSupport)", "value": "91287a935b493f8631844a04efecf0c4b05361f2db9c964f4f8b37585fb35b00e61c5245ccd0537722f8db094985ee5e", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "securiji1-com", "colour": "#9B2174", "exportable": true, "hide_tag": false }, { "name": "securiji2-com", "colour": "#1598A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426673, "uuid": "c13bcb6d-e4fc-4b50-a23f-98c93a1a5f9f", "value": "T1B5019E12160BBD5D164BE3CE727850501FE78444E16E362697481D4E9F3199A09DF859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426673, "uuid": "9816d0b3-760c-437b-b071-30ed16d0abb1", "value": "12:px/vEhzd+mPfGS0WVTXuZ7/PfY8oK51WGXXfDWQpubluiQQx3W8jn:ppMhzEmPfY1l1Z3BXXfDnuZQQVWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687426673, "uuid": "b88f385a-71dd-4f4f-82b0-9809127478ce", "value": 663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687426673, "uuid": "2f5574fa-6fc0-4d0a-a53e-0abfefe49773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426673, "uuid": "5438a907-7639-41be-8f10-23b68016e987", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789c8c07-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420235, "uuid": "c7c962f9-7b6a-4926-b8fd-f525d20c7324", "comment": "Malware payload (AgentTesla)", "value": "a34be31bfa59a9779821b759dc797934", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420235, "uuid": "3b70fba5-e7ff-412b-a281-7dfc8b2dc53e", "comment": "Malware payload (AgentTesla)", "value": "cb946347a9299eb757a05a41e423193f911e461e1b0896dfac95c42267bea7ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420235, "uuid": "350f8011-8284-4437-aed1-ba6378032dc1", "comment": "Malware payload (AgentTesla)", "value": "4a00ceeaacba0ab62a9b7be7a91533fc55a5750b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420235, "uuid": "0e3ad2d4-8e15-4fe9-8bfd-1b29322093eb", "comment": "Malware payload (AgentTesla)", "value": "6eb0a406245c9f6a4b88c1b29d5d89ecad2bf90b02cdb23b45b277a60faedd3bfa40e99ab4c975c864a6d07025183662", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420235, "uuid": "ee34b717-8db7-4e72-b1b1-fa5f6f163a78", "value": "T10154126D6AEB9CA3F05635305EA2DB27E3F5F9C42741124B5F70CFAC2812243DE19A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420235, "uuid": "5c593117-01c1-4a40-ab18-2fc54ab1bc6c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420235, "uuid": "43052f98-b7f8-4242-8e70-abbcc0a78d90", "value": "6144:QsSGhkMy9nTFg7h++tpBZ1OhK59m/oyP8tLK1cChue:6+6Fg5puKrmdkNkcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420235, "uuid": "2eac4433-3d46-432d-8a4f-991861f4b188", "value": 281083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420235, "uuid": "c8c7a473-7e36-4058-ba36-d9b949be655b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420235, "uuid": "81cb2ecf-7324-4b51-ba95-115533949876", "value": "Purchase Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a99168-10f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687436849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436849, "uuid": "c4b26cb4-5514-42cb-a350-69121862034c", "comment": "Malware payload (Guildma)", "value": "aac609dc64dfe1efb416e3eceda0593c", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436849, "uuid": "ce9d55b8-a6a8-4550-879f-a4abdda5714c", "comment": "Malware payload (Guildma)", "value": "cbece15ac0bf59645fdee5b5084ef386eae05809754f4c36fb28b959deffd93f", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436849, "uuid": "cec0c0aa-70ac-4765-9ef0-e9d4a348cae0", "comment": "Malware payload (Guildma)", "value": "554f13b26daa9738642094c84a93eb212879c083", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436849, "uuid": "ffa2e37d-615b-4e44-abba-84323716bce3", "comment": "Malware payload (Guildma)", "value": "236a8d426171dfee77c79a2d90438e957f3daaa53fcf2cb420984e3527353b9ba9809968791d0a14edcee21c64a624c6", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436849, "uuid": "a99db579-80e3-42e4-98f5-09a0dbd46992", "value": "T1ED0166A5936D0EBE94B70791CC397C0CD4B69CB24E4FA0BEDD277884C9255E10FC060A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436849, "uuid": "907a5a99-c3e5-4c7f-8184-84b5ce7689e2", "value": "12:tLRMgaZvreaTASq9VIB9VUaVuRj9VIz87KZIxi7SzrJdUTY/k+jFOV:tKpbTfn+a8640u9MZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687436849, "uuid": "0781a9a5-6481-4400-9c53-d3a091c072a7", "value": 769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687436849, "uuid": "6906a233-a650-4ed3-8667-041e5ad68320", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436849, "uuid": "3e3b6782-4850-40e2-981e-c1e996f67929", "value": "MLP3PUK589519J19663098.410217.33255.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da42356d-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687455617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455617, "uuid": "b69c48e8-db82-4267-a68b-ff7a22463033", "comment": "Malware payload (Amadey)", "value": "81d1914b6972b49dd3f2aad443e4ec89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455617, "uuid": "7714a42b-4128-4a48-b026-04df8cc9713c", "comment": "Malware payload (Amadey)", "value": "cc39c0fa08cc5c0dc454f4b2d9f93abb6f15938be97d5372c732c3bbee4ed424", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455617, "uuid": "02a62a74-53fc-4990-a35c-71d61bf39e2c", "comment": "Malware payload (Amadey)", "value": "d063db342de5371f9283b54dc56ef33d61a1c8aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455617, "uuid": "e30f9c71-4d5a-4a5a-ab42-538dc2b2745a", "comment": "Malware payload (Amadey)", "value": "bb6dad49e085acdd0189f4f2ca9e5bf4a22c112114fdfcf1e29d318d8c64972531a77159ea33688399d21774d6e80f62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455617, "uuid": "0ac96f75-3fcf-4e03-a848-c2fa944d6dcc", "value": "T169B4F0CA62808973CF63CCF1D4EFB9E75A75712107714B83130D8AF69E056D4A60BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455617, "uuid": "bfcfacba-b1b5-41ba-8bf4-04673934c69a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455617, "uuid": "cb5bd447-88a6-4bcd-9ecd-5dfe83a0030d", "value": "12288:Mei8dTey5shTbAhmuQUVFtgx8h1K3ngrj+QJQmZ:MeiMTey5s10Qm1h1K3ngrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455617, "uuid": "f56c9588-b59f-46da-b95a-02643d3b6bf3", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455617, "uuid": "b0f7db97-48cc-4c5e-9fcf-b68eb55f0b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455617, "uuid": "bc22ffe3-1037-421c-850a-d7dcdd00d9ba", "value": "81d1914b6972b49dd3f2aad443e4ec89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f508d9a-10d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687423548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423548, "uuid": "a8c2a002-1862-45e6-baea-2f1241c3396f", "comment": "Malware payload (AgentTesla)", "value": "9afc87de81574adb0c4ebd9d8b9e38d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423548, "uuid": "07ed8a5f-971e-453d-8128-c73761091cf6", "comment": "Malware payload (AgentTesla)", "value": "cd073922067eb8eb0bd71748a7d18636a017a8266022d6f9ba3806e82a928cda", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423548, "uuid": "496fe0d8-d9a9-4410-b88f-73196a004aa2", "comment": "Malware payload (AgentTesla)", "value": "ee7421117d76b7688f5aa8b882284b74d0dc8f5a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423548, "uuid": "4458d183-012e-4968-af30-99c36df43486", "comment": "Malware payload (AgentTesla)", "value": "8276ff8e9254e724edf58afcb240f731acb0e9fbb11501221f6d245b5a0024f6df46b16f5e53f3b43b0c98ffb136f24d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423548, "uuid": "d2b64edc-8e25-45ba-af7c-bc94b8f46567", "value": "T19D05239941507D2583959AC2EA9B31F7CBE87E3F39A78A0D00CFDF04F8E6C19C065996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423548, "uuid": "c5aae3f5-527c-4f5a-8c5e-4010812a94cc", "value": "24576:5n/flsYDdRHdis98Mr5YdDxcrl1VMZaEKspI4dUj:1/uCRHd9frl8ZaEfdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423548, "uuid": "e9d4ee84-35d9-4f71-ab87-a492cd80e34a", "value": 810034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423548, "uuid": "17d09785-47cd-483b-85ee-eecb540df7fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423548, "uuid": "bac0ce2a-b0ec-486a-8ef1-3542573b3148", "value": "CONTRACT-3I3EID66O6O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11905295-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422639, "uuid": "39a111c9-0813-4338-b2c9-d4022fa29f76", "comment": "Malware payload (Mirai)", "value": "459e764d6441db499d371a5be118e7f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422639, "uuid": "1f4c88a6-3486-4008-86c2-0b3ca9614c35", "comment": "Malware payload (Mirai)", "value": "cdc7c97e0b7345c83675dccb2432b420fbccb8e78696d48967fec1d3dacd9bf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422639, "uuid": "61c90095-4642-4885-b63a-57b19f496fc0", "comment": "Malware payload (Mirai)", "value": "2bd9182c56de984d5b6cb4362a1eb9fb2fb46bfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422639, "uuid": "0e684aa7-32bb-4f65-94d6-5939dafe92fa", "comment": "Malware payload (Mirai)", "value": "83a486374b887f2c319a8430e43766c4616e12e67958169316e6fd4a381b5199a0b512ddcfe60b61305f0329a4db8059", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422639, "uuid": "33244822-bb3b-47bf-8461-a22c7c67ff6a", "value": "T168739E75806D98D8D2484634B4E88C791B13F60496671EF9AACB4FA36017DFCF50A3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422639, "uuid": "7d5462da-2e0b-40ad-bcaf-221a15e186b4", "value": "1536:b/cio49NaHacdMrx3aJ+Tcp6UYO/7CV9LfSX6C9MMnnnc:bkinnPcyx3aJTsQ/7CrLfSX61Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422639, "uuid": "14ff53ff-6980-4f82-99c8-7fa5c4684389", "value": 75628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422639, "uuid": "1a105ae8-f9dc-427c-938b-d1e26b48348e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422639, "uuid": "820e4425-1289-43e7-8312-c25ed61f5042", "value": "459e764d6441db499d371a5be118e7f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1233f74a-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687430371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430371, "uuid": "fca50a2a-7d82-443d-a250-7ca6ef5c4295", "comment": "Malware payload (Fabookie)", "value": "89f04e97ebb271b88ef0231df7e51156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430371, "uuid": "13b520f8-e0dc-4b00-a2b6-18c768b9b874", "comment": "Malware payload (Fabookie)", "value": "cf4c10732e1ed55669890820b459236dc32f8df82c3246be778a327c0192b349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430371, "uuid": "77d12a39-3a86-4316-961e-0b317956893f", "comment": "Malware payload (Fabookie)", "value": "6ecc7bd6d957b70b9f6e37fcaea71df3e4fa76ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430371, "uuid": "97ca2dd2-4778-4d3e-b884-92304698f8ec", "comment": "Malware payload (Fabookie)", "value": "2405191f6f93b4dcdf40cd7def9651e6f7c8cf8c72ba527f5d99c27247de8a6ad19ab95a4534aebd1eb004ab0d3f277f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430371, "uuid": "56856187-a1b0-428d-ba1b-89a93dbcac1b", "value": "T12D741981B3DA4038E0B2C679CEB18363EA767C155B3056DF07609E6A6F73BE09531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430371, "uuid": "346b4c50-43d4-46aa-9c2c-22d656c50538", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430371, "uuid": "08e894f9-c850-44a7-9c50-4e493bd164c4", "value": "6144:xFH8RIT6ALm4StJ3rXDx49wV7Sk1RPiaODgKYleQ4SGP:xWdBXDuCNAMeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430371, "uuid": "f3e9fc1f-ce4d-4b21-a48d-8ebb770c1a69", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430371, "uuid": "070c09e8-dd4d-4b66-b49e-8e6feafe9f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430371, "uuid": "3038ce74-1e32-42f7-b978-b454a1413ab0", "value": "89f04e97ebb271b88ef0231df7e51156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba8a7cc-10d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420911, "uuid": "fccf98df-497c-440b-b65a-0adada0eb658", "comment": "Malware payload", "value": "cf65e302815897af91eb95bfc02d6c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420911, "uuid": "ff139c77-d7bc-4fd6-9ecb-b2277181a818", "comment": "Malware payload", "value": "cffd427f69fb9fc96891e8d2623c20310fc9e09675f36a7cf0916afe18c665d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420911, "uuid": "6708b5d5-0472-47a8-85c9-0bbdae4bf54d", "comment": "Malware payload", "value": "cc913b7af8f1abbb8fc36781bdb5250a1db468d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420911, "uuid": "d94b1f18-ed19-458a-810d-7a0eb917b14f", "comment": "Malware payload", "value": "4cf2d60bbf105bbc786f4c034b5ce16af305a23e083096f39970c4152b77fae23ab7707bb21d1a1dc4775a861153f481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420911, "uuid": "bc6aa0b7-044e-452f-a603-21ce2e03b046", "value": "T15A5612320532BDFE8B6C389094052B452CED5C275359DFACFA4414EF29A1738AA7F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420911, "uuid": "4f340ed5-fadb-478f-9661-1e1152874143", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6L:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420911, "uuid": "85b26eb5-9928-45e7-8545-e42e96dceb74", "value": 6279343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420911, "uuid": "2d4c43e7-f58e-4ea2-bbef-907490edb91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420911, "uuid": "f0dfa748-b6e0-4d60-ac85-5ce7b3420daf", "value": "cf65e302815897af91eb95bfc02d6c63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d399b7b0-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419099, "uuid": "3249dcef-47c5-4a23-9938-53fd2abc5884", "comment": "Malware payload (AgentTesla)", "value": "a827217aa0abb87868ba4cbbfc8b2adc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419099, "uuid": "05794841-86a0-4ed3-9894-e755ecaf0d36", "comment": "Malware payload (AgentTesla)", "value": "d019bc9b8c0bd6b5510d725027eee6ecea4f831cc63a7238785d93d6282fa1ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419099, "uuid": "d128ad0a-8f13-492c-82b7-ea00da79d226", "comment": "Malware payload (AgentTesla)", "value": "5feaa975e003a4e47f379d71c99ac7a9748fd277", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419099, "uuid": "93eb216e-be63-42dc-8e8d-58c35d36e040", "comment": "Malware payload (AgentTesla)", "value": "8f3c9e6a9a96a1f1727abdd2cc0bf0845a707c9470867bcfa845c174b9c2324d519a28cd83636ca915abc5ef8c873438", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419099, "uuid": "f189be8e-e08d-459b-8e8f-fe9fb94b34f5", "value": "T123E412A0B77E0007D46B4BFA25A00BB0137E38977876D7EE4E9B71DD54A7B404A20B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419099, "uuid": "ea85dab5-c242-424d-a871-3df81ce3fde9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419099, "uuid": "3177242e-e59d-465f-b911-5f390c55f817", "value": "12288:0XpM1JCIQfNsVcuoQH70saogAG5c1Q219LJRipSykz5KZbBokbY3X:/1KNobvgANQG9lRcSy0K/ouY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419099, "uuid": "80a87cf7-9fab-472c-967e-ed5620921702", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419099, "uuid": "a6b97c0e-dbaf-4852-96d5-4c89742792bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419099, "uuid": "b0d1170a-cd61-4431-915b-516de129f6c1", "value": "a827217aa0abb87868ba4cbbfc8b2adc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427a8d3a-10e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687427875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427875, "uuid": "c0bac165-546e-473a-8e26-4d115da8fab5", "comment": "Malware payload (AgentTesla)", "value": "cf59d76d943f7cce24c18ee5874ea61e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427875, "uuid": "3de6e642-3f59-43cb-9a8f-3fdff699ee32", "comment": "Malware payload (AgentTesla)", "value": "d0b929cf1ebc9a58215fee3d08819d1b0483a2bb06299dfde70c323fc833ef38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427875, "uuid": "c2c66b0c-b941-4266-bdba-b4108ac5210a", "comment": "Malware payload (AgentTesla)", "value": "325a3bfb53aae2e2ff4d31cb043b0f05b45ddd4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427875, "uuid": "4c68777b-0c81-4a1a-a090-5267a302e452", "comment": "Malware payload (AgentTesla)", "value": "aeb2e36db357f8f18a10974e20ad0fc3ec0ba7a5ccba8c80390757057ccd23457fd432c6f312cde99e84da8c44676f05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427875, "uuid": "5852ee40-c321-4cbc-a09b-f28077b14c14", "value": "T11D053372D7E3EC3571BED24275AB408E6BDA507D4231EA8BC4BD4D0BB11BDC011A85EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427875, "uuid": "fde1cb31-f135-47b8-97fa-9effc7102355", "value": "12288:5hdoH5JZU8yDHISKsRLSUaPrIPWhgqFmqbJoHhUB8CMPTIwCiqw3IB25ZLYJJaWY:5he+HIH2WI6LPloFWwTOGZLoajTr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687427875, "uuid": "6a036ccc-cc0d-4e98-9440-56bad036789a", "value": 824646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687427875, "uuid": "03b9db6e-92d7-40a8-bf59-53855623fc80", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427875, "uuid": "15b25b14-e917-4364-9385-294a9c077606", "value": "M.V LUNA ROSSA EPDAs & comp's 2 two POs, PSB-17398902, PSB-18384789.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf39428a-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430259, "uuid": "1bf4da29-09a3-4835-b394-443c254e4966", "comment": "Malware payload", "value": "394e381794d22a7b8b21e90220d9ac74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430259, "uuid": "1b4bede5-b9f0-4ab6-b3ab-79917c6ca4f1", "comment": "Malware payload", "value": "d0e3789eb98ff74bae246b25fc6132eb8b10d46ea2ec5eeca60fc1f4ad0365f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430259, "uuid": "ccad3150-c0da-44d4-984b-9c33cb8a8902", "comment": "Malware payload", "value": "a982cd95435f1342b62d1139d98f65d902e63fd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430259, "uuid": "5f681108-fce6-4750-a72d-71621d6851de", "comment": "Malware payload", "value": "8b36b33785c81677aee0080e2a53baf2f3df218899f3f6137678701e0ec1e74b42871066169d80e0a2f3c98fe1537718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430259, "uuid": "a64b46f9-85ad-43a2-bb1c-dc522d8fba6b", "value": "T11C06F0320532BDFD8B6C389194001B452CED5C67635ADFACFA4414EF29A1738AA7F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430259, "uuid": "01860dd4-b638-4ff3-8e22-c41e8a5f5b7b", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ737:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430259, "uuid": "6d3f7f9e-9261-4db0-97a1-d9cbf02f54bf", "value": 3729743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430259, "uuid": "e1f28732-0cd5-494a-9031-42fcc5265a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430259, "uuid": "3d7b57ce-4d93-422a-96b4-b9aa08068d4f", "value": "394e381794d22a7b8b21e90220d9ac74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7834f477-10cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687418087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418087, "uuid": "3b76c171-69ee-437f-8be6-a3c254865bd6", "comment": "Malware payload", "value": "9faf2d1c25b9bd804bf803505ad53c02", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418087, "uuid": "c8768703-c624-470e-a607-ee40c75155a5", "comment": "Malware payload", "value": "d0f6e8eeda3d18298b6ebc3ae053ccfc511d06f60724da683d361f29d2943e6c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418087, "uuid": "76162b25-b5d0-4c6e-9db4-7ffa85e3ae31", "comment": "Malware payload", "value": "d1fb0b72c758bd7508d534b3d3078944b05d3e7a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418087, "uuid": "77731339-77a8-4b15-b454-261802a385ab", "comment": "Malware payload", "value": "cc30062f23cb224c83daf383ff4540ee9c597682bd3a2a22b2187b81835eacc7454a153a5ef130ecda1468a41cfb41d8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418087, "uuid": "934883cc-4f4b-4a17-ac06-b9afc46bf050", "value": "T13DD16C65B2AB094ED8BDC035DB961A89E80A61C0872CE0A22541F3DDF1936D8557F08F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418087, "uuid": "6b23be38-b824-4fbb-8984-650b43ce54ad", "value": "192:nknIyqmqFeRC2sNYU0DqvblyCDn9XQzGX:kG3FeRsKND8n9wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418087, "uuid": "47a6655b-a8e0-469d-a994-5cc9e9610ef5", "value": 6161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418087, "uuid": "27a693e4-41cc-439a-86e6-3d188ecd0ad7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418087, "uuid": "7fda951b-a89b-43db-a128-df05d48380f4", "value": "Braemar MTM Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d7c183-1127-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687457244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457244, "uuid": "e053617b-d798-4eab-9835-72d5b4ee6a29", "comment": "Malware payload (AsyncRAT)", "value": "4a2744d94897be7fccb349b3bebe3abc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457244, "uuid": "d5e9101c-b6d2-455f-a5c6-8d696e2e5aec", "comment": "Malware payload (AsyncRAT)", "value": "d173f0a86e693ad02d756c7f8f1bee445c663aecf2b4f886f733ca01c0911345", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457244, "uuid": "99af64e1-d074-41a8-9e77-958f167467f7", "comment": "Malware payload (AsyncRAT)", "value": "c1a9584cc7bbba1e81a68e8a4155d55aa27aa03f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687457244, "uuid": "710658f8-0b01-4ec0-9b69-6a16d42fa704", "comment": "Malware payload (AsyncRAT)", "value": "957a6301f0b7d79042b4523006157d0b9ec72cd2710e012d6bfd66577487ef1205fcb3518ecd7ca1a45045254cc94891", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457244, "uuid": "e6998bbf-0da1-4546-92be-8b12d78c42c3", "value": "T1FD63F8053BE9801AF3BE8F7469F6628509F9F5AF2912C91D1CC910DE0532B829951FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457244, "uuid": "ff1e17f4-2f94-42bb-b06f-2d04a213e6df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457244, "uuid": "37b8106d-a6f0-4271-aa9e-c86f98b1f067", "value": "1536:72wukvF1ak9gcKu5UYFBfIfZJAPb2vEqTE6erv+3rPlTGNx:72dkvF1ak9Ku5UYFBf24Pb2FTEhwdGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687457244, "uuid": "31ca8000-54bc-44e6-b742-230014eb751b", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687457244, "uuid": "32a7cdc3-961c-4392-9fd1-0f037392cf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687457244, "uuid": "435c9185-4657-4e3b-b475-6a16102b1172", "value": "bNIH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6335afca-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1687420628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420628, "uuid": "ef07dbba-5d6a-45c5-8705-10e5dd74c1d9", "comment": "Malware payload (RaccoonStealer)", "value": "737e31d51dc6d865f7bc466cd3ba076c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420628, "uuid": "e562144b-8b51-4562-b70a-f03f00127c34", "comment": "Malware payload (RaccoonStealer)", "value": "d24b231691810a76e0df605db4a80386a9cdbb44faa0b7b0c4867e842a4e5705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420628, "uuid": "b7912a07-dc29-4b32-b210-f853827e0dc1", "comment": "Malware payload (RaccoonStealer)", "value": "16ab3191a737d93c05436a1a0f8539ce48968172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420628, "uuid": "1e6e29f5-cacb-45ea-9e97-c8ef0f953e19", "comment": "Malware payload (RaccoonStealer)", "value": "ab5d04b9cf580983c8d2931323d026d6e78b9b4bf72c30d96400566f5677e160737fb33bdd1e45236d6cd806e1cc752f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420628, "uuid": "95e4c768-99a4-457c-9c76-cdf2f9d8a45b", "value": "T1FF562353137401A0E5E1CD36593BFD9A72F6065F87C2BC7EACEA2CC724179A8E212563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420628, "uuid": "e67b2e99-3719-43d7-a6eb-fe66d8a4505e", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420628, "uuid": "36fc2415-428b-46bb-84c7-8568c679f065", "value": "196608:Ln4TZqsTJ6ynPPRUuOyUixLGPwtA0fEN:L2qoJgyUlPM9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420628, "uuid": "236cb307-7c03-4b96-9e64-26b99edd4d3b", "value": 6413312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420628, "uuid": "3c3a9685-003b-4d81-898b-0770f0810080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420628, "uuid": "302c5975-9768-4fbc-bfbc-d5143502abc4", "value": "737e31d51dc6d865f7bc466cd3ba076c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a148752-10b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687408238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687408238, "uuid": "37647ab6-9acf-45a3-ab34-399f1f8f79b5", "comment": "Malware payload (SnakeKeylogger)", "value": "eecdb787bdf7328b2ebcdc0ab2751e7b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687408238, "uuid": "aee5fcfc-2598-41c0-b303-5558d2820670", "comment": "Malware payload (SnakeKeylogger)", "value": "d25f58a1cc5b75521979856d19daf08e9641b9581f44c0689123ac05eb918ffc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687408238, "uuid": "69c93c4e-b763-48af-98bd-81e6d6a6bc74", "comment": "Malware payload (SnakeKeylogger)", "value": "f1db5c65672c82cba9c904199bb6033913316e8a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687408238, "uuid": "4a19cb14-0ee0-403a-9f40-2d5b1a22053f", "comment": "Malware payload (SnakeKeylogger)", "value": "489b2099336d19a3ff08d9bb989f78111a0be9270f957567097b4151e6df5d509c9c48699cb596ccdd1ae87fd260d341", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687408238, "uuid": "00095895-767e-4f65-85ec-e3c2a1e65573", "value": "T1789270565B8C4C61E26AE8B7474DA00E19BCF23630C255C4BCADE7757B7D10E0B6B2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687408238, "uuid": "b5db15f7-5b00-48a3-9af9-18cee872f82f", "value": "384:3DHgpJuCnr032V+hi/CsK2ZO+wUFzxF9ZqQ1HWwvJafkgQH8T/xwndMCgMsQ:zSrs2r0gzxnxxD4kgQHvndMCg7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687408238, "uuid": "4c5ae457-a655-47f6-8172-683e74b01ed7", "value": 19809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687408238, "uuid": "ffc6ce12-8542-4784-9075-e170798d0f81", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687408238, "uuid": "ed276c91-7d79-48af-b172-13ab15a11bd5", "value": "eecdb787bdf7328b2ebcdc0ab2751e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1400d8c7-1101-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687440682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440682, "uuid": "3c52c473-faa3-4ed2-b9eb-31bfefbbfe2a", "comment": "Malware payload", "value": "51ae82686bc083847054472a086c00be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440682, "uuid": "8737de80-eaec-4d7d-b1f5-fcbf02a4b586", "comment": "Malware payload", "value": "d2926503422cab431474d89b0826d80bbc06d449367decde0c49ee481a96b8c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440682, "uuid": "5021f43a-33bd-45cd-a347-e35575d2421f", "comment": "Malware payload", "value": "fdfc24b5c8c414be0bd98d6a0931a8330daf57c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687440682, "uuid": "94a04d4c-0a39-4f67-b764-4517a6213e42", "comment": "Malware payload", "value": "4dc9a9027adf18fdd7599b60b1aa3aebeba10e0f4084d86694f1369cb562cddab95a745cadc432baf7017d47a086c7e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440682, "uuid": "15ec8a50-ef8e-4a99-ad46-b32b6ab2af92", "value": "T11A348D5075C1C072D9AB2C314574C6B20EBDBC311EA0DA8FA7D8193A5F356C2E625BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440682, "uuid": "9d0ebbcf-87e0-4b34-ab04-6771364b15ad", "value": "b160e82af058a746bb7ff4c92e78e05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440682, "uuid": "48bd4cfd-f0c8-479d-bc0c-950c855546fa", "value": "6144:v/l3Kt4fRnA+63C7WlEUJe7R9r92hKs7+LnSkayD:vJKt45nA+63C7yEUJe7R9r92hKZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687440682, "uuid": "ecd92130-c3a0-4b6d-aaf7-2dfc82a87a21", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687440682, "uuid": "a9929b7c-b7a7-453a-bc16-975c58a5beeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687440682, "uuid": "cb69a18c-024f-4e78-8a40-a1b020fa3237", "value": "SecuriteInfo.com.Trojan.Loader.1559.7561.12298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3492e205-10fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687437730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437730, "uuid": "654065b5-b7fd-4c22-9a36-946b22134a73", "comment": "Malware payload (Formbook)", "value": "95817bc2c8f3c3ee59af11cd1d2be85e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437730, "uuid": "8a494266-f9ae-452b-b6f1-5e858457e226", "comment": "Malware payload (Formbook)", "value": "d3e2ea1848859a68a57ee684b9bc17a85359f0293c58acb100e9b06337278506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437730, "uuid": "cdeffb2c-05a5-4049-8e46-2689ae63a205", "comment": "Malware payload (Formbook)", "value": "cbe3149f2e4dffc3ad421416eaf3464565b4f9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687437730, "uuid": "e9c0a4c4-d474-43ba-acdf-469ddd373e61", "comment": "Malware payload (Formbook)", "value": "78f2681ee9aff428ceacdf2b03c6591c6adb041dc62b77abe4b45540aafdea8dc205b24ca46b8f90362a79c9fc742b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437730, "uuid": "ee0c469b-ae04-4378-b6c6-23fafc308097", "value": "T124F41290A32E1033C54B0BFC5252577153778AA7B453E7CA8EDB32E666FBBC58610983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437730, "uuid": "35aaaa27-5cc1-43fa-ac64-ee9f56f118ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437730, "uuid": "1c39b249-d1c3-479d-b5c9-03cfa6ec2321", "value": "12288:G6XpM1JCIQfNsVcuoQHL0sfT2whLTrkJND6FsjKGrHiIOIJ+oKNeCX:u1KNorfhRyOsjlAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687437730, "uuid": "2f17ea47-7141-4fe6-9c33-500bad5e5e00", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687437730, "uuid": "85772859-e98b-4647-a776-8f397aac5547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687437730, "uuid": "b2fb4a59-a983-423a-b9f5-c2177caf31a8", "value": "Product list 22062023-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d968f759-10d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687422974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422974, "uuid": "8bfe4321-65ef-414e-8d42-9a978815c666", "comment": "Malware payload", "value": "dede269a4e3195b812aaa001d55ef48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422974, "uuid": "81d4d44e-291b-45c0-b26e-221c5be159be", "comment": "Malware payload", "value": "d47ae2e376a07d4206f98b12bb548dd9b15063b1b5d8b304209b61b507799221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422974, "uuid": "4b0104f3-088b-48e2-9d1d-9761aabc1abc", "comment": "Malware payload", "value": "12d6967c4462503267bfb576fe0d32de0edf2b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422974, "uuid": "c3bd91a9-2e04-4c3a-93ad-cc25abae39e4", "comment": "Malware payload", "value": "0ab50ae47b1d574f297d9ffb952157bcde6e9ff2833abaa50554ab4bf2c49c02d51b4c0c52a1920add4ac8876a96aec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422974, "uuid": "8c7f4b92-9dc4-42fc-a65a-a78fb97e9f32", "value": "T11AB5F11273D5D036FFABA2739B6AF60156BC79254123852F13982DB9B8701B1273E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422974, "uuid": "898932ee-7efa-4ffb-80bb-dd6e6b69fb00", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422974, "uuid": "ed0e9b58-2554-4286-b4a6-20fc1c83fdd9", "value": "49152:7h+ZkldoPK8YaAzFCz+sQuMLTzaKIb4EPYxTSQ:k2cPK8sFCtmvCPYxTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422974, "uuid": "e3769871-2a41-4b93-a5a8-0eb07e82971d", "value": 2281482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422974, "uuid": "c2436d46-86c9-4b93-b108-ee493eedcfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422974, "uuid": "54545dc5-9cb3-4195-995f-05a0281e67da", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec15e45e-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422576, "uuid": "6b801122-4934-4ba4-b069-9ba22b72f4a4", "comment": "Malware payload (Mirai)", "value": "38c4e411439d0dd63935747cbcf76271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422576, "uuid": "36b67c23-9d1d-4b32-9e0f-4c4d838e6292", "comment": "Malware payload (Mirai)", "value": "d5c5cabc592a7cf4cc7ddbf180909d674a95ba6c9a0f53be59cd147fbbf30ec4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422576, "uuid": "549ce919-4744-43b5-8697-37d9b4160a7e", "comment": "Malware payload (Mirai)", "value": "bc1841a8ac2294688aa516df66623d4858354546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422576, "uuid": "1ecd7234-233b-4bb7-ac57-9ccb1fb479c4", "comment": "Malware payload (Mirai)", "value": "de82b1261f1e70ff04e65d71037c87f03a6be7b9d326f588f4f1439b5730c2bf90e6dbe23a294f38c0ec07fed1b9f8c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422576, "uuid": "0daa0905-9b2d-4c39-94d2-3726a8b97d83", "value": "T122834DD5A4005EACFD4FE9FAC9250B1DE92173005F630F2BA667FDA32D231A1AD0AC55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422576, "uuid": "3586b10a-4fc3-4dc0-937b-d2d8826ebdf4", "value": "1536:UFTOs/kw1feJCg6jdcf3nN60rhZUWPGEKcGXX8w1F1VGicyR0F:dkE3nY0dZxfg9UixGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422576, "uuid": "42a4df99-4127-4862-b6ce-b2388813e346", "value": 81040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422576, "uuid": "1e3496db-87fd-45e7-84ac-c93add4a5850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422576, "uuid": "3291eb6b-8a3c-4444-b3a5-c1840933bbe7", "value": "38c4e411439d0dd63935747cbcf76271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4620d58-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687420013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420013, "uuid": "1f1c5f13-b2e5-4455-acf4-923cf0d43e84", "comment": "Malware payload (AgentTesla)", "value": "52d340eb0e478081ecb99cc3ba37c07f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420013, "uuid": "b01c5c62-7888-480d-8c3a-56a43f70a46d", "comment": "Malware payload (AgentTesla)", "value": "d5dd79eb30ee21b80384417ecf6be358774e9ec9f6ee4e43eb699fb3aafc8480", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420013, "uuid": "4cb100e8-c46a-4a2b-9073-cbefa9ec4b82", "comment": "Malware payload (AgentTesla)", "value": "0f9ccc94eaee5317a859dacdf405ad0b12eaa2bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420013, "uuid": "a4a2a150-abf1-4bfe-b0d0-f702b2332535", "comment": "Malware payload (AgentTesla)", "value": "f5c37e90ed08f92cce97c3378c0acaaf15d86e9e8a789720e0e1787a030d90fa90633b35f599842b510ee1465c718c72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420013, "uuid": "ee2802cb-ea5f-42fb-aa06-94a9b933f789", "value": "T142D423B20B7D29CBB35900E5DFD65AC9C0E89C815E747228D4A4A75B1ABE8D08F1DCC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420013, "uuid": "65f77ab1-5b0c-4bb3-ae77-fc7c9c255505", "value": "12288:PJFZJQxZ3U/vqKw0rpgnL6XdT/SxlirR6sKz3Ms4dQ/Y0YxRCJqWCT:PJoZE3qKw0rmL4GMi3z2CJTCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420013, "uuid": "1a410965-db33-40c8-a967-339ea885d1c9", "value": 638037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420013, "uuid": "420ecd66-8f3e-4a14-8c71-6b15d11ff2fe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420013, "uuid": "b5073138-a2bb-4e3b-b30d-ec7efb25c8f2", "value": "SOA # 87594094.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d98bf1-1125-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687456489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456489, "uuid": "4adbb136-39a9-497a-8ced-709df9702de5", "comment": "Malware payload (Guildma)", "value": "770e2a864be1c71fccd1715f7433abb1", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456489, "uuid": "19806c3b-af83-42f9-88e8-6e18f853af2a", "comment": "Malware payload (Guildma)", "value": "d6d9da79cb5047c9f47d10aaad01d8f27f775973f5f04379d5c3346f31f4225d", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456489, "uuid": "f1b7e99b-8824-4917-b80a-3d92a31c2d7c", "comment": "Malware payload (Guildma)", "value": "551c810fa3430e8f150aa10a326078b0a3f7d9b2", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456489, "uuid": "de4c6500-f5e9-4d0c-aa72-dd5e592c52ef", "comment": "Malware payload (Guildma)", "value": "65cc302f0116029a7c5f7135280899165ce4e2e1a2cb7dc319b3b89556caf5740264af1744693c1c93413a2ad1d25528", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456489, "uuid": "ae1c6ded-a8eb-44ab-9f98-a2b0bd5e648d", "value": "T1F8111EA593680EBBD8B307B5CC35AC0C98FA8CB30E4F91AED9633544C5285D51FD0729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456489, "uuid": "c9628449-17a6-4d1f-ba85-97c3500098ea", "value": "12:8rflM8OByN6/nfMZCcveaTAS1VIYVUaVuRWVIz87KZIxHMnD3VQVzjsfOpaR67kX:8FN4UZCcFTfg7a8T40uHMnjMj5aR3cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456489, "uuid": "ee33581e-814e-4b5e-ac8d-123d027ddc82", "value": 977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456489, "uuid": "4379e019-5caf-4a33-a82c-f38e0932565d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456489, "uuid": "78212f48-f648-4d90-adc8-a1540c6f891c", "value": "ENRTWV86LNOX3B15084930.829123.55538.LnK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf863c3-109f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687398953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687398953, "uuid": "c745fb30-e7cb-4fb2-8f77-ca7e49a00bbf", "comment": "Malware payload (Amadey)", "value": "f0883f4a05f137ed91fd77786f00ba93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687398953, "uuid": "405adbcf-9ff9-4f4f-bcb9-03b3c36fd341", "comment": "Malware payload (Amadey)", "value": "d75821f15f29a2031c22880cae112457067158c40f850a9d5eb065237bf05cce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687398953, "uuid": "2f4ef85e-070e-4db4-adc0-89852eca9b21", "comment": "Malware payload (Amadey)", "value": "d7d97ad90cbad9fd3d30e74dff973c481fe08fda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687398953, "uuid": "b7f43524-d925-440f-984e-75568ec33b84", "comment": "Malware payload (Amadey)", "value": "ecdd6cdcc8b4590814cd3ad8f3f832fbce8acc7ac075d2e17abe02c9b0f310e3462b43ec2f45a5b87b18c30307ee1980", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687398953, "uuid": "c7a5d839-d59e-4a05-8ba2-49a9b5a41f18", "value": "T1FD15020276C0C036D5B725760AE0EF74857AB921077119FBDBC80EAE4F215E0AEF65AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687398953, "uuid": "6df8524c-963b-4b0b-9c8c-6206150def47", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687398953, "uuid": "eaa79d23-b968-4e9a-b0d9-9a5fd50c5873", "value": "24576:6kNeezn/7ZK8Y8/Z6kA2Z0SUF39UB9LWsXR2J4rc:XNeebzZK8ZZfA2ySUF321TXoJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687398953, "uuid": "869b68fd-c15f-45b7-a21c-461d32e8f807", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687398953, "uuid": "508a8931-f473-4a84-9661-f6510bfbc921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687398953, "uuid": "0bb0ae26-5f66-4035-a145-4c24d0a11904", "value": "f0883f4a05f137ed91fd77786f00ba93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff1c834-113b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687465666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465666, "uuid": "fb0655a1-6566-4555-9efb-008f7042d495", "comment": "Malware payload", "value": "eb09ffd49c38007729f51471f46a3911", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465666, "uuid": "afe3f6a0-78c0-4294-a0fb-38d7fb1e2f5c", "comment": "Malware payload", "value": "d78fecf45ed687ec026cdad0581b5714b4238baf1a8731687a9f31d0684f25c1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465666, "uuid": "4ee0433d-f1ce-4b6b-b6b3-56f9e3007b08", "comment": "Malware payload", "value": "d811752b397fd0cbe3268d4ea9e51c06dbbd4cb0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687465666, "uuid": "4a38f2bb-70e1-433a-943a-ddb6150a4411", "comment": "Malware payload", "value": "67c64b8bd0486ea0d1648dda9fc2960e3d92782c593c46064d9f5b91689a4cf25bb155c3048a422c5ae9ce5f3d9d1b73", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465666, "uuid": "3e32880a-7cb3-4438-ae12-4ccdf088a1ec", "value": "T19577335D95F3444F3A7BD6328BE8C9E5DBC45124F382C63E7051BBA792C7BC85AA4208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465666, "uuid": "9b518f97-64af-4fc4-9085-2bcdaf12d1da", "value": "786432:J7vsNwSxEZCWFq7nqTOBb0K984zfFN5ENJV0tnH:J70NBxEA7aSwK984K0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687465666, "uuid": "42fd81c2-2e13-4127-83cb-633d4fb5b100", "value": 33162160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687465666, "uuid": "87bf9be3-478d-44e7-86d8-03982287c1a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687465666, "uuid": "aa8e26f1-f457-46ce-b186-3e64e2a293ef", "value": "eb09ffd49c38007729f51471f46a3911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a01b56-1129-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687458019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458019, "uuid": "46b02786-10f9-425e-a6a5-560eb6ffa297", "comment": "Malware payload (Amadey)", "value": "0e46049953cefeb704110ddfcdfc427f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458019, "uuid": "958ba32b-c12d-4a8c-89cb-2424b22c8488", "comment": "Malware payload (Amadey)", "value": "d7dde8dee8de0c00c4ccc0ffbf63b85721f6d86debe26bca22162662824d1c16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458019, "uuid": "a273ae87-aec5-4288-878c-0144fe9e1495", "comment": "Malware payload (Amadey)", "value": "9426248e785ed7dbd7df108c0c3133e47be11868", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458019, "uuid": "152ddf00-6c76-4f08-8870-0279ba996a71", "comment": "Malware payload (Amadey)", "value": "c14e771fa8b172acf6ae5ce4a85aaa2b87dd865b311c789f60eca3bed03476c54454baf4d8dd8b1c3768f6f16f179710", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458019, "uuid": "c64b2252-af82-48f8-9acb-5307eea2c6bc", "value": "T16DB4F1CA22800973CF23CDB2D4DFEDD74E76612107714B87230C9AFA4E556E5A61B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458019, "uuid": "f7eb9164-6e50-4d81-9b48-abef281fd80b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458019, "uuid": "815b407e-9b9b-410e-814e-e000084a74c3", "value": "12288:W0QxGDTey5sy1TSz0zfppQYPrBBCJAMQJQmZ:xQxoTey5sWmzcfp+YPrkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687458019, "uuid": "2c70c45d-2aa1-435a-a645-283e9a36fa73", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687458019, "uuid": "3ef91392-ad94-4a2e-a604-e778bc16ae26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458019, "uuid": "1b3847c7-e732-4725-a4f9-746bbe16396f", "value": "0e46049953cefeb704110ddfcdfc427f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2b2366-10d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687423437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423437, "uuid": "bdfa4bd2-ff31-42bb-ad6f-d271c2865e42", "comment": "Malware payload (RemcosRAT)", "value": "88398a11e31b6e511b1562cdb1814530", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423437, "uuid": "a6ccf9f0-674e-4886-8ebe-73f4d3dd9e4c", "comment": "Malware payload (RemcosRAT)", "value": "d7e64e5c78457ed99bc745fb38fc28fa0792d7cf6491c7c9e9c35cb3b3b82d83", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423437, "uuid": "5b100a59-0469-471a-9757-9844d3e7339e", "comment": "Malware payload (RemcosRAT)", "value": "609a66bbcbd0a2263fd6705514d040001f95aee3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687423437, "uuid": "9ca79977-24b9-4c24-ac1c-235485e402d0", "comment": "Malware payload (RemcosRAT)", "value": "23c60862898c8f158aaa6417c9e3fd37cafbaba45193dc5b3a604fa23a39ff2a0bc3720d21b87c1c3f2fad3fa478f73a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423437, "uuid": "a2680d8c-735c-4dd4-9bd9-4b6031476702", "value": "T19BB423B9005BD40208D8DA708F669357C2A12B79DA81BC7C444FE7F5C3AEA84DDCB766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423437, "uuid": "ccab3a30-7f67-49d0-b0f6-a026764712d6", "value": "12288:+1Xg79rnFRTu24tuSQ/lQRySQpZ1WV6HQoYxvcyMup4Z4oP+W8f:mw79rjTfSxQ/l1SQT0V6HQJKduFoPpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687423437, "uuid": "b1a3741e-17ca-46f1-8308-15e2bd09eb14", "value": 519173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687423437, "uuid": "f7367f6e-12ba-496e-887e-40ecdc8e94b0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687423437, "uuid": "097fe152-1641-443b-976c-0a9e6aa63aa0", "value": "Original Shipping Documents.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab85358-10bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687412400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412400, "uuid": "98b3fd00-ebcd-4f21-afee-6c38ad315c59", "comment": "Malware payload (Rhadamanthys)", "value": "f5a4e48c469d899bf882475b36dff8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412400, "uuid": "62c76637-1410-42c1-a3b7-548f30aa35bf", "comment": "Malware payload (Rhadamanthys)", "value": "d850df618ed03fd518cb4c52bb09657a2eda865702a0498b965b0279ea73b362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412400, "uuid": "fa1babb0-a80d-4a8a-9135-3b9ab015ddb7", "comment": "Malware payload (Rhadamanthys)", "value": "b1845ec95f2837038461a04dc266bcb48a052fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687412400, "uuid": "cf342766-3b30-426f-9ba4-822cf108afa4", "comment": "Malware payload (Rhadamanthys)", "value": "c474383ee33f82768360deb94f94f987242f38ebc87e8a918d5041b683e082e36842fb9ee7de57b78c961a119d8dd5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412400, "uuid": "c6ee013b-a2e6-41af-a761-a1fd4fd1a6e7", "value": "T13EA45BA5BBF2ADC4CE8D33F388046BA4069E477645F2D2C84D295952273F6A5CB0B53C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412400, "uuid": "2d0d0c79-2231-4c97-8698-6cd332285281", "value": "fd020041ed8eb76ffbdb414a8b3716f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412400, "uuid": "f9e7c24f-50e2-4806-96a6-2f3e609d2212", "value": "6144:L/E8DIpjK28t4snQxlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snqv/cgu4VGn6OaM+ucj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687412400, "uuid": "ae3bb2f4-ccbe-44c2-9d46-287f3dcdff2f", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687412400, "uuid": "1544ae31-f78f-4aae-99e4-16cba90c650f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687412400, "uuid": "2a24ad91-f179-47d4-9e65-f687814ca10b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd039c2-1116-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687449906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449906, "uuid": "056a83a2-7a7d-4d20-b23b-7c76b74c5355", "comment": "Malware payload (RecordBreaker)", "value": "1db2259b0d11fa8ef8c85a8cafc37f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449906, "uuid": "31398a8d-8fa8-4b7d-97b2-cc9c66dd6937", "comment": "Malware payload (RecordBreaker)", "value": "d8559130616dcb860a123fd7228fda07563e4623efc4cc186fba1a695d8c83a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449906, "uuid": "b99b5776-2257-4d2f-964b-3882fcfac5b1", "comment": "Malware payload (RecordBreaker)", "value": "c59b9caa9526c297f834fd5fc840fc530c2c1f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687449906, "uuid": "75b84b9f-c384-44d1-8de7-8600c1a4a8f7", "comment": "Malware payload (RecordBreaker)", "value": "761efb8b20dc997ed59a5610fdb37e747a52b038cd5fbaa478df6f0a84cf0322058e5fc8566dd2b1509d629fef3a6e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449906, "uuid": "2a770167-c0db-44e6-8132-b029a0fb6f17", "value": "T1A1744B43B2E26C61E525CA728E1EC6FC671EB5608F597B9F26488A3F09741F2D233315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449906, "uuid": "2610d4f4-7a68-4f3b-acad-7df9b854386f", "value": "c9bc0f68c88ba3111fd371f437c636f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449906, "uuid": "086ce26c-14aa-4436-9e77-a936071a351f", "value": "6144:9A/8ic0HjmRESNERDFalTOkIRmL9n6lU2ycjC9mUWpzT:Xic0HK6SKJFKe+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687449906, "uuid": "6590e477-7a79-4a0a-97ad-a4315be5dc36", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687449906, "uuid": "81246a4c-8aab-4945-ba24-f77ffe39dabd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687449906, "uuid": "c815ed1e-32a3-4b21-8839-b3ca94143c2d", "value": "1db2259b0d11fa8ef8c85a8cafc37f9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d4a3db-10e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687427884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427884, "uuid": "0317614f-aaf3-4980-bfac-1ecd091199d7", "comment": "Malware payload (AgentTesla)", "value": "48094c1543a5294555d7823c04f9c841", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427884, "uuid": "dbe2473b-8400-438b-bdbb-19699071f6c3", "comment": "Malware payload (AgentTesla)", "value": "d954757b83f62ace1ec7dfb25bc61b328be1b0393f88a9487acb9eb1866f8b1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427884, "uuid": "5a5760f3-7969-44ad-89eb-54ab3400d8ba", "comment": "Malware payload (AgentTesla)", "value": "e5bb49ae2c820766e16f3be99bd955fa52a72ea7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427884, "uuid": "2d35ede7-dcc3-467b-bc72-96cb6fb7d58a", "comment": "Malware payload (AgentTesla)", "value": "0333d95225380fccf6ac700bb8a8b7656c7d074268f64a208bde22e81f7f18d208ecca0091963e52ade6e5a1e6b338ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427884, "uuid": "1f372b98-b53b-4f72-8ab6-b50445239631", "value": "T1BA45BF08BAB6BF56E57E03F580122C70C3B7905AA25DE36F5FE211DA2EA5BC08445F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427884, "uuid": "ee67969b-0361-432b-9566-ba366ca021a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427884, "uuid": "3045e0cb-f3fa-48a3-9757-59dd50673329", "value": "12288:ec2vkHnqY5KZPZ6ISIyBXyP1ob0txZVQpnO/xVfZ3iDWRO3uU3S5vUTcg+SrI9Ai:yvqx5wjysSSxsRcxeZROvnsIqz2TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687427884, "uuid": "a64f7d5d-9130-4890-a031-e38bc55bdd97", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687427884, "uuid": "7704eead-570f-4519-8d15-0d34a3c43332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427884, "uuid": "aaadccd0-2b94-4e23-bb97-c2d7a2f8a31c", "value": "M.V LUNA ROSSA EPDAs & comp's\u00a02 two POs, PSB-17398902, PSB-18384789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eba3416-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687430392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430392, "uuid": "c352713e-45b1-4a24-967c-bc6cba6bb501", "comment": "Malware payload (Formbook)", "value": "35aedb11b76d1eb2494a18e7ea35a2f5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430392, "uuid": "e645cb66-18a8-4750-b7f9-ce7cc4bd855c", "comment": "Malware payload (Formbook)", "value": "da232dbfbdb66d8f79264b3d1221fc10d92c5eff1115a339b0b364802ee0fe4d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430392, "uuid": "ad376923-b503-4f1e-bcaa-3e6b6cd547fe", "comment": "Malware payload (Formbook)", "value": "685cf1c7f7760b78b9ed0bc3f1bfa88670164922", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430392, "uuid": "0b5fe3c1-1520-438d-99f2-acbb7088ad5d", "comment": "Malware payload (Formbook)", "value": "a5acc57bde2574a9b94e1a09a0760178e280c880f1f5143911cf12c7d1874aaa2481b3a34c4680c47362927093381b46", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430392, "uuid": "5f348fa3-98d1-4be5-9e33-11872a0564cc", "value": "T1D485020DE104837AE75607B12C9271A9901C7CB67FC9988276C6370F6E33FA769E61C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430392, "uuid": "a9a96e3a-65d8-433f-b276-d4ee792f7c2d", "value": "49152:CQmmQ30Wu1MMTYDlQmmQ30qu1MMTYDqZlDjiQ1qSC8:CpmQkWuOlpmQkquOq7jiQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430392, "uuid": "3db2350c-baba-4b6f-938f-48505b533f6b", "value": 1801216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430392, "uuid": "12cfeb2a-1f2b-4e0b-bfa4-60114dcc000d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430392, "uuid": "bbed40d9-a0b3-4c24-b713-65d81ed63c73", "value": "Eurodelices 22 06 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66493a41-10a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687400877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400877, "uuid": "0e46d48f-2680-472e-bafc-edf34e5d0006", "comment": "Malware payload (ArkeiStealer)", "value": "53c3c141b89b777bb8d9827e31e59802", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400877, "uuid": "30ef1056-c17a-4ac1-90a8-dd7eaf0e0f48", "comment": "Malware payload (ArkeiStealer)", "value": "da5f869e09c374e7a3a31d7144750081b676b68aeed4a71b277c089a271ab4a6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400877, "uuid": "2c58f54d-ce8f-4629-9741-f212c3b4d7f1", "comment": "Malware payload (ArkeiStealer)", "value": "01b7d62ab4cd1155b59e3d21665d49c73afaa23b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687400877, "uuid": "e2adb668-9ffb-4fe9-843a-e60ebacc97c5", "comment": "Malware payload (ArkeiStealer)", "value": "8adb881d872352c0f151d40076bfba92942262c0bc1a494997d6a5d21be62978efe4e306bc655355b59336ee164f7eb1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400877, "uuid": "028f80cd-4628-410f-b23b-737d74e8c3e6", "value": "T10464CF9362A17C70E1224773CE6ECED8766DF5108F68BB9A12589A2F09B01F3D673750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400877, "uuid": "57dc2bf0-8857-46a9-bdf4-c53917951af8", "value": "7e2f40dcf3d81681fb786c02378f9f78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400877, "uuid": "5c112197-c914-431a-b9f2-07aa01366f27", "value": "6144:bs5KkT2RQgQhGlq5OrofyNAhL5eWjO+ZD0hSPn:bsYkTwShGl7hNATNq+ZDOSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687400877, "uuid": "253026d4-a7df-4f8b-98fa-4841eb1fa025", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687400877, "uuid": "68af5334-65f9-435a-a374-1b73c320aca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687400877, "uuid": "d5482bb2-0413-4737-bd3f-0d3e2f002c26", "value": "SecuriteInfo.com.Trojan.GenericKD.67675351.3456.1688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e3e9f0-1142-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687468768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468768, "uuid": "f6954ecd-b595-4314-8283-542b824bdce1", "comment": "Malware payload", "value": "08b2654169b760b6c7e5239dc45fe4ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468768, "uuid": "0f7389ef-e995-4fb7-8717-837b27054b4c", "comment": "Malware payload", "value": "db138daeea031256b76f34a27868207927c503c9d708a2263faaa8658e9ee581", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468768, "uuid": "3a08ea22-0576-4dad-b5e1-db6a8bb667a8", "comment": "Malware payload", "value": "06648b1f0ac8ec3f0ee6e664f1fdf3b0ea3c6eb6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468768, "uuid": "1b839b62-3a46-496e-86ce-3b7fb8cb11ea", "comment": "Malware payload", "value": "72e2b3f304a6c8244ca7214bf772aeb893e7a1630292fbc166509c8b07b2690e7b577bc6a02c1122554905e98c112e99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468768, "uuid": "f52c1172-451b-434d-b48d-a5e41b877d89", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468768, "uuid": "0a0779f7-4e41-43a8-b0cf-fbf51aa6bd01", "value": "3:oe/phJoEgCPX7W:oeRjZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687468768, "uuid": "c9c6ff6f-24e2-47bb-90f8-c3b095a45496", "value": 45, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687468768, "uuid": "50e6ee8e-88f6-477d-896d-a5ea9b5830f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468768, "uuid": "dd838a27-5648-4628-9cdf-6ebc3fcd3ddd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3b39c1-10c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687413849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413849, "uuid": "c343bf66-2e5d-4a3f-a3ab-e4b9fe7ab0c1", "comment": "Malware payload (RedLineStealer)", "value": "812117b53cdcb42545bf29d4de9c250e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413849, "uuid": "3dce35b7-5284-4b29-8db8-b397232d3f0d", "comment": "Malware payload (RedLineStealer)", "value": "db3b6398b31db39a0732329f5c8e8a68e0556339f25d7de1a22bcabe7c02c2a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413849, "uuid": "1b44ab49-b85a-4c56-8fc7-6f1fdb827759", "comment": "Malware payload (RedLineStealer)", "value": "728f45b3b14e0b895356815d4981186401f799ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413849, "uuid": "d934b7aa-f668-4d91-9a9d-909f1cdd5988", "comment": "Malware payload (RedLineStealer)", "value": "ae9b97b95eb2fe630f1bfd744f8c6d1c92eb7e06f29ef0cf570946aa573ea022fbbce0787cbea0273e7841b418029faa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413849, "uuid": "7ca5ebad-ae3e-4bcf-afbe-4ddca659cb56", "value": "T13A04C568364BA57ECA6F883D9C700CD06B7CBC671246A7078D8EF4E4393B7919A151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413849, "uuid": "97284511-0790-4bef-858c-ec9d43b84c86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413849, "uuid": "fbc8746b-bfb0-4126-8904-6d43024fe289", "value": "1536:Ycn6836sv0W7TleNzrHy045BZuQUBRxsrxND8YQPZbu+YYVxX+0GkRs8e8hC:Yc6+so0kZu2rxN38oYrX+v8e8hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413849, "uuid": "bdec81ea-6640-4046-98f4-d044771fd975", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413849, "uuid": "1743f855-1be1-445e-abb2-2fb105f2f714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413849, "uuid": "d18695e8-04d9-4381-aaac-f8b2f5c77372", "value": "812117b53cdcb42545bf29d4de9c250e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970d084c-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687430164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430164, "uuid": "b1d579e7-ce9a-4016-9080-ffdad86567e6", "comment": "Malware payload (RemcosRAT)", "value": "348703f50d978846c48ddcf367d25c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430164, "uuid": "92096684-dc92-45d4-8be8-6a30f9dbf4be", "comment": "Malware payload (RemcosRAT)", "value": "dc091920175bd059d2925977e1806df9930c40db5292a73158bac390fca03d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430164, "uuid": "51ec0fec-d2da-47b9-9ba3-d1bbd2ccb0a2", "comment": "Malware payload (RemcosRAT)", "value": "dd130ed5ec64a9d52123308002883c64b226f680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430164, "uuid": "142dc59f-589c-4bd3-b3b6-49885f3a99f8", "comment": "Malware payload (RemcosRAT)", "value": "567adc1909fbb3f17202b4c14498a606fc13ff2446d6ce05b8d276470e70483c3ee0475172a0c42cf9a1a0f77fb50983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430164, "uuid": "5e4b0df5-8f4a-468d-a7e7-2c6e5a755632", "value": "T1B055F150325D9F61E4BA8BF20960527157F66AABB03EF6094EC3B1EB25B0F118971F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430164, "uuid": "8181f2ca-2979-455b-a87a-4576f99da6d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430164, "uuid": "58921dda-900a-46be-ab66-1bc9ea21d353", "value": "24576:n7MyuyF14+YwJ1KNoNdXJcolU9+qBtby9L7o86E5b0oy:n7MyuyTZ/J1KNoxco2+q/b7joy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430164, "uuid": "3576c2fe-f0c3-472e-b2fe-d94367f715f6", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430164, "uuid": "640ddd06-718c-4a20-8ee2-d16c4ea55bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430164, "uuid": "dd882e33-ec02-4958-8aaf-5dddbc9146b0", "value": "348703f50d978846c48ddcf367d25c6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c564f-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430366, "uuid": "7a7a54c5-d138-451e-8ea9-5fc36813ea59", "comment": "Malware payload", "value": "fd8fbf78e716e60dbab4f44ce710e3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430366, "uuid": "8682fda4-6b96-476b-97a1-6e6021b27f77", "comment": "Malware payload", "value": "dfdc08b6daa2ba630dbe27a80c79fa4f9b36d193633b93274995d1c14e88012d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430366, "uuid": "79605b39-425f-481e-86a3-6cb027eb4aad", "comment": "Malware payload", "value": "ea4e78e533c552bd6aa86a92b1d3e158ee6fa59e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430366, "uuid": "7d4e2788-5ebd-47db-a57d-154aaac54e64", "comment": "Malware payload", "value": "28ad374b02b26bc926e00a447270ee3e1435a49754f7a270b41bb8af43e41a2933ba7dbeb4c97bba008b9bf64173f47c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430366, "uuid": "fe1cb08d-0abb-49a8-a1f0-968959342acc", "value": "T1015612320532BDFE876C389494052B492CED58275349DFACFA4414EF29A1738EA7F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430366, "uuid": "d84e9c8d-58a1-4583-8d37-95f8ebd75341", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka66:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430366, "uuid": "924e70d9-023f-4b1c-8821-cab741e3d334", "value": 6071959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430366, "uuid": "300cde85-467f-4982-b218-2b7c19ac68ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430366, "uuid": "140824e0-83eb-46ff-853e-3764b6b51c35", "value": "fd8fbf78e716e60dbab4f44ce710e3f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cffa83-111e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687453514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453514, "uuid": "91176f15-cccf-4d42-b9bc-54f45ef3d797", "comment": "Malware payload (RedLineStealer)", "value": "26c95cc50290b9cc45ef898a9113f2ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453514, "uuid": "5b549e69-2a69-4862-a53c-4d8f8ce3e69a", "comment": "Malware payload (RedLineStealer)", "value": "e1a040ee080d597e3a383a835a08f42ffc34043164a9cb9a7606f659cbdb3df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453514, "uuid": "a27e85d5-f0c7-4e56-b8e3-8452a2a79ca2", "comment": "Malware payload (RedLineStealer)", "value": "ea967a0c4f78c4caed3707ad3a528ea50e72b958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687453514, "uuid": "05edb8e5-0c85-4aaf-9ba9-1ad4c4df02f8", "comment": "Malware payload (RedLineStealer)", "value": "d6f0863a0f602865a440ac1129ff7968296ceb8b57a6667c7e10fcfded2a316ff57a13b3418ce2c674e743ffdf69061f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453514, "uuid": "14ddf33c-9523-4806-839f-d4ce4106e6e3", "value": "T126E401CA62404873CF77DAB298EFEDD74E7AA021477147C3124C8AF58E161E1921B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453514, "uuid": "16426c28-4df5-4c74-9b91-720a5b3954d2", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453514, "uuid": "c067f2b5-54e2-4c1d-8351-2c1f5615b14a", "value": "12288:dJI10qTey5sUu1yucSHBmz4YQ/IExTvwcyCRoLIT7tGuGeNdNxU57OtQJQmZ:dJI1HTey5sUx/Mmh0uIHXGeNwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687453514, "uuid": "2ea0ebd5-aca5-44fb-9cfc-4b47970b9f57", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687453514, "uuid": "0ddaea9f-f2f0-4ff9-aecd-61ed682b1c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687453514, "uuid": "765c5a63-445b-467e-b666-39f4f7c20914", "value": "26c95cc50290b9cc45ef898a9113f2ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc8500e-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430363, "uuid": "acc97f56-64af-4c77-9c8a-37f975d6db7a", "comment": "Malware payload", "value": "d7c5e13ebfb622e0b87f196b17073e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430363, "uuid": "b44b68b6-4bca-4a3f-a6c7-5b08b15f6741", "comment": "Malware payload", "value": "e2884183ac54282953c5e1f25357e18b521dcb7e7404068a888b903d01cfb0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430363, "uuid": "9d2ff4dc-f586-487b-9718-79f15a925930", "comment": "Malware payload", "value": "7464377acc3db7e2190f790750580d16f6e1c6af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430363, "uuid": "5a4f9100-1164-405f-bb71-d5e451784324", "comment": "Malware payload", "value": "fa0bfec60d1265310ce8779c994e840a8bcd7045b2b7d48d7647f7ba5b15110a31b88fdd5d966d125384bc35642ee16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430363, "uuid": "3fc42bf2-a29f-48c4-9803-c965adfe2acd", "value": "T1015612320532BDFE876C389094052B452CED58275359DFACFA4414EF29A1738EA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430363, "uuid": "13f53bed-5228-44f8-977f-6780aabb3909", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6n:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430363, "uuid": "1e33390a-7aa3-45f6-b1c8-7672abba74f2", "value": 6205011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430363, "uuid": "d5dd0b41-b433-4469-b7cf-78c041db3526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430363, "uuid": "362f059e-925f-4825-9389-02a4fa7250e7", "value": "d7c5e13ebfb622e0b87f196b17073e16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367d74d6-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687419694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419694, "uuid": "84f2c6d9-4a68-4982-a6f3-2da6e4df8aae", "comment": "Malware payload", "value": "0804539baf0ab758158c45e6ffa451b9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419694, "uuid": "e41d741f-6367-4ef6-9692-795480879136", "comment": "Malware payload", "value": "e52461146c72e8f4606a91f3bc12f5523bf9780eb2414c7d096d3be28ab0d87f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419694, "uuid": "92a74ebe-a1f9-4931-b7d9-3251d5de4755", "comment": "Malware payload", "value": "6cd2bba60757e910c14d2983b8d123fbf10ba67e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419694, "uuid": "85e8d8d8-48ef-44b0-9f6f-8d64d2edd57f", "comment": "Malware payload", "value": "5dbe67f08a8da97d2fe3dc0e4978aac5fde71e5e485a1ea7dcdf53ca28a68546e50634fde3ad1aff8d77ef46259d0dec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419694, "uuid": "b98b055c-20c7-460a-ad1d-a445fb27650f", "value": "T16F644B1EF5A7B8BCC6D3E4B4D6BE87B1B934744D05B42A336780EA701252BE45338E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419694, "uuid": "ef5368c7-a617-44b3-9b5e-ff5027df7353", "value": "233f3d50f8ad1fa8b6c33359ee5261c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419694, "uuid": "efd7139b-9760-4bab-a69f-21b4617da735", "value": "6144:rqYMp1whyZAJfpTGfltYyMpfmA3a8yqgf2bMUDe:rqYMp1HaJfpfJmA3rg+bHDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419694, "uuid": "1b9caa5b-7d69-4df3-ab44-4685cf8d0af9", "value": 321544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419694, "uuid": "ee308e1d-3c87-433a-98c4-271039a249a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419694, "uuid": "f07eb077-7210-4acf-ad02-61598d53e215", "value": "0804539baf0ab758158c45e6ffa451b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0b76af-10ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687431676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431676, "uuid": "989f455c-5163-4b69-9532-63215623e778", "comment": "Malware payload", "value": "6838b2667d4bb10d372f71a4de97d376", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431676, "uuid": "24359b08-d43e-4798-a47d-69634b34e9ad", "comment": "Malware payload", "value": "e625a7d416b257ad68afed66b06b73816046fd832cb08625b79425133a09508a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431676, "uuid": "3cd693cb-6e29-49a9-8d14-77f1a46f4bfc", "comment": "Malware payload", "value": "b9e7ceb3c3f1baee1e4c7b0ba6110b94e01966c2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687431676, "uuid": "25022b4d-013d-480f-8da5-fd200d02247b", "comment": "Malware payload", "value": "9aabef411432d4e63674c3c5707c19f714392cc3c8d6266947c26204bb63f90955f1281d8f7bf2384c75a65d524fb814", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431676, "uuid": "394690ee-7ac1-4f70-ab69-e63a2d020a3c", "value": "T1EC758C21B387C532D56D0277E959FE5E1538BE73073141EBB7E83AAE88B08C16375A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431676, "uuid": "4c0d04ce-2bcd-423f-a85c-df7b7ddb6d8c", "value": "24576:1TvxLN94SlEKSDB8pDESD30TidMgWZ5H1WCVuyi4QX851wfM/3F:1TfqZDB8pDESD30TimgS5VWAa851wfMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687431676, "uuid": "6ebf610a-c439-4086-8341-41e54997630f", "value": 1551360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687431676, "uuid": "5043dade-4f2b-4ab8-82a3-d89a0a03e31d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687431676, "uuid": "6866f096-c6f8-4f11-b30b-079722606240", "value": "GoogleAI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc6aa28-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419035, "uuid": "6539909e-32e5-42f5-b35c-5a45c9ab798a", "comment": "Malware payload (AgentTesla)", "value": "1b5f7b30f72272fd66aa76d8f5297097", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419035, "uuid": "9e428560-c58c-4ab8-b98c-7592f5693371", "comment": "Malware payload (AgentTesla)", "value": "e680198a17b3fd32634e3cbce9e3dfdebd65291c4af981dc0afa93805825a8e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419035, "uuid": "398e3244-a256-4279-b909-280240c2470f", "comment": "Malware payload (AgentTesla)", "value": "e163a0575571302cb3eee46c8441e94792f7fed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419035, "uuid": "241dd8ca-fcb7-4331-a3ca-e089404a07a7", "comment": "Malware payload (AgentTesla)", "value": "30202f99c73a9d6db9b681f0ea02cfc739457383d777066ccbf2333bdb4e218ea85f37b6514dda13d07603e28b6655f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419035, "uuid": "0ca4e926-5151-4a15-a509-afa61ee37ebd", "value": "T1A412A0CC57E3555EFAD325AA5A7E104A06C0D5B4290C2F4FCB587E6598E20F84F5D0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419035, "uuid": "3ca2d44a-6d54-404a-9501-104803b933f8", "value": "192:40KAJo2irc43ffyMzG0nprJh69JY+tlKaI4LpCUUI8HIYmdOkbGES:GAJo2+B3ffy0rp29jn5LpDUlHIYmdOd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419035, "uuid": "2e036737-009f-4ff6-9e21-637507461b93", "value": 9456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419035, "uuid": "a5e331ae-44d7-49d9-9ea2-1d68c46d5b03", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419035, "uuid": "3d28c749-9757-475d-9d18-e7c7e93ae67c", "value": "P.O _192883.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc78317-10e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687426501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426501, "uuid": "bdc49b7d-df91-45bb-bf47-28ff9c902899", "comment": "Malware payload", "value": "eb017b0a1d2d555a754e354f03888451", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426501, "uuid": "1f7e7a00-89c9-42d0-9b77-cb8b22afa5d2", "comment": "Malware payload", "value": "e84d133ad68307d39f37bdbce7fd030527f30d2e5707fe7d8b29ee2bee43d4b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426501, "uuid": "97b0c168-f509-4280-8f95-de4da279cf23", "comment": "Malware payload", "value": "a753a628fd32544e2de009c5f8890c7b534c9014", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687426501, "uuid": "4dd17e7e-2d49-4df0-9ed6-822c3f79d763", "comment": "Malware payload", "value": "1c39153edca0dad99547336120fb1278816b4add6d37c444e87f6a72533817e9c908d5f798efe6f0ccee36c830802ca2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426501, "uuid": "e75d619b-33e5-4e1f-81fd-0b469b957d0f", "value": "T1AA447C21B4C0C036D67A28324664C5B15EBD78301AE1DACFABD90D7A8F357D29724B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426501, "uuid": "b3cc4ab3-d536-45ce-b0f8-647ed9d7bc08", "value": "21f260a50c6a786310e6826ca41e48ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426501, "uuid": "6d6ab967-c2ec-4764-998d-015b7ac856a9", "value": "6144:HX8KTEWoGb3FdzFVUbEzTwH12vtMlSVcG9FwPZstuGSZOTAOaOc:38moGb3FdzFVUbKTwHkFMlSVWP4uGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687426501, "uuid": "b436f375-72d9-434e-a261-1b9dea41fce1", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687426501, "uuid": "7affaeff-4a72-49d8-8e9b-323afcb3badd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687426501, "uuid": "ba114d2f-e292-4989-af7e-0c8097a46ad2", "value": "SecuriteInfo.com.Variant.Lazy.354397.4302.29069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f16e695-1140-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687467812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467812, "uuid": "ed280119-4870-4911-9421-eed9dae4dff5", "comment": "Malware payload", "value": "29b0757c702ac33a644bdbffc76c40b9", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467812, "uuid": "5ad13dc2-29bf-453c-9b20-9635a84d1c29", "comment": "Malware payload", "value": "e84ffb3ea66bdc480ba43b0fb5f3e3ee98aaaafde86e6fe5d9b67f67be279b97", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467812, "uuid": "da90c84f-e00f-4032-ae5a-45ca19856011", "comment": "Malware payload", "value": "065387cb12654348590d5cb993a4c19d682925be", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687467812, "uuid": "8240ae64-446b-4ac6-b993-50ff9e7de4bc", "comment": "Malware payload", "value": "7147255f94cad9e10e5b0cac37fc46eaec15e7b587b26f7e40dddce0dbc570c1c393f3b21145bcfadcadaa9a78925f7e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467812, "uuid": "e359920c-4a2e-4c05-9f43-e9769d96542c", "value": "T1E9D34AAC988CD588C979EBF2F752F4CAA14D733B4E8A94B671AF0FD61243C15E943801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467812, "uuid": "73ff56ac-2d6b-415b-84b2-a96d467ab15a", "value": "1536:9xUcsSL8csOUpcssqcs+c9csmcsHFb2Aa24ERLYm3RT3MSLVMXLHtSR1GWBZD7p8:RvsGGYLrMeVoHtSXGml6niAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687467812, "uuid": "91b8a489-4e56-4ab1-a5d6-af3fb865e94e", "value": 131702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687467812, "uuid": "0e5a9440-2b57-4b14-8906-8f62edd51056", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687467812, "uuid": "780a7b8f-6285-44ef-b94a-772b6670ab07", "value": "qbot4.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e17143d-112b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687458872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458872, "uuid": "15d4b1e4-264a-4be2-ac15-0b22e16b4156", "comment": "Malware payload", "value": "86113f7629e68d99871c23161184a003", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458872, "uuid": "3dedcd22-c256-410a-836a-eb36aff36e17", "comment": "Malware payload", "value": "e8d3340c209b3890f87c4fc1e4cec0ed7ac576a39c6e4eacd18847fb27cb709e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458872, "uuid": "be2c27a5-61bc-44fa-904e-1d5c7b0a1d15", "comment": "Malware payload", "value": "06ec9b72f893f13bde26e9af86468faeecf7df33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687458872, "uuid": "bbe33591-2f36-480c-b381-7e37d6a26f48", "comment": "Malware payload", "value": "1b9c015441f42a27a55c946287066c81376fe98225e5f594e5c98e489e50a98c5d1161b6bd173aaa7f53efa1397dfde6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458872, "uuid": "a45fe634-db6d-4e01-ad9b-7fa461e6c4fc", "value": "T1FCF4BE31F680A037D2B315B98E69D36A143DBB301B2868C7B7D46E7C1D382D25A7536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458872, "uuid": "dca9b436-0dfe-452e-b49a-ffee30d7d185", "value": "2f727a975c44a2925ace416e4a5ad2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458872, "uuid": "9dad69cf-df93-4c40-947c-eaffa2c8d1a2", "value": "24576:OeNt8okNsryfLpbnmjdP/ZW5AvZEj5J5:JNXgc6lG9U5J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687458872, "uuid": "ec59bf57-daa4-4e97-a00d-3dd853842a8f", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687458872, "uuid": "e794af97-e2c7-42d5-aa48-3e5e5e0ea70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687458872, "uuid": "a6c82725-0676-49fd-a132-434a2fd7c15c", "value": "86113f7629e68d99871c23161184a003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e0bb5b-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422242, "uuid": "8662d276-04d3-4eaf-a9a2-0af1fa0e30dd", "comment": "Malware payload (Mirai)", "value": "639e0bbdbece4dae2f50f002817b9c60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422242, "uuid": "2381702b-4d34-4b12-a63a-e5e997165c92", "comment": "Malware payload (Mirai)", "value": "e909c3f2ac83755017644afec2ceb2436fc8da6a68aeadc21d1a2b9395195d28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422242, "uuid": "17236f1a-b250-4fc3-8114-822658ee5712", "comment": "Malware payload (Mirai)", "value": "8c5cd854f88c92557b55b11de979e0dcb5b0e535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422242, "uuid": "3225477d-214e-46d6-ae04-fe2f33e4861c", "comment": "Malware payload (Mirai)", "value": "24ec7d5b9524d3ab5b0af9158820cef31504be418bc60aa8dbb37545c399d68f0b2f5cd8c662391465ad20cd52e928a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422242, "uuid": "96c9f2e0-9355-499f-97e6-c80dfb9f1806", "value": "T14FE33B06B70C0D47D2632EF43A3F27E193EFAA8121E4FA44651FAB4A9271D321546EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422242, "uuid": "e09d715f-a0d4-49a3-a775-2e269bfe0976", "value": "1536:fDavwdjIGCOsPlwxprvy0aiYkAbqQ5rUAOAMFu+X0vAPWNIf4cL2H96X/:SRPlwx1KAy/UUM9JPxh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422242, "uuid": "6f9637ec-e770-4096-93be-f5f08fd3d005", "value": 145924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422242, "uuid": "3b474dc5-2db4-45ed-b6fa-5ea3dfa2e34f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422242, "uuid": "69250761-5493-4e57-80b8-a9a8411276cb", "value": "639e0bbdbece4dae2f50f002817b9c60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8fa3c5-1095-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687394660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394660, "uuid": "0e36deb4-2ea7-48a8-a204-2c6fa314659a", "comment": "Malware payload (Amadey)", "value": "f00264bb33aeee7c357841eaf5092949", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394660, "uuid": "bbab1ec4-4456-4df3-9d16-37fa578bf959", "comment": "Malware payload (Amadey)", "value": "e9f3ec46387776b505948a3e6dc2f327edb466fec966a43124f950d34d572b58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394660, "uuid": "595f10cd-8e4e-4c60-8b9e-0a3862cc64e6", "comment": "Malware payload (Amadey)", "value": "49bce19ccfc753fd645987d5254d55fb3fd81998", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687394660, "uuid": "49615ff2-3595-4856-aff7-a1d8bbd57335", "comment": "Malware payload (Amadey)", "value": "8d1af2f80130c20a3f5c6d269ccac8914ca4936990ce90e2299cb4876edcccfe1b8fd863a125b42e1d00b223f859e59e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394660, "uuid": "f4136730-2498-42a0-a018-d566ef6d5942", "value": "T1F5E4E102B6C0C032E877357609E0DF78893A781107655AEBDBD80EAE4F315E5ABF619D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394660, "uuid": "b03fc2ac-f9f1-4734-9ac9-ccf2c22da3d2", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394660, "uuid": "9b541d80-1575-4e27-b7df-f1f629f85ed7", "value": "12288:46ztKeJjWeeIOF6beWJSn/oN24/P2Kuk2EKoxx4nfk8AfJZrU:1ktee3n/oU4d2EdXMM8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687394660, "uuid": "4320b9d0-d33e-4a87-8279-66d878340933", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687394660, "uuid": "f3d3675b-5146-4730-b30a-8368addc8e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687394660, "uuid": "f22c9106-3a64-455e-8a65-65288d29f484", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6a37d9-1106-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687442845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442845, "uuid": "011a4c2d-0b26-4e4c-addd-5e72f1fb4de4", "comment": "Malware payload (RedLineStealer)", "value": "b435f4fa4b02f5e0686c0a82b0033354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442845, "uuid": "99367336-bab3-4814-b4d8-8976041af2ab", "comment": "Malware payload (RedLineStealer)", "value": "ea52680e80eb9e200c61abd755587ec2fd5ed477e8093dbcd8d75200be09ac0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442845, "uuid": "b4275077-98a5-4147-ad47-3555e885e960", "comment": "Malware payload (RedLineStealer)", "value": "472ea52b01e0ba97f46cf97521f32a563395a744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687442845, "uuid": "f83aa6e9-2010-47de-9811-7333f6484c05", "comment": "Malware payload (RedLineStealer)", "value": "b85e70776761e033afebccbead9838ae6e9e7ffb3ef76983e104f85dd38719708ab010aba12e2f9ed08e1decbc5fe677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442845, "uuid": "00eaa715-52e6-4969-b75c-437ac57c232f", "value": "T13D845CC17BC1407FD962107B05D38EAC5328F82517663BE7D7808B2A8B5C9D89BF694D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442845, "uuid": "c6e012a4-6611-480b-ade2-4bf1550f0d1a", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442845, "uuid": "da027def-0e3b-4dbe-9de6-0274d4248885", "value": "12288:wztKe0jWeeIO5Ghgmc0D57ABb0wTH1b/rbOxzrnb2OA8efJUZmM:wkeeex3A6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687442845, "uuid": "aa845175-bf8f-47a3-ba24-1e1391c39232", "value": 397827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687442845, "uuid": "a08b58aa-ef37-4c2d-a503-30f985a3c6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687442845, "uuid": "23c3d1ab-ef6e-4ae9-85a6-be910acf9e71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e742f39-10e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430553, "uuid": "3b5050ff-04fe-4c6a-9779-f9939d37c3cc", "comment": "Malware payload", "value": "2dcddc030afc4c9427d7cbf35355bac9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430553, "uuid": "e6456f83-4667-4561-9bbe-5607e0810547", "comment": "Malware payload", "value": "eb32cdfa3443dc553b69a3c436c9710e3545aab930fd9c04355ce7736dd89786", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430553, "uuid": "1c999c59-439a-49ef-ac9d-bcdfefe9c955", "comment": "Malware payload", "value": "3393e365378152e659c6ed86e383b9de126239b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430553, "uuid": "920d8729-5e97-44f3-b80e-0cb512e0b3d6", "comment": "Malware payload", "value": "e58128f9fd8e23b0137e4ced93cc5bb4444825676fa0ba53e15872355e8469c0ecda4f54f667856e5f44c96baf569852", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430553, "uuid": "8fc67f8d-1fbd-49af-ba5e-c97bb9bb8525", "value": "T17977337CD0A1239B1D7B5831B5F1A0EBC86681F18A535E2792BDA633DBCB3D1917808D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430553, "uuid": "c24a0fb3-4316-484c-9a92-8c6ed74db8a6", "value": "786432:vfTPmBTW7E0YaoUO/pmrW9twEvaWH36l96t+eOhWYPOzh:7CTqzYxQKh36mZYch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430553, "uuid": "c54b90f6-032d-4784-a41e-adfa1bcde748", "value": 33305437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430553, "uuid": "e3cc8187-10a1-4476-a439-0b73696f9f63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430553, "uuid": "19a13b9e-57a1-44b4-89d6-b97023fbc846", "value": "2dcddc030afc4c9427d7cbf35355bac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c5b30a-1123-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687455318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455318, "uuid": "39e71c46-1df3-4b5c-84bb-4ff04d8d351a", "comment": "Malware payload (RedLineStealer)", "value": "c9fb090adb8289f36e327885b00497ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455318, "uuid": "f87d769b-4a7a-440e-a2a7-9fac93d2b804", "comment": "Malware payload (RedLineStealer)", "value": "eb85ef4a0eb3677f91b8f85f3367a9fbf2c16b179170d7cf99565ee314944107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455318, "uuid": "956c54af-8ac6-49ce-91af-3322508e57fd", "comment": "Malware payload (RedLineStealer)", "value": "b667c91d123124210f71c4c394e9864b388b6d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687455318, "uuid": "544a6152-0f00-4d1c-92de-1677774216b2", "comment": "Malware payload (RedLineStealer)", "value": "9a7d49f0578c909989273bcfde665f067b57dda9c99fd01c5b35c89c92052c96efa326a6ae116e53ee44102e988eed2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455318, "uuid": "48bd813d-3a36-42b8-b3de-e119bf81276e", "value": "T11BB4F1CA35404573DF33DDF2D8EFA9D64E7A71210BB64AC3120C49FA8E056D0A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455318, "uuid": "e99c1a85-3401-49e2-8a1e-5affb0bd0afd", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455318, "uuid": "5f018bef-4331-45bb-9141-7f88f8dbca67", "value": "6144:5CtSKGvhZJuqwePpsyJfsPX5a+XejrXqLaUzVrf/+YYb+IF/k5Mba1cKQJQmZ:YtS5hTey5sgeIq/+YvAaWKQJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687455318, "uuid": "6e88c830-bb5f-4bbf-8d06-41b8d6eeac3a", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687455318, "uuid": "4b4153ef-ca3c-4cb1-8be1-764c9959c509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687455318, "uuid": "4370f556-db13-4d9e-840a-32f1f1caa7fe", "value": "eb85ef4a0eb3677f91b8f85f3367a9fbf2c16b179170d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d47467-10ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687417146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687417146, "uuid": "17715661-2db1-406b-a9db-2004aeb2c766", "comment": "Malware payload (AgentTesla)", "value": "2d2c538add83ca99cce2381c040721a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687417146, "uuid": "8da13721-8cd9-4040-853b-2caf8e8742d5", "comment": "Malware payload (AgentTesla)", "value": "ebb41097e34a0dc25cef50df54f13c25d160ceb7240b4c3a5e33d61cf52e4adf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687417146, "uuid": "3ef718e5-efdd-4c0d-bb0b-198e31d63034", "comment": "Malware payload (AgentTesla)", "value": "7f247f4e83555baa10c0dd4afaea672d87150b0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687417146, "uuid": "60715b1c-43e1-43df-a877-fd8072560668", "comment": "Malware payload (AgentTesla)", "value": "b8cab2ba77ba72501030a7f6cab025eb59e473bc18b867e4bd26ffb424eebcfe1dd2e2ee63157a29a85827ad3cd64c15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687417146, "uuid": "8db3cb69-c335-4ec0-8744-39e00d6970e4", "value": "T17312B0CC96E3955EFAD326AA593E604E05C0D5B0190C2F4FDB587EA598A20FC4F1A0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687417146, "uuid": "e381b6ba-67b4-42aa-bf7d-75b4b20be347", "value": "192:k0KAJo2irc43ffyMzG0nprJh69JY+tlKaI4LpCUUI8HIYmdOkbGg:CAJo2+B3ffy0rp29jn5LpDUlHIYmdOdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687417146, "uuid": "31bcad90-c25f-4e17-bbce-2d6208878523", "value": 9480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687417146, "uuid": "76f31c4f-f156-49e3-9699-4ab3661d23f5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687417146, "uuid": "4ad05921-51ac-4947-a188-38d10f1f38a2", "value": "WORLDPACK (PO 20225181).PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad8c553-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687420614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420614, "uuid": "b93e7900-8315-4c3b-8627-f2b1ceaec90d", "comment": "Malware payload", "value": "65d224cbd3a05f26b7fd79ad9fa6d0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420614, "uuid": "1aacd328-95ba-4ef2-b482-4ddcaf5a03d0", "comment": "Malware payload", "value": "ee76990b8b47853bc861ff203b034e9a9f1e5832e031b3ec81912a6a5e66d2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420614, "uuid": "a555b2e4-3c34-40de-8282-a299a92cf527", "comment": "Malware payload", "value": "a5dbe8cce915bc133cdb7962ce76d84a5198b68e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420614, "uuid": "c81032d0-0b57-4782-bf12-b02cf1ec2a6d", "comment": "Malware payload", "value": "51dbf89a2cda2096626d53856fee9bab77f160cc92e115b33a1ae072f9860fa3f8eddada5cb4643c5370db7ef5a07446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420614, "uuid": "c9cf9b2a-a6b2-4519-a9ee-e1f24fd8cafa", "value": "T1125612320532BDFE876C389494052B452CED5C235359DFACFA4414EF29A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420614, "uuid": "a4a5ceda-e165-456a-aef2-c324a80066bc", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6C:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420614, "uuid": "f9d55af9-dfe0-4b65-8393-2c6b536af803", "value": 6376867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420614, "uuid": "110eb548-1fad-4b2c-9af0-01ab73d4f8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420614, "uuid": "da13adc9-e381-41c6-9aca-19338d451ec8", "value": "65d224cbd3a05f26b7fd79ad9fa6d0e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4111fbc2-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459226, "uuid": "1cdcbb83-4731-48fd-8767-7995fd726337", "comment": "Malware payload (RedLineStealer)", "value": "837bca31359b6a4c73cfff8eb3944b29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459226, "uuid": "4884b222-8798-496c-bc90-ba0a5cb9f339", "comment": "Malware payload (RedLineStealer)", "value": "eed2efb4c4e0b1f65fb0930845b30ddf84ee71b8ea7a1efdbb80d4ac342bb9ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459226, "uuid": "4602fe1e-24c5-4430-b673-dbbc17ee8de2", "comment": "Malware payload (RedLineStealer)", "value": "2d0122f945d47654d6edbe2bb9a4142d8771d272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459226, "uuid": "144a5ef8-5223-436b-8265-456af0ee18cb", "comment": "Malware payload (RedLineStealer)", "value": "a8e3c7444adff395490e2a385e03cb616187dd74c2605dc682c6ce10d29e3faa3f41a2d47a9c31068cfe4b2909c15fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459226, "uuid": "ae539ef2-7ab3-440f-9db1-7d453f3e0ecd", "value": "T17D443BFB52D1D460DD0FA4B02C6AE1BDEE31B461DEA284CA1DBA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459226, "uuid": "fcba9ef0-3201-4632-a23a-6bf3f10b015b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459226, "uuid": "bc319b4c-2d9f-4046-a967-35400df127da", "value": "6144:Nq3wnigt0poiRG/XvLNUgYhuE22RQJQmb:Nq3hgtAoiRG/fSv5QJQmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459226, "uuid": "edb65f1e-30be-46fb-a41e-c76e5d355bc2", "value": 276801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459226, "uuid": "d3bc4949-a664-4fad-901a-109e0e8767e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459226, "uuid": "ea8a9387-5a77-4b20-afc1-b44427d47ce3", "value": "837bca31359b6a4c73cfff8eb3944b29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e548b642-10e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687427719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427719, "uuid": "7c0d5b0d-5f91-450d-ab7f-6ea2eef8582b", "comment": "Malware payload (RedLineStealer)", "value": "b4a368096b4e68c5534edcef7af02c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427719, "uuid": "a03dbfbc-e164-480f-ac3c-145596743313", "comment": "Malware payload (RedLineStealer)", "value": "f07c60c0d59d24a06570825f8de8f5f7f306fb8477119025140e52a86741217c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427719, "uuid": "8d43d8dc-f727-4ff9-b9b7-70683522f4a7", "comment": "Malware payload (RedLineStealer)", "value": "0bce087b893afc05188ba1dafb5fd1843657b9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687427719, "uuid": "4e8761c3-52fb-4e9c-aac2-d72c0d5dc247", "comment": "Malware payload (RedLineStealer)", "value": "d7d41abcd6fa6b450631820aa16d1b2c2d735aa9b5fa59188a513962bf939c46e7823063a9d421112a24586c6d8296e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427719, "uuid": "2dbbf7d9-bb68-4a03-95a5-0cd91533c1a3", "value": "T156845BC17BC180BED571107A05A38EAC5328F82517267BDBD780872E8B5C9D89FFA94D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427719, "uuid": "3f326038-272f-4500-aa50-e9e25532a57e", "value": "5546d5d08c85c9bfc72c6e57a660ba00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427719, "uuid": "6fb95124-cddd-4a1a-86d1-9de0df77f5f9", "value": "12288:0ztKe5jWeeIOZ04wP+iHKs83JCG7eoMwbZu/89/hHp5CZk3pCGio:0k9ee1JuUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687427719, "uuid": "14861ccb-9197-4c04-bb50-e3219f58a637", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687427719, "uuid": "c6c7d612-1371-4e6c-b5f2-08686854a0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687427719, "uuid": "ba4b41d9-aede-4ce0-bed2-3a6737346eed", "value": "f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f007a8e0-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422583, "uuid": "ecbdece8-80d6-412c-a86b-913874c96773", "comment": "Malware payload (Mirai)", "value": "441e6c9071a4099c1cd1c5b4920ec224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422583, "uuid": "52a60726-08aa-4e2c-bda4-dc3d3c5e8dbb", "comment": "Malware payload (Mirai)", "value": "f1a6cbc648829c2f4dce683f4e6bfd20c1844ffa8bb1267041f23b9ceb34866e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422583, "uuid": "fb77789d-7ee6-4dcb-9e1d-a3642229d5df", "comment": "Malware payload (Mirai)", "value": "56a8ddc94f91fa2d5b591ae6bef476df8a2c0ebc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422583, "uuid": "a1d218ea-48ee-4498-a77f-7d8ae8c874f2", "comment": "Malware payload (Mirai)", "value": "706c9156feefd29a5fbf3cc0e2075ce668e08da2f6e616ca9fa7f4d779c4c8b070bd64f95cdcd0868517cebb76c7a864", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422583, "uuid": "82596487-3e21-4c1b-9453-255508e0e93d", "value": "T1FE2308817891AA39C3D063BBEE6F018D3355A798D1DB3397C8241B947ACB90F0D57B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422583, "uuid": "5fedb19b-7f5d-4ae0-9324-7ffd581c6950", "value": "768:WV9JdEjLgSXoEai9bFvFbZB7QQEPJddnj0eCSGFu+JNrymyN/jhLwCVy/Jx+5H89:aJ2/gHm9bJ4ddo9JNrynNbNeZWm22W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422583, "uuid": "57fedd80-c63c-4b7e-bfd0-ad5e014c344e", "value": 48176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422583, "uuid": "b85f8845-b4dc-4404-b55b-d90350033a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422583, "uuid": "3d50a7e8-baba-4cd7-aa06-c16d1d59999b", "value": "441e6c9071a4099c1cd1c5b4920ec224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8face6b0-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687418985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418985, "uuid": "b803608f-a903-4b86-b88b-381776006063", "comment": "Malware payload (GCleaner)", "value": "874092febe9f443741b9964ab019e8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418985, "uuid": "9b32d4e8-0fae-4cb7-8269-8bc34114b35f", "comment": "Malware payload (GCleaner)", "value": "f29aa4270d0bfc8d8e3781500ade8881c84b47e0409271cc7e7f3130d71f5dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418985, "uuid": "2c2ee19e-0669-4a19-9e20-e5215ac1cadb", "comment": "Malware payload (GCleaner)", "value": "b485715111a0633c09b07a9bb42afbc293209a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418985, "uuid": "5b14f806-8bfc-426e-bcb5-7f7c65ccfac7", "comment": "Malware payload (GCleaner)", "value": "cb91ed76175560cc0a64bf254c780cd1321d07b8c7b858e45a668e919ccf5d643f3865e45bc13b5966f58ecaed5fb857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418985, "uuid": "9060887d-aece-41dc-b06c-a3219cf4ac0d", "value": "T1E584088382E13D54F9279B73AF2FC6E8764EF2508F497B6911199A2F04B11B2C1B3B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418985, "uuid": "f98bcaa4-4583-4f3b-b7a1-84ca570bbabf", "value": "b1a5bdbc77a4868d9509a53571fbe8fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418985, "uuid": "81c7c884-33d6-4cf9-bea4-176e2cba068b", "value": "6144:CZbIwQuz8J+mC2ICH9n8pEJYbKgs8LRpg1f2NhgJk:8I/G8UmC7CHt8+JvuRC1ONeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418985, "uuid": "3553c0bc-0246-4074-80ca-8688b948d8ff", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418985, "uuid": "58d181ca-2c1e-4b4f-8fc6-3ba2327c6285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418985, "uuid": "613b2b1b-16ae-4361-be4b-9270d4db7c08", "value": "874092febe9f443741b9964ab019e8c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278a83e1-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687456606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456606, "uuid": "601ab405-7a5a-476b-862c-82c552197c7b", "comment": "Malware payload (GCleaner)", "value": "7b4bd24d3681cbc12547b533087782b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456606, "uuid": "00482cd7-7ffe-49f8-97d9-7a48302e58e0", "comment": "Malware payload (GCleaner)", "value": "f3647bf12ed870c1d5380c96b6109983634a450599713784ea514e8287ee3a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456606, "uuid": "0599f681-52cd-46fb-ac78-b294a45f966a", "comment": "Malware payload (GCleaner)", "value": "25ce814f86a3e1403a5b5e437bfb5b003f2827f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456606, "uuid": "3f30c1ad-d788-4d22-8d27-6c8007263700", "comment": "Malware payload (GCleaner)", "value": "9c7c3b318702ddb8e8190d01c3b557cfb4db5d2bd122017b75608a2eb6a83afa1d1ae245cb3acac696009abca6a00489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456606, "uuid": "16667ba0-7519-4d1a-acbf-2c168768777e", "value": "T148948D03B2D16C61E525DA728E2ECBF8661FF1604F1A7B9F66988A7B09701F2D133315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456606, "uuid": "ed1e3dc7-f29a-4cfa-9099-136b97de3a83", "value": "e53988d785c3385128434cebf2176c57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456606, "uuid": "13144c8c-1de0-4576-a911-fe137492fa19", "value": "6144:yPINoqXnXbCaWv/HTFyJSPPa8GCFGn3SaihUdfSHDVf8cjC9mUWplm:PNoqXnrCPFWSCbnAqfSHxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456606, "uuid": "ad69f076-f245-400a-9898-73cd8d6e9662", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456606, "uuid": "9fe0a872-2779-4e94-a7ea-1dbf18228753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456606, "uuid": "16f0bda5-7f49-474e-bf2c-9e7adee85ab6", "value": "7b4bd24d3681cbc12547b533087782b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfb968b-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687413236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413236, "uuid": "da45b077-6332-43b4-b5a3-4ad9759c7da2", "comment": "Malware payload (SnakeKeylogger)", "value": "79d31bb94bf5c6d03038d10b62b20c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413236, "uuid": "8944928a-4481-47fa-828a-0a8214f075a0", "comment": "Malware payload (SnakeKeylogger)", "value": "f36aec59cf40c76d86dd5817b15d2b1fca004c06254858f0b17a28c7bce3c852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413236, "uuid": "085a37d6-5767-4c09-9862-1714dcdb10f6", "comment": "Malware payload (SnakeKeylogger)", "value": "1e980c94d9357d55128a06697459d423f8f767d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413236, "uuid": "2d319748-e6b2-4fad-8ada-0a11196f7383", "comment": "Malware payload (SnakeKeylogger)", "value": "42fae7f0769df90539a2ce19812f4fc31aa9632c07a0a38f6fbc0a92af25bb4b7f8792c79e9be0c2182688886cedcdad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413236, "uuid": "26d49d94-c57b-484b-a84c-746dc39ffc19", "value": "T12DD41284337E9713D5B393FA9150103253FB6D99B051E26D8ED7B0E91A21B0B43A2EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413236, "uuid": "07675636-7634-408f-8c93-0d7277fc97ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413236, "uuid": "96e8379b-059a-45d9-8a5c-b567a7a7aa60", "value": "12288:kkapdvDhH62MmgPFZFKT+LzXSubT7rW5cClasQ4EZaC+YxphJItSAFia:CdvDcAwfFoSzXSO7rWNlauU59JItSgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413236, "uuid": "45524356-80c6-4335-b001-0df3098d5013", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413236, "uuid": "7753990a-d2d8-47fd-84b9-64153b85a794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413236, "uuid": "03c71542-1315-4afd-9585-f68dc8d5b934", "value": "4520007393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc69819-10c9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687416623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416623, "uuid": "45280ae0-6c67-4dec-914e-71bf0a6f09ad", "comment": "Malware payload (AgentTesla)", "value": "73e6ba88fb53f6a2fffc6c5e5a8ee2fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416623, "uuid": "1db49fa6-e970-4108-8b79-e9464d8c9675", "comment": "Malware payload (AgentTesla)", "value": "f37444849fb5d3f512aa399c0ccc8bbac2dac9a725c7965f445cc472f64a727e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416623, "uuid": "29b011ea-9bbf-4233-bc6c-a61606dc5116", "comment": "Malware payload (AgentTesla)", "value": "3766e0b24adda22e41d0b8abcc796e2204791db5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416623, "uuid": "438c3b01-98b4-45e6-ba85-007ed91956d3", "comment": "Malware payload (AgentTesla)", "value": "ca8e10983f89d21b0f7c8a31ebdfd821360f8ea2aebbb1498483b609d2e6764b9162db7eb80929cabc13324e91f95a09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416623, "uuid": "72bd6f3f-2df4-4e34-8a0c-652b9d122a90", "value": "T146E41288A27E8762C5F383F5A6B15630837B3C6E7562D75D4EC731E92A5AF080600DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416623, "uuid": "2ac0b12a-2057-4225-b6ce-ec3fd2134a4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416623, "uuid": "8284666a-37e3-4c39-8b26-c746074db47a", "value": "12288:8IhpdvDhH62MmgPF0HswcqosXzokpGEbB4eybdKb9ucfLStI15pK2i+BJb:xdvDcAwtqosXzo1EbB43dG9fDpK2bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416623, "uuid": "9c2aa6f2-bc99-4504-afbb-11c95db7bce0", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416623, "uuid": "c499aa0d-c581-49bc-b050-954ccf52328b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416623, "uuid": "78d3827c-9184-4792-a43c-5c6032bc11a2", "value": "PO-230102.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e813982-1142-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687468617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468617, "uuid": "8b53a308-9574-4bc8-b48a-a938183f4693", "comment": "Malware payload", "value": "78e010c77733672c24c9bf7de6299808", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468617, "uuid": "b3050ac3-d482-46d6-b289-185b2632cf02", "comment": "Malware payload", "value": "f4d1c7a0d27efb208334838e89759e5009b83720dee66a8b75c5669208023203", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468617, "uuid": "4770a290-c403-4ae0-81c5-ab09362874d9", "comment": "Malware payload", "value": "35714875123da41918f245966784584d87049599", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687468617, "uuid": "27899bae-9f4d-48b4-b800-273337510746", "comment": "Malware payload", "value": "a0d8300ea3f7494a500a7f1716024c086d2642f78be968de59f9332e9ddeb45eb17adea3e7066755ae3fdf59dfc84808", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468617, "uuid": "514d84af-38ab-44d8-ae37-88ddb432cca2", "value": "T1BE74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468617, "uuid": "f3fd4ed5-5418-4019-99d6-5f8acad4813b", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593C:fIS1xbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687468617, "uuid": "b4bceaba-163a-4370-8ecd-2668d26511d0", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687468617, "uuid": "f92586d8-10c0-49fb-96e8-fad6a4374d9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687468617, "uuid": "6aaf6858-430f-459f-b8ab-abb89488d275", "value": "1_qbot_downloader.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dbb9c8-10c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687414106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414106, "uuid": "9adbbd9b-77d4-494c-af31-292c1275e888", "comment": "Malware payload (AgentTesla)", "value": "2b25e3b95ad06a28672dc85c461d0c3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414106, "uuid": "2f8d3cb7-f727-4e78-89c6-22effaa7e8a4", "comment": "Malware payload (AgentTesla)", "value": "f5b6dc23ae9c791a713904688afd9cbddb26075b14a5a3c1a0cf1321de971e71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414106, "uuid": "8c48d0d4-574d-4a81-ae07-ced9236b91ba", "comment": "Malware payload (AgentTesla)", "value": "2276cfc3a4ed0608a6db3162e5cdf3426e46fdf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687414106, "uuid": "97c5327b-719d-436b-b60b-604fc599fed3", "comment": "Malware payload (AgentTesla)", "value": "e2fba32aacb10c82cff5ed23305343f2af475ca00e81bd17660c3d3661c5e6d7e2f9be8e805f4398028564aad78e006f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414106, "uuid": "c865e469-ff2b-457e-a282-a27dc3df65ed", "value": "T139E4C4102DDFA4481337AE97A3DC39AE5FAF75AA513A81593019034B0BC7D81BE90F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414106, "uuid": "7a7c09ce-70f7-4dfe-8977-e4aae0257fad", "value": "3072:9gYcpl+og0S7UM3MPMOUcMBEoQ0c4IZqem:UM3MPMOUHQ0c4IZqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687414106, "uuid": "6c291cda-8e0b-44c5-bd1c-9cae0abdf70e", "value": 705646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687414106, "uuid": "8cca9b08-3fcd-4fa9-a087-6759ebcbef59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687414106, "uuid": "2ee92a50-387d-4ba3-afe4-f5c3f305ff7a", "value": "Factura comercial-004537.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009bb52c-10d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687422181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422181, "uuid": "83af07bf-32a3-472d-9515-33dd43d769a8", "comment": "Malware payload (Mirai)", "value": "c4a2b37787b43f7a78f027ea52e09ce5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422181, "uuid": "5c8560c9-c85a-4714-8583-28feda769228", "comment": "Malware payload (Mirai)", "value": "f5e819a249ba1a649bdf9ea0799e312ea9f72505e36c903c86e901d0c64f5967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422181, "uuid": "28cd4875-56dd-451e-ae59-6afdfc65fe1b", "comment": "Malware payload (Mirai)", "value": "4538bb10fb951d93c86eb8ad1e7ae61f0b567a3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687422181, "uuid": "84c5db9e-46db-42aa-b507-1cf74f09f90c", "comment": "Malware payload (Mirai)", "value": "d6926dd7957205f64d108b820c65bf002b1b200fa5dd11d32763797e5dfe35c79c85b283150e447a899c36cc944fd846", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422181, "uuid": "b1117bac-c2dd-491b-bad7-9191d48a9126", "value": "T10AE30945FC519B27C6C612BBFB5E428C372A17A8D2EE72039D255F20378B95B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422181, "uuid": "7b87ad2c-afbc-4bc7-9980-1bb3565b274c", "value": "3072:Rsr/UOZcypaFfO4rqPsfo7Of9gVNIV8mB:RshZORO4r4sfo7K8mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687422181, "uuid": "19c34b8e-9265-4dc8-b79a-82ec156a8d95", "value": 145804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687422181, "uuid": "ae3f1747-7a88-49c5-8bc8-2cdbb21f94fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687422181, "uuid": "aef1119b-d264-4a1c-9dc6-2416911496a7", "value": "c4a2b37787b43f7a78f027ea52e09ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7e0b61-10c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687413398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413398, "uuid": "d804aafa-5647-4e99-a349-de18c4de4b66", "comment": "Malware payload (AgentTesla)", "value": "10bae11f5ecf20810386d9032e203017", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413398, "uuid": "fa4732f6-7980-4f27-9270-4e4eae5c1f95", "comment": "Malware payload (AgentTesla)", "value": "f69fc3c75b668037669d4fb0366195aac7e89263c5c17fb64f8c04b8b680b239", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413398, "uuid": "60746e4a-cc2d-4feb-94de-ded68243cbae", "comment": "Malware payload (AgentTesla)", "value": "dd1a053cac26b6b6cfd831a4e887ad0894074399", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687413398, "uuid": "16ed08f3-65a2-4027-8483-7e59a5f3aa65", "comment": "Malware payload (AgentTesla)", "value": "d3da02d5bf18271464bc0dd94b49668aaf67bdfa45f4edc13d5e00d24b277ed5b2ea2ac7e1dc71deb0f504575d75c682", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413398, "uuid": "cf1874b5-0e93-4c82-adfc-e8d4a2edd9f2", "value": "T1A783822EE70F0965DF55977B030B4E895ABCB22DB38540B138AC573437ADC2E46629BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413398, "uuid": "ffae774d-33b3-4b65-b6c3-d9ddf54e1756", "value": "1536:af0Xvx3EMGd4kbGeoWY4asJYC2AwimSA26bk1WIP8DI+iO6Z1Od2IC7Q9/mPqvUp:asXvKMGykbloWNaO2Awi7A2mk0IP+I+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687413398, "uuid": "4b81fc5c-0871-4dba-a7b3-a1a03a51a17c", "value": 82728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687413398, "uuid": "eed737be-3970-4901-af61-a032d5a94ef2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687413398, "uuid": "7af1e31d-47aa-4569-99a9-76eb2af74234", "value": "10bae11f5ecf20810386d9032e203017.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d857a1ae-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Nymeria)", "timestamp": 1687419107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419107, "uuid": "1771716f-a340-4d20-a0ca-e5023c767e37", "comment": "Malware payload (Nymeria)", "value": "d76c2df220e7475b12770d2916b108fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419107, "uuid": "e1e1e92d-3b4b-4ebb-92a5-1b076a37494a", "comment": "Malware payload (Nymeria)", "value": "f7361238517b78cbfa63b08ba3e6a8828aa006cb4f65e564c3f69f26127e87bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419107, "uuid": "31ad0aa6-2b15-4e7e-8011-9a9bb9600231", "comment": "Malware payload (Nymeria)", "value": "f8dd7e97b18570543bed4e5a2403f3e7fc83598f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419107, "uuid": "c161ca34-b659-46ae-9cbd-3575230cd0e3", "comment": "Malware payload (Nymeria)", "value": "af4e0e451d56aecbec2d89aa70b32ea7a2b76eba372cb6b74272fd1dba65c29975c4c9438362a273f1cd0415cd5611b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419107, "uuid": "3999d065-ad84-4560-be46-c2a5873e4d8b", "value": "T119253340DFEAEC59CE5EC47330E78B5E3EB90B1248BD03586455CA1CDEAC7076A66872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419107, "uuid": "83d12096-65db-4c97-82de-93518ac3ddf1", "value": "b9083dd82a429a49d949568d3647ca0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419107, "uuid": "c8541c64-66e4-417b-b760-b0a56596f056", "value": "24576:GhloDX0XOf4lLZPs0hmOReGh1kLbkZEFK0gmJBphnYf0si:GhloJf6FFdek1kH2EFK0gsBDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419107, "uuid": "84d11020-6432-46d4-958e-93ff0d89fd11", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419107, "uuid": "4ca3fca4-8cd6-42dd-b43d-4267bcab8a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419107, "uuid": "f272eca4-e988-4ea7-a1a9-0404f4890a7f", "value": "d76c2df220e7475b12770d2916b108fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9399ced9-10fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687439178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439178, "uuid": "d32ecb63-5d11-4bd7-b080-bcc04f5a5217", "comment": "Malware payload (RemcosRAT)", "value": "a65d2e4684c27d2b2f6f564f297a07dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439178, "uuid": "265d50f3-9038-482d-b40a-2e75400498a2", "comment": "Malware payload (RemcosRAT)", "value": "f74114f7306666720ea784e9908aa1b5893354b5d868dde1217aec56122601fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439178, "uuid": "ffe8cd10-98b9-471c-acf3-c1d471d85349", "comment": "Malware payload (RemcosRAT)", "value": "a0bcbd3df3b5bcc0a7d921e635f7075cfc3444a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687439178, "uuid": "7ac56ad6-53c3-4b66-8515-4dcf5f506379", "comment": "Malware payload (RemcosRAT)", "value": "bba42c50e403e67bd0d3dcd5f98967edf92d44a91e1bcce15a29d023b802a9b87420cc4d2ed0e46659881289872c2b13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439178, "uuid": "dc1f825c-1f23-4419-b88f-6dcd7612c797", "value": "T16525C0B1A3E18437D12F2A3C9C12936D7C197FB53A686C4667D53C4D8F3A2413A2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439178, "uuid": "e9bcf8c2-9b26-4c8b-b6ee-6e432538f390", "value": "86b76e29e8cfff69525744de68799022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439178, "uuid": "409c6e6c-1953-4b2a-9bd3-6f83a91ca1fc", "value": "24576:OdXCS/MhpM3Gr33xUIffTiHc/zOeJgI+yoS:OdXwxlTyqSyoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687439178, "uuid": "cfc636b6-113e-4c58-8ce7-ddb83d36f32a", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687439178, "uuid": "2cc3de7c-34a5-4595-91f8-e50437f28845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687439178, "uuid": "54a42394-8c4a-418d-9994-a50984efda4f", "value": "BANKDocuments587DOC03027321122021387032DE564RT55E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8281db-10c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687416030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416030, "uuid": "15e727bc-d4e9-48f7-a617-04e1a492a81e", "comment": "Malware payload", "value": "52e3bd192d7ba9d0b0050bbb396f45c4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416030, "uuid": "c78dabf8-c961-4587-9b8e-e7481a9a7ae6", "comment": "Malware payload", "value": "f760c8398ccfc999e331cda20371811b6c38eb1bc925f244923392ae812f4376", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416030, "uuid": "85af1564-0508-4a42-8d1f-69ca2d72ef6f", "comment": "Malware payload", "value": "85395a520d2be1566ffc583a8fa9ab5bd213603e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416030, "uuid": "d1bafdd6-3a8f-48a3-8dc7-5a4991c403eb", "comment": "Malware payload", "value": "68974a778e1a8e4289985bcc6c1e1ceae1c213f3ae245310de9a6103ec2211fb930f3df6c25c3ccb54b0f92e7d12d470", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416030, "uuid": "9de50e0b-ce0f-4b7a-ab29-0c6ed82e8608", "value": "T112272383F368683FD4B3C432896A96365529DE548E53D74B391CB30C2A779E82B84FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416030, "uuid": "0a77c980-8f62-4813-9ead-e3e6edd7b974", "value": "393216:XZYp3yCgAptf9Bq9OTYQjH4WmbDiUc7lH1wsIKJBM1zmS2anbNr:K3FZnqDQrtIFgHysIKMX2aZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416030, "uuid": "449cde5c-444c-47c4-88bc-021787d941a6", "value": 20582317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416030, "uuid": "854dd5b9-934f-4fac-9d6f-7b39725eeb53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416030, "uuid": "3d1bcb4e-f18b-481b-997b-de39f49e4e69", "value": "BNL-SMS.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa33be7-10cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687418529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418529, "uuid": "faf5b296-b730-4ab8-9896-b47c793eead7", "comment": "Malware payload", "value": "f9291249583589be03efab73f4ac9883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418529, "uuid": "18d3b6ae-130d-43e9-b7e8-623a04ff4ac4", "comment": "Malware payload", "value": "f7c5c01dedc8af16e02e0559d7f973020588ec60c22abb5d25942cdc208f149d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418529, "uuid": "a7023e80-f956-4cf5-9c03-75447dd58c23", "comment": "Malware payload", "value": "dc659498c9297daba3397040005b7b8fcfec045b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418529, "uuid": "2a800e15-8ae9-4da0-86f9-3799c7552b24", "comment": "Malware payload", "value": "7455c39869a75f9b1e0dbcfad20748e3a02edfc40b54c013afd716e6558d3a282804e66bb229605b2fc046ff0a91563b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418529, "uuid": "163f8bd2-4d2b-4beb-9d23-17975113ff61", "value": "T1D186E017ADB8CC6CC9A384335092C397D20AE14DAE09DB9F13B11945CEF496B5B12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418529, "uuid": "035e3c46-7b5b-4a60-97e6-f5109964c346", "value": "1f2702872592229d2f4cb1162cfbc55b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418529, "uuid": "23f91de1-84d5-48ff-b591-d4368f601190", "value": "196608:2cvXqZGazRpON38w8KPXJU2owfRffhhvizcjcrTuDV6sGuk:2cvaMa1YNHzJNoOZOUcrTuDwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418529, "uuid": "54546ae8-d0e4-4416-9617-7ad46e54979f", "value": 8406156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418529, "uuid": "f68ac503-8f5f-4b61-bef8-10b4bc931439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418529, "uuid": "1208247b-3b8e-4b85-bfcb-ba4f34e1d168", "value": "f9291249583589be03efab73f4ac9883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ec76d4-10d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687419719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419719, "uuid": "bbfe4bb4-3dc1-4ac7-9c94-730526502fe0", "comment": "Malware payload (AgentTesla)", "value": "d86a0b37b32a68e999e94f3299c9bbb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419719, "uuid": "c3a7e4dc-54e7-4d78-acc0-7bb3d6b696b9", "comment": "Malware payload (AgentTesla)", "value": "f89e980cad0c8767b2d3b8cca3c7d4f336baec22f35899d0ba870b9f0bc44afd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419719, "uuid": "50503750-adf1-4ca7-8c6e-8fb41e3d8d7f", "comment": "Malware payload (AgentTesla)", "value": "7f82e1ba19799ed4656c5bd54b7e56c9d6c7fb21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687419719, "uuid": "82b70298-5536-4a12-a441-3de902b5836d", "comment": "Malware payload (AgentTesla)", "value": "0049f5598121357eb06f63b435a7833595cd9287061c5a73cffa62bdcc66001b8695ffc40d24c48a94d27c7dc763a974", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419719, "uuid": "38400c32-44d4-413e-92b3-bf8a4d9e6481", "value": "T16215C2C60A14A387FFFC82B51099E53F516E7F4DAA40A1CF5E9173B4A233A0E49D1A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419719, "uuid": "b7b2444a-8317-41c4-b129-333c6834f097", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419719, "uuid": "c8869869-5aed-4d15-ac7d-32c523558190", "value": "24576:/dvDcAwwYhFX5znf9rWY1HK1CvpBL0jb85:/dvQRHX5bfNF1q1MnL0385", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687419719, "uuid": "1f2e7d98-16f5-4b4d-9dff-09df36faacd0", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687419719, "uuid": "1d6bdba8-7868-416f-986d-7ea28358b281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687419719, "uuid": "3cd8920c-c725-42bb-98f6-9bb6495dacbf", "value": "Invoice_0230621_087860_092920-DOCX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a8fc95-10ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687418995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418995, "uuid": "027a2600-acc6-43f6-ab67-add130dbcec2", "comment": "Malware payload (GCleaner)", "value": "54318662d90fa4747c78315f06c2f754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418995, "uuid": "9fb374c9-9e3d-4eb5-b8e2-51f0299d0187", "comment": "Malware payload (GCleaner)", "value": "fac070d72e467d7e781b64a7f4b183a4618c4c6e03be975c2627c9be99e84f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418995, "uuid": "af1c6936-f182-4cce-a71b-b8e2c7f657e4", "comment": "Malware payload (GCleaner)", "value": "9eb4bb6689a5dd095347cf8f313b32344464fedf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687418995, "uuid": "6e476d79-766a-47fd-8442-5e638d479d2c", "comment": "Malware payload (GCleaner)", "value": "d62a6733f7f79680edf1da7c1b92dab1342a66005052c1695e9fd4a40b12da428ac8d7ed1ae27e80dec68da58261f359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418995, "uuid": "510c5d99-51a1-4d15-9ac9-11672700d539", "value": "T111744A4392E13C51E9A58F738E2FC3E8760EF3504E497B65222C9A5F24B91B2E177742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418995, "uuid": "1077258d-dfed-4cc8-a511-8f8a83382af2", "value": "7240fa76536531357d99f937a15ee51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418995, "uuid": "6bd0978c-7123-4f64-b84e-898f4577ca6a", "value": "6144:Xmax24uJTFW08YXhqxxCnbU9ZxgBGc/kVW:xJuJTFW09hqxxCnbU9ZncMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687418995, "uuid": "28615d9f-4457-4355-a7ad-ff6ee83b94c0", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687418995, "uuid": "c0d67963-ed4e-481a-9fce-b84370db0d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687418995, "uuid": "9875fca3-546f-4aa0-b869-344260ccde71", "value": "54318662d90fa4747c78315f06c2f754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff70268-112c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687459224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459224, "uuid": "4db17ceb-f0e3-4d05-baae-538473d6a8f5", "comment": "Malware payload (RedLineStealer)", "value": "1a6b668d63052bc664ee960ba92252ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459224, "uuid": "864719b8-0a2d-41f2-a3eb-adb917f2dcca", "comment": "Malware payload (RedLineStealer)", "value": "fc0705e1a8ded9f7c1b53a0d8acc6d20b955b1afd2c44ce9d6a18cb7dd34944b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459224, "uuid": "2180c6fc-b893-4881-87ec-1c221218bb6c", "comment": "Malware payload (RedLineStealer)", "value": "3eaa3b0e55721cca3137d8bd3e086b9fd75b20ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687459224, "uuid": "8d116188-2387-4dab-8ae2-5431d504b975", "comment": "Malware payload (RedLineStealer)", "value": "bd2ccad4fe33d2a9b912468b1951b028d538a9b1b209ec0908525102c2f1403453cea9b5108a5f96285c4069fe5928b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459224, "uuid": "31ff8fde-f472-49ef-a702-ce2542edc732", "value": "T120E412CA65408963CF33DAF1C8EFE9D74E7AA1250B6647C7130D99F94E052E4E60B43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459224, "uuid": "a0468e07-556d-4444-9a42-d6ad04750a8b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459224, "uuid": "ad71794a-3cbc-4002-94c6-6bf2efec24f1", "value": "12288:iRq2dATey5shjFl4Ukb/tMNfYaWNOcJewMABTnwNAT5h7KruBQJK4E+3KeQJQmZ:Mq2+Tey5shQUkDgfYpUcJewMuoATau60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687459224, "uuid": "2d04f341-7e5b-41d1-a627-d0a784e66970", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687459224, "uuid": "96edf800-28e7-4023-9a3f-cdf11eb30a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687459224, "uuid": "d8aa4627-22db-40cc-9028-c96e0d0bc2e5", "value": "1a6b668d63052bc664ee960ba92252ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ad2587-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687456821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456821, "uuid": "5877008f-018b-429f-ba7b-2f022e956c81", "comment": "Malware payload (RedLineStealer)", "value": "cb0b9556aefdc47e04c9dfaa6cd62c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456821, "uuid": "0f4a97cb-5f09-4161-93a6-02f50bd5e318", "comment": "Malware payload (RedLineStealer)", "value": "fc0a50ec189b63649ff733fb32955f7ef800a453f322f7fe5e16ad952178ec52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456821, "uuid": "e8dedeb4-6f6b-46bd-897b-c857a1eb30f9", "comment": "Malware payload (RedLineStealer)", "value": "b1867f73f6dffcdead59adb30c0cf1e558cf19a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456821, "uuid": "3f63f893-acbb-45c0-a12b-1f957b5952e5", "comment": "Malware payload (RedLineStealer)", "value": "1a355b44beab606745b4d2b19302723fa5bf66ce544632956bb3b1b9c5aeb9aec134de35a72e40ef6f087df1ec6f640a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456821, "uuid": "39c4d4a6-5803-4a62-a567-4ce1e24dc826", "value": "T1ECB4F1C922804977CF23CAB2C4DFE9D70F7AA1110BB14B87160D9AF54E065E8A61B57F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456821, "uuid": "8adda38a-0c98-4522-9606-c7bffa465168", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456821, "uuid": "c16c6394-70b8-4bc4-971e-c2a56e3502fd", "value": "12288:HodJ3Tey5s69MVwRiZ0RMqG3YyvDPCeLJY8e/nI6QJQmZ:HodRTey5s69MVyu0RMqyYyjDOFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456821, "uuid": "5e87694c-09b6-4f99-9e78-44a47d058275", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456821, "uuid": "eebce37b-3c56-4e33-b70d-1611163b97e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456821, "uuid": "d434fded-3b50-4102-bcd4-e6f05b7648f6", "value": "cb0b9556aefdc47e04c9dfaa6cd62c70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e34343e-10d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687420244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420244, "uuid": "46c791ca-97c7-42ba-a146-fe5989835003", "comment": "Malware payload (Loki)", "value": "3c01bc9003cd7325f4ef1c59ddfa250c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420244, "uuid": "f3b64fc3-0e55-4e0b-b0dc-73fa9ae2ada3", "comment": "Malware payload (Loki)", "value": "fc1c2a3904caa654e1cbc35758a7f710d60f3dcef0c028eda87cd7e82489b472", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420244, "uuid": "d7f6becd-1e6a-4437-b177-3e63b8234980", "comment": "Malware payload (Loki)", "value": "1bcc21d6758d4a416c958b1b21bb1c92e1e81f8d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420244, "uuid": "4ce5f4a8-1410-4574-9573-32f817fa2dca", "comment": "Malware payload (Loki)", "value": "f713c613a92019dbc1147283ebe80b3fefbac67783d2d720a07dd4229a945b7281df363c5da73ad8d34ee762a536110a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420244, "uuid": "b899a01f-ea92-44df-9b8d-14d7b90fbdc5", "value": "T100D41254BB9A1067D65B1BFC00A026B0933BB84B7A37CADB4C9772DE54B6F805660F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420244, "uuid": "013309a3-e532-4272-8535-2b114656a181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420244, "uuid": "bc6cfb96-e325-46ae-a261-1da2fcb1f516", "value": "12288:s4XpM1JCIQfNsVcuoQH60sayjsvRZpPeEbu3cIMXdHTZAlG97AgAXheRX:s71KNouGdRa3t6dNb97lAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420244, "uuid": "7ea7c5da-5071-42a6-a6cc-8c00d4637068", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420244, "uuid": "ccee98b3-cb76-4035-a18b-36abdb64792f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420244, "uuid": "270b6db4-65da-4aea-83b5-5d92592c1775", "value": "zY5DiDOAsVjaETY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb77dcb5-10dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687425608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687425608, "uuid": "58b662cb-86be-42e8-af59-6f3b3098dd24", "comment": "Malware payload (RecordBreaker)", "value": "ddc8ffd0641b7d561430ae489fc6aeb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687425608, "uuid": "44c71327-c1ba-44d0-bb4f-782b8ae851ee", "comment": "Malware payload (RecordBreaker)", "value": "fd499f6e9aeec4927a0b4ef013123db28d6ec283845cf8b6632efd209f53d383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687425608, "uuid": "6b2f0d8a-8e41-4f6c-bdcf-4bcc6608333e", "comment": "Malware payload (RecordBreaker)", "value": "a14c77468476aa2c5e8dfe75f35e8751f1ddce87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687425608, "uuid": "6d4165e2-c0c1-4db2-8ebb-342b0190e436", "comment": "Malware payload (RecordBreaker)", "value": "f187607abeb64d22b4776bad2c39a322e4852471d63f594e1817a44ad35d66a5cdf30a0f13b8e046a0cdae3d55e46ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687425608, "uuid": "ca3d18f0-9f64-447d-8fb6-07d1557cdb17", "value": "T15654AE0137E1C072D426717A8525F7B45E6BF8715767EADF2BC80ABD0F386D1AA2430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687425608, "uuid": "eb847a09-1b5f-465f-8544-3bf76ce03ae4", "value": "4c7f209181ee40b674200cb9d1c76dd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687425608, "uuid": "97ac0766-e130-47a4-b77d-00fc389cb868", "value": "6144:tFnyEWXGf0TsCK1HRqTlPdLd5nAGkCi2K:7yEUGfws/1xeNd5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687425608, "uuid": "7bec829c-b26f-4e20-846e-ccd332894725", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687425608, "uuid": "c3ee4b68-64ec-4fa3-a253-8755fd21adc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687425608, "uuid": "8caaccde-5b24-4d6f-bfb7-523b447e4ac0", "value": "ddc8ffd0641b7d561430ae489fc6aeb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c076fa46-10d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687420785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420785, "uuid": "d8e33a8b-b0ad-4127-9fef-e13ce6175195", "comment": "Malware payload (RedLineStealer)", "value": "2c40c895781aa65ec811537233d48850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420785, "uuid": "40cea03b-4c01-4904-9497-078c7865d01d", "comment": "Malware payload (RedLineStealer)", "value": "fd9b0bcab91a3899bd4720e00819f2c2e0cd5d5cc084e18e9f86b489e2b995a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420785, "uuid": "239ad149-2e53-41a0-9a03-20238faa8327", "comment": "Malware payload (RedLineStealer)", "value": "1596f924a96293520341ef57e3175e512abbbb38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687420785, "uuid": "bf68e7b9-d410-447f-b740-cef39e5ec33a", "comment": "Malware payload (RedLineStealer)", "value": "bea145961452db2723e1f8e335c471401c58711b674b12b1de84150974d94085582f49cc63fcfd22b2687111c37f3148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420785, "uuid": "7bbd54db-7468-4444-bf20-16e7a2186b49", "value": "T13344CF48B28A7B42E9C8083487E7D5181715FF07E944E71F22E976065E7338BB563B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420785, "uuid": "534c4844-eeb1-4cd2-bfdd-4948994f4186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420785, "uuid": "ec43479e-b9ff-463c-b680-dc074cedd178", "value": "6144:jNebAaaOd1WG9Uv7mqwwnrTDeCXFkvOTMUJxEsGQg:jLrvjXFkvOTTJxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687420785, "uuid": "ac2c3db8-b861-4d25-8200-b0189b63a594", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687420785, "uuid": "ed6f1435-34a4-48f4-8913-d569f8b49650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687420785, "uuid": "e7c92a85-698c-4fd4-afee-6bfa0cba30c3", "value": "2c40c895781aa65ec811537233d48850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7bdc10-10f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1687436159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436159, "uuid": "2b24d76a-398c-41ff-946b-a8e802e2028c", "comment": "Malware payload (Guildma)", "value": "114a96406c2aa2c69b891b29ab8771d7", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436159, "uuid": "4d3b1809-5605-4b07-8511-9ce764789e0e", "comment": "Malware payload (Guildma)", "value": "fe441b6c5bc37f2a39675ecec331c5bd8682a9dd283562c3d1c03c426051b72e", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436159, "uuid": "293e41e8-a56f-4099-8fa1-db281b0279c8", "comment": "Malware payload (Guildma)", "value": "779421858f75cf081299e4b25e2e5b5803f742f8", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687436159, "uuid": "8b6dc57f-86d5-40ea-95c6-a5c9e8bdf65d", "comment": "Malware payload (Guildma)", "value": "d444aa799735a423206b4be890043d8af3a06f17ab99d12cf885c0390627c028268a691457b537ab7e479e71f2da0bb5", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436159, "uuid": "a93fb90f-a3be-48d9-83b9-61db0cd93479", "value": "T1A7016BB6EB680D7A94B20B86DC706D0C58F69CB20A4D905DD9133548C57C6921FC4BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436159, "uuid": "f99a3856-8549-4d97-823c-d0becdfcc574", "value": "12:tLRMvDCu/eaTAS6yVIdyVUaVuR/yVIz87KZIxiOjl63AguqJFp1:tKvDCu1Tfwja8340ug3Agv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687436159, "uuid": "afa1a1df-782b-44ce-8056-716fd532f525", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687436159, "uuid": "545f3cb2-1432-44ac-a2fe-e5e3d9e401aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687436159, "uuid": "8605a2ea-85d9-41d8-b735-04ddfe8794b3", "value": "ORDEM_DE_SERVICO_8755723354613023.395236.53868.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9fb667-10f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687433450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687433450, "uuid": "95d866ba-e71d-4326-9d9d-ebe2910edec7", "comment": "Malware payload", "value": "30b0946f23665b4e21c197804decf473", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687433450, "uuid": "34c85caf-7540-4b2f-9914-0bbedaee71b0", "comment": "Malware payload", "value": "feb9ad6adc8b8f4ceae6b19dd18547ee1abb9891d36ffb5cab0d661359d05c30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687433450, "uuid": "b360ef4b-3f14-4b4a-8007-483f784757ed", "comment": "Malware payload", "value": "0691a5e9bd2f44c3225357a91ce13667b1acf54e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687433450, "uuid": "21e645e1-d78d-41c7-b1b0-ef422ce1f89b", "comment": "Malware payload", "value": "b6738e5a5f3d6a5bbec3644826e0fc0574558d87070e986cae29b4790d08b61a0966fa454cc0bd23d74774b0eb9c9ccc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687433450, "uuid": "3f8f25fa-bae1-439f-97d8-d53b09b80174", "value": "T15377337CC0A1639B1D7B5831B5F1A0DBC86681F1CA535E2792ADA633DBCF3D1A178089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687433450, "uuid": "8d9b0b2a-a35e-4751-ba87-874d4010feb0", "value": "786432:vfTPmBTW7E0YaoUO/pmrW9twEvaWH36l96t+eOhWYPOzp:7CTqzYxQKh36mZYcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687433450, "uuid": "42ff9b08-3446-4a6a-9208-89fcf67077d0", "value": 33305449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687433450, "uuid": "60a9ee5b-a3c5-463c-9758-487ec372bb4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687433450, "uuid": "b15bd3f8-f102-481a-a2c4-c04a11a2c0fe", "value": "30b0946f23665b4e21c197804decf473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743ee70e-10c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687416362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416362, "uuid": "519e73db-47cd-43d9-99ab-452374b13864", "comment": "Malware payload", "value": "157c168eb5bb5ea8b1375b0834c00cb4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416362, "uuid": "5aadbb2b-2912-4a99-a7e9-ca4742820b66", "comment": "Malware payload", "value": "feee8b399acf736605f15dd1be6027d4e1f7c2538675ed4c43fc947f9e201e29", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416362, "uuid": "69cd7ea7-5b36-414c-846e-396097bd5d5e", "comment": "Malware payload", "value": "4a4e5e8f8a379104e107c3356fb2eedbadcef665", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687416362, "uuid": "32dfe37e-c7e3-4ba1-9f02-301f25d02695", "comment": "Malware payload", "value": "8c803dfa0c42485e17a626f3db566fac615509265ee713011a115452bf4a17fff02b0bf06de87c6d4eb40d6a693b0e6e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416362, "uuid": "81c775ae-c163-4116-9d1d-b78ba8fcccea", "value": "T15C36D156B3B400F8D1ABD178C9165607EBB1B415177097DB56E0CAAA2F23FE12A7F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416362, "uuid": "00b27cbf-5c22-4dc9-9c83-2686481bfa9e", "value": "7ece47d65941b3e72bb0a2006de482fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416362, "uuid": "b644baba-8bfe-4886-97ae-c530ca910b78", "value": "24576:D7SRhRFO8fNz8bQCuV9suuvTo1+0+kSSJmdzCjj4GdaVcNrTR8hgW0Fuh9XFtn7p:8lfNzsQCKsuuvTFkStdzNC3R8hoe/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687416362, "uuid": "fa41bd10-3959-4db0-a911-005f3e226b73", "value": 4997632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687416362, "uuid": "1a65c331-8c9d-4594-9eef-e7adb6249768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687416362, "uuid": "258b5031-717a-49e6-a595-5dc39ead5646", "value": "157c168eb5bb5ea8b1375b0834c00cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eab307-10e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687430089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430089, "uuid": "6ac1f7eb-8c88-4510-911f-2b05b326caa3", "comment": "Malware payload", "value": "2ed6231ff9b39d621955d3b772e256fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430089, "uuid": "74b266f2-56fd-421e-9e24-2869d6e36a77", "comment": "Malware payload", "value": "fef744e3a1b193d881e624e89d75e8dec5c03db9abb0e6ebdd53336606bc5949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430089, "uuid": "1d039dc4-25b8-44e8-8814-d6d2ad608448", "comment": "Malware payload", "value": "7f5252e3d4a0bb8d7581bb7d0632ab2d73a2689d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687430089, "uuid": "91c62d28-de6e-4a55-ba99-fa5ea6fd1c70", "comment": "Malware payload", "value": "054b44760b0938cb87dcfedd2af6830379aa310d1c5d9e2347712017a772af10776182e5436f24f7d8d9944f7ee08e74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430089, "uuid": "4c497b88-904d-4b88-a61a-fc5f441c545e", "value": "T1A88633FD6BB14B6ACAE0673DBDDD81D48F83395E9838BBB03CB871045BE364815055A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430089, "uuid": "b44a99f5-4d84-4f56-9d85-ea20be7962cb", "value": "196608:DVuJMQpPG7G7ep+UkX/2srizXq9yR7OA0nTshYC2:huJlpe7eep+UkuLDOA0nTz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687430089, "uuid": "93c02f15-0587-4742-bae2-171a07d49b21", "value": 8523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687430089, "uuid": "ab370ecd-84ed-4a23-9563-6979b1de0d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687430089, "uuid": "daaffdeb-6bf5-4f23-82b9-a355db6776d1", "value": "SecuriteInfo.com.Variant.MSILHeracles.89738.8028.1955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e64b2e-1104-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687441972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441972, "uuid": "478b87dd-b942-415f-a919-b7f6a8fe04eb", "comment": "Malware payload", "value": "52ff59187c2b89d02f042c6c6211a62b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441972, "uuid": "2adaff36-6fe5-4b7c-8cba-01f74537e2b1", "comment": "Malware payload", "value": "ff4534224d8fc38aab63e9732f572116add0fed40f80e8e06e8afd98bfa128bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441972, "uuid": "594e611b-5c11-4916-9907-d453a6868924", "comment": "Malware payload", "value": "278cce0aa06b84bd3844db09013f61f4f4ebab98", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687441972, "uuid": "d2efdc20-0f09-4c65-842f-d375d4a914e0", "comment": "Malware payload", "value": "a82d226b7fc18fd071197be8cc89c008e34f883d56d88d70ae28eee29bee16bc0f0d247051935cfbb9f14f691bba3666", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441972, "uuid": "5c5ca417-2d84-4bd2-b9c8-ce9d2660a11d", "value": "T10777337CD0A1639B1D7B5831B5F1B0EBC85681B18A535E2792BDA233DBCF3E19178089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441972, "uuid": "8c1f7fd6-e39b-4e1b-a435-10bf33dcbd80", "value": "786432:vfTPmBTW7E0YaoUO/pmrW9twEvaWH36l96t+eOhWYPOza:7CTqzYxQKh36mZYca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687441972, "uuid": "c48c3ad4-412a-4e38-9317-1be349270264", "value": 33305446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687441972, "uuid": "f450dbd4-27a7-411f-86fb-c963c7fa069f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687441972, "uuid": "c1302ad8-682a-40cb-bd1f-5ac8bbefb691", "value": "52ff59187c2b89d02f042c6c6211a62b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f20d4c1-1126-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687456780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456780, "uuid": "a2e221a3-5093-4318-8255-e3c2662ac039", "comment": "Malware payload", "value": "fb932030fc9a28e50e7aaeae19fea934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456780, "uuid": "c19df575-17d1-405f-9997-b90c7bbfad1f", "comment": "Malware payload", "value": "ffce0fb6554ed8d2bf0a8d6c5fe570370acd1137dd32c7e2d66b0a2632a01604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456780, "uuid": "0c37ef6d-6b4e-41a9-92fb-1e61ab17c358", "comment": "Malware payload", "value": "8945fb30a3807bd72daf1bdb09c97f905ed7b88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687456780, "uuid": "c82f1bfd-09de-466e-a9be-af963c55f6ad", "comment": "Malware payload", "value": "6e8f2f125eba1a3d5591a2ce5c91874a0130b0494e7289770c615fc046b38839f462f2c326e2280b6a0a668f7920da8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456780, "uuid": "d960c9b8-1871-46ea-a4e5-474a3b09fd9a", "value": "T143E4F00071808932E97312325FFC89BC677DB961176929FB13D40EBE8FE96E1E532A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456780, "uuid": "379358f6-cb55-4a13-a969-ff9e14e3705a", "value": "0330cb8599ebc8e2472474ca94c4c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456780, "uuid": "7b93fff8-9cd3-4770-ae7d-b19d6615ae48", "value": "12288:KBPQd9uBP7su+Kflk5L1V/mojGFb6yOtlJJ2Tzh1wBP1KI/A3KGBh6Kqk8:p9mou+m4hlmoKMyO1U8KI/A3KG/yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687456780, "uuid": "53cfd218-f6d4-478e-96a5-77296212dbdf", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687456780, "uuid": "eb92c79d-e816-4e66-ae3b-ea225776f72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687456780, "uuid": "79c2ad6c-9577-4083-970f-1e5f401925fe", "value": "fb932030fc9a28e50e7aaeae19fea934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }