{ "Event": { "published": true, "date": "2023-05-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-22", "timestamp": 1684800181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1e6d8351-7d1f-4fa4-b08c-951943fe6620", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f20502b-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755916, "uuid": "4ca24dfc-63f5-48aa-8844-4332475f829f", "comment": "Malware payload", "value": "3f5a65b9fa0102f465d1f6d12b62aac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755916, "uuid": "125116cd-837d-4935-8e86-39bfb2fd4839", "comment": "Malware payload", "value": "010e9b536340d3f8d0e5d3458a5402204f4f1eec7deed11ccf780d187d5b12e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755916, "uuid": "9dd6768b-0828-42df-a738-282874fb0257", "comment": "Malware payload", "value": "63814a7249e3863ce035067c596681e72a5c6732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755916, "uuid": "9583f161-b3b7-475f-a67e-974bf297c91b", "comment": "Malware payload", "value": "8fa50d3757b763b2f9f7d1d91ccd1737efa0b9735ac4abc2236c53a93402087f4df0a170d44c31cb94e2cccb89801734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755916, "uuid": "13b45e55-dde4-432c-99c6-16cac2fa170c", "value": "T185D429453DD2EF26E746513249B9C7B87666A8F0CEE9964322309A1D5837370FA3B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755916, "uuid": "c04ebee3-6c60-4b13-964d-8a4a6a31f985", "value": "624a0953965567e30fd2cf8b0afe3aeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755916, "uuid": "ebc68874-8536-4f0f-a446-2a80f1ca1a04", "value": "6144:x4BeC5NF3abLD2AnMHr77Viz4tfWKqCAw1Vy1sa85tDxxh7GSKtQNXIw:M7F3ab9nMH7VuE7C+atSkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755916, "uuid": "9c86189e-6b38-467a-9cc2-7a7609d7b04d", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755916, "uuid": "5893988a-72b0-485c-8311-b880ebd58510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755916, "uuid": "31f177cc-c674-4d0f-9715-46f953927b41", "value": "SecuriteInfo.com.Trojan.MulDrop8.52767.8267.16106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b352dde6-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752300, "uuid": "aacda0ea-8d11-4399-abaf-7a4b0e289fd9", "comment": "Malware payload (RedLineStealer)", "value": "dbdcf0872ec655ac6e1a6b0d2164cd46", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752300, "uuid": "552faba8-86d4-4117-853f-1228cf59a6f1", "comment": "Malware payload (RedLineStealer)", "value": "011518dfccf06ae8a4e8816bde8e1182b8318c23caae6b6f4267ef0172d6d761", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752300, "uuid": "2ca61eb5-9325-4960-b3e0-3b9568c4d74c", "comment": "Malware payload (RedLineStealer)", "value": "6625a77578d0bba6a740e2a050aee0c462b7bcd0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752300, "uuid": "5e487355-836a-4d90-8a7f-2e9c48f45dc6", "comment": "Malware payload (RedLineStealer)", "value": "577d05108a85f65f29ac283fb32c8a014fea362c105624e28076877fa7e84cf2dbbfec11fefce94371be8f9808c857f6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752300, "uuid": "7e37e339-588b-4bdf-bb46-67c0a1fd17a4", "value": "T152252323ABECD171EEF6173458F503C30731BCE1993492272785A96B4C72B94A97633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752300, "uuid": "89cd1d67-277a-46fe-98b1-6fa51b9ec1f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752300, "uuid": "a3dabe90-e30e-4593-b4a9-31d64489d16f", "value": "24576:By1GkSEFRe9yq145rTgEeMP9ZJr5HZSLN9Vj:0HRFRmyqK5r7FPh5HoLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752300, "uuid": "19159344-6e7c-49c6-8c13-e8513e050c23", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752300, "uuid": "68895a95-3884-444a-81c4-04c7d6ad0f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752300, "uuid": "41ab7cd0-5731-46df-bfff-4e86d060cd9f", "value": "DiscoSetup400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cc1031-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752406, "uuid": "35902e58-c317-4f10-8f70-c5c6d35bceba", "comment": "Malware payload (RedLineStealer)", "value": "174ca1152c5569b07f50fcc4a7013ef3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752406, "uuid": "105122ec-01a3-45db-818d-b56f1343481f", "comment": "Malware payload (RedLineStealer)", "value": "0132c101423fa2b115a816d8af7885526f7113321b27c78088990da08e9a634b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752406, "uuid": "3ed796cb-d016-4453-9271-48e7a02972cf", "comment": "Malware payload (RedLineStealer)", "value": "cb7a78d66be98157b4ef311ef5ec9117d6fb7c5f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752406, "uuid": "8a181a2c-90cd-4ae8-bb22-8066f5387ee6", "comment": "Malware payload (RedLineStealer)", "value": "6726d7ba513234f8ad54903d61141406fcdf2becf5760b725d9e63827368a703c56c92d9755d531a42cf22b59003674f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752406, "uuid": "6c2b5801-7e08-4a29-9b36-d30cc3bff05a", "value": "T18125231366DC4436E9723B3214F39A87073BBCB04D75973B7B48AD1A1C72B14AA74726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752406, "uuid": "a08384fc-4d21-4686-8930-b626510022ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752406, "uuid": "4e8efc2e-53b6-4e1a-93e4-d07643ba1660", "value": "24576:qydvg+omjTkScyaGq9mw7Uy6cOklrDafpyD1:xdvhomjTpcyJq9mw7U8LIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752406, "uuid": "98db2e76-2b08-45b5-a32d-65dc6cdb16f2", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752406, "uuid": "b1f974ef-fe35-49ce-bfa7-56e57db457d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752406, "uuid": "9424ad56-1970-413c-9116-e1854941ff3b", "value": "editor307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053f67b7-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752437, "uuid": "d5776651-76eb-4678-8432-2d0d7af72d98", "comment": "Malware payload (RedLineStealer)", "value": "c41988ab159576d9cc910c585a6cc118", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752437, "uuid": "b7364602-baf1-4f4d-847d-411466aacf19", "comment": "Malware payload (RedLineStealer)", "value": "0211ad2dff57df12c699528690b136927b682da5e298d41ab66965d559f7684d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752437, "uuid": "83b2ee51-98be-4076-bc22-0262d89e15e1", "comment": "Malware payload (RedLineStealer)", "value": "53027870eaff2557c4353420dea06e4ff4be88da", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752437, "uuid": "8c69834b-ef34-4019-ae80-dfb29c86fab8", "comment": "Malware payload (RedLineStealer)", "value": "dc2049155bdc7b5138f2b2912c66407a7c68258f8f5ae983c4fab2aa22f356dc6830bbac8888fc7457eb180054d86c74", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752437, "uuid": "c52db60a-c989-46f3-8404-cef39625dcdc", "value": "T12C25230BABED4171EA611B3044F207D30E323DB56E65666F7385A42A18B22F4F5B077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752437, "uuid": "5262cb40-5070-4928-9fa1-7c0fd69aae20", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752437, "uuid": "89ca25a5-cce6-47c2-8a35-541ca4a72ee9", "value": "24576:4ygmYf/xemOqsOkYc7eo8VOt8sxO6Z2TFKv/X:/grnxembsX2o8VOt8s1opKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752437, "uuid": "e115ffe2-38fd-4357-9511-035247c2ee03", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752437, "uuid": "063acea9-d2b8-4f02-be36-7d2cbccae021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752437, "uuid": "e48c5763-bc65-4270-9ceb-be87af4bc3a1", "value": "gameplay240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1744a769-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684738294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738294, "uuid": "390a381f-88c7-4281-a991-93c3d642b06d", "comment": "Malware payload (Stop)", "value": "e131c4a8304d2b552494a4c6c9e73783", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738294, "uuid": "7e133af7-0b37-4080-be40-a75e49a40c50", "comment": "Malware payload (Stop)", "value": "0221aa3aeb9d83a2e440d4081d2b46b85a916bb8ed8e32fa3434344180c52be0", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738294, "uuid": "635975f3-7ec3-4c05-83da-46e1fb2189b6", "comment": "Malware payload (Stop)", "value": "df9c718854a3b7dca0033260faf491e0dc1cbe77", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738294, "uuid": "d2eb5a4d-87aa-485d-9867-2ee21eb233c2", "comment": "Malware payload (Stop)", "value": "d4a4d7a984059aba81270d9688fcd7338054da22e46b65e7fec85eced0388b73f63fe03b53f6dd38d8319590fd14e563", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738294, "uuid": "1455cb1f-25a9-4666-ae1a-950235b5b8b2", "value": "T1F205F10362E17C61EF164A728E2EE7A8361FF5604F593BDB1B444A6B15B01F2CA72F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738294, "uuid": "5c78d44a-1a3c-4b52-a364-87a95112b7b0", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738294, "uuid": "c95d170a-8efc-4c27-8cc6-1a1299023ea3", "value": "12288:nJ8fyeFHnIMfTfrrTWEIxT8NDzBgZiUoVmhWcgyPgcgaFcAbo/Ph/f:nJFeFHIMfvvWPTqFj5agj4FfkhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738294, "uuid": "8cd6991e-dd62-41eb-b125-086db1d2a574", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738294, "uuid": "460e2735-7938-4d96-acb4-302ee92aea3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738294, "uuid": "ce1cf25f-c912-4dd5-a5b3-35e074067866", "value": "report727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b836c19e-f86f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684739423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739423, "uuid": "e46fa9c8-f197-43c4-b36a-fa2870e4057c", "comment": "Malware payload", "value": "39f96bfa62a593c2aaeecbcd98ce00d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739423, "uuid": "a072774e-5f0b-4dcf-8c7b-097ea5a9e173", "comment": "Malware payload", "value": "022a6f19fbeaa13f4c3cd3c5e2432fb6a55553addea7072db658eb29e4a66434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739423, "uuid": "07bde8b9-af19-469a-8085-7047cda2b50c", "comment": "Malware payload", "value": "0564fa0be874beacd3fdc29ad873954e2473db97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739423, "uuid": "79f56ba8-86d6-48cb-babb-ee50d863fb96", "comment": "Malware payload", "value": "89c4dc502fce9ed2188f4c0e9ca4cdb46415b618f9f4ecddaa7b91b5c8394c98d39f1370c85352a3b9e905ca9c0f919f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739423, "uuid": "fc9e8aa3-511e-4a4b-874a-596f6971524c", "value": "T1EE55D061BA1281C4C4EC383BCF6391F893B69DB74E65D01A7DE836D99937A432A03753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739423, "uuid": "e81da28e-fb4c-4624-9dcb-17acf80ecff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739423, "uuid": "9297f018-0b20-4924-8ff2-544365f39d54", "value": "12288:2d2fefKfjtu5NZ9/z9uUxV13BVtGl9W7g5D2AzZ06Wny3lnEmf:2i8NZ9/z9pV1xo9W7zAzLkwln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684739423, "uuid": "483d8422-23ab-441c-bcd7-b9ace65600e0", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684739423, "uuid": "57bff7b9-0e82-43e6-848a-de2717c334a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739423, "uuid": "ec4b9157-8bd8-453e-8bfb-6191845e48a5", "value": "LXLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd90fea5-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752317, "uuid": "0eea59ec-3a77-4a97-890b-9b4d2244e0b9", "comment": "Malware payload (RedLineStealer)", "value": "b7b0ef2f80e2704218aac359da71dbbd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752317, "uuid": "12996784-ef68-46b6-9c44-d13b770d2898", "comment": "Malware payload (RedLineStealer)", "value": "034081e568a6ee8520f8b1d4f72a5757090b2c203e5f910aac6dbf053083fb4d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752317, "uuid": "2113b6bb-aa9b-4c33-9949-025f440ada11", "comment": "Malware payload (RedLineStealer)", "value": "fddb2564d65ccd930cd0fd057d04445422f6c73f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752317, "uuid": "fb39ea1c-b8b7-4031-ace9-384001ae44f9", "comment": "Malware payload (RedLineStealer)", "value": "6c51272a6e6d50ee6638bda4e4887cda263d75b65623a5ffd5a109b8308bddcbcaad05ce2c1261039f4eab6194a671ac", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752317, "uuid": "7b3a1e8d-1a41-45d3-a0f0-b0a20eaaa68f", "value": "T11F252312ABD49472ECB167325CF20393053EBCF1E5B4963A7695AC2A4C73591E83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752317, "uuid": "32d1102d-a607-459e-88cb-f9cd2aaf7dc3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752317, "uuid": "3f5dd7ad-7e5e-48ab-a052-faa88cadd0c5", "value": "24576:WyRP43mwHtLkq0p9tgaOgo2BiQ33xxI2fs4Zv1xJ:lRgzHtLkq0JOgo2Bij2U4Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752317, "uuid": "22753dd9-20fc-4aa5-af38-7d0e69bc898b", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752317, "uuid": "5e69e5c2-457c-4003-ab11-b9f4d42528fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752317, "uuid": "635021e2-c932-4a0c-9332-f47e51f16d0b", "value": "Unlock816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89634f29-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744928, "uuid": "9c53827f-60f7-42db-8519-7305a25f1b4a", "comment": "Malware payload (SnakeKeylogger)", "value": "7a72c6446b5daee944113c7c353a4156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744928, "uuid": "1c42594e-87da-42dc-a841-d4693264a3ea", "comment": "Malware payload (SnakeKeylogger)", "value": "03c2c605e315b7589bd9f386579027ad31d4014d5dc3d48ca9a446a5e53a3afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744928, "uuid": "92292c94-8f4d-4ed9-b8a4-6a3ae12b0f85", "comment": "Malware payload (SnakeKeylogger)", "value": "12b72cd3ec04b84b1fd1ed75fbf9265b25743574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744928, "uuid": "15262fef-8d6f-4665-ad23-cb59a97fa9d3", "comment": "Malware payload (SnakeKeylogger)", "value": "57a0e0ea001fa8a4f24f9379f861e4b31c2d9e0ce2efd99746cecd020df635f1afb644e26dabbcdbfa151814859a032a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744928, "uuid": "dc4e5967-c66e-43fe-8bbc-6017bbf6669b", "value": "T110E47B5233B53621F47D33BD0019638CCB39B44A2122E22A1F567AD546E37EB7B1A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744928, "uuid": "4f032d79-83f5-4bc4-89e0-435bb74df6f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744928, "uuid": "88ba0c98-4324-413c-82f9-9d4d8b7b9425", "value": "12288:AvV+s1bSQT6tjjdB4XABuhzydBi5mtaxLVrCtHQ2OY2aJ0BVtLJujWqRvuokq+mS:AtZyuhzyjx0xtd2OYlJ07Zbq5Cmv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744928, "uuid": "de124043-632e-445f-8c6f-ff5f782ca8fd", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744928, "uuid": "bb3fad4d-cf6c-4d98-a0bf-d9c7a0f7b226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744928, "uuid": "de3a667f-80f7-4c9a-b569-4de90461eec5", "value": "HSBC TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d567b9a-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752477, "uuid": "496238f2-b83a-406b-b617-5a99a12f3bb7", "comment": "Malware payload (RedLineStealer)", "value": "bd07e15dc09a3e1d6bf65d1696c90084", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752477, "uuid": "a6da7032-683d-4cfd-b3b4-b7f5ef38e45f", "comment": "Malware payload (RedLineStealer)", "value": "03d8c5cb2c813701046e078c878176a41226c849a5905ea6674063b7530bc473", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752477, "uuid": "c73a38d7-4d7e-46d1-91f0-1a046f1c4b42", "comment": "Malware payload (RedLineStealer)", "value": "e889eac071141acd2ae70034fd36ee45b3212510", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752477, "uuid": "66c35dc5-ef7b-4954-ad68-45b89736855d", "comment": "Malware payload (RedLineStealer)", "value": "727af87f968e31906ecfba3ef4ac5baaa0219e1cb3eb6f31e84dd3d530bc926462950994d684f627827952a5f266c6e3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752477, "uuid": "cf173817-cc24-493e-94dc-1b3569d64014", "value": "T11A252347EACD4072DCB567701CF612870B35BDB15935933B2346AE9A0EB22C59832B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752477, "uuid": "adc60304-bdd7-42b5-a666-e5bbd1c477fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752477, "uuid": "c94775e2-afa4-4275-81e1-364461b4bfd7", "value": "24576:4y3nxh9n7NHzuvU0q9sZt1jL4qBMsuk5dcs:/3rzQU0RXJ/BMsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752477, "uuid": "287a0b7e-d4a4-403f-8d2b-d760921de127", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752477, "uuid": "018e051d-54f5-4352-ba87-48bf11554942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752477, "uuid": "2bc25502-65a7-4802-bd89-beb2cce039c6", "value": "launcher882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f45638b-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684762842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762842, "uuid": "9b6d6023-d216-4e24-ae47-583027d3947e", "comment": "Malware payload", "value": "eab84655059f00e3b5a7367fe8c59a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762842, "uuid": "805de7d4-78a7-4f62-892d-4b0ef24d98ef", "comment": "Malware payload", "value": "041a9ea0d4641f608f9a2c7d34b803de29eb1e8a6bcfb785814b279e96ace734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762842, "uuid": "a44db772-4d9e-4151-b95c-ebcebbdf8b81", "comment": "Malware payload", "value": "16d5a78faddf61dacb182913d4740adc10fbb8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762842, "uuid": "737654fc-d215-43f8-ac0c-95bc9b2120f6", "comment": "Malware payload", "value": "bf18db0356af933a8739d0911b8ba650cd88e4e256ecb4ef42628dcf29d30e38fabbcbf25e1ec966b88a0e7f2add89aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762842, "uuid": "4324bb2c-b612-49d6-b650-5ebdb1bf12f4", "value": "T109E5D700D701521ADDBB24E54AAD313DB14CDFE0131864D781C8AAFADBEAAF13E3559B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762842, "uuid": "0b75e33b-519e-4995-97b4-840939c0d1e0", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuq:rzC+CqfG2VcruFG2KAyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762842, "uuid": "46d1fb44-8aaa-466a-b537-370045ec2d76", "value": 3053834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762842, "uuid": "3eba713c-a442-47e0-bd36-5f4273d9f10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762842, "uuid": "dbe3af3e-15c5-437b-8969-534ecac11b71", "value": "eab84655059f00e3b5a7367fe8c59a08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209e2982-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745182, "uuid": "9069885f-bad4-49cf-8dd7-8161c7f2ef40", "comment": "Malware payload (Formbook)", "value": "e4b4f25fdbd4a82ef0df9076ec6dd250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745182, "uuid": "e06c6fd8-5800-4d55-894d-0e31ae0f7fd7", "comment": "Malware payload (Formbook)", "value": "0480f30f1070d12b3231c495ee15699f09049f1c5bc19e889ebd2f3571bd4ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745182, "uuid": "45bac2c1-a697-49a2-9c44-4c3a4976a34a", "comment": "Malware payload (Formbook)", "value": "35a27a55da6c5c6c65292289d95469cd4ec0bff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745182, "uuid": "0ae3cf72-9dc6-43ea-be75-1593c8d047c8", "comment": "Malware payload (Formbook)", "value": "5b3236f5344c9fcd325c936115f7fd2090d73396300172ac94384c77822ad97fbd5f79c996c540976be253d2789520db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745182, "uuid": "617cc050-f628-4927-979f-aab3c7392afd", "value": "T1B8E4F1C126988D15F66B5FB94AB3E63803756C61EF27C70918E01D8B7C66B827B01BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745182, "uuid": "ae839ad5-838f-4439-92d3-99b1568ee23b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745182, "uuid": "88fe8254-9f0c-40e3-8cc2-bd612405455e", "value": "12288:ptOFx0YPX/NqPsAogO01MnY7Zzrgb7Siqumatg8BaNd2h/:ptOwHPsAA0eGgb+iquBaNG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745182, "uuid": "93e5e194-8b5e-49ff-855c-fa11c69cc33f", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745182, "uuid": "c8a30171-b5cc-4272-990e-ceac90eca19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745182, "uuid": "3a44fc59-112d-4a2d-8221-9aacf2b94fec", "value": "order specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2099da4d-f863-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684734015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734015, "uuid": "67fda02e-7a67-4d9a-813b-020744897b70", "comment": "Malware payload (NanoCore)", "value": "0b2e9388de88d69c1b256cc62bd00230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734015, "uuid": "d13741c8-84d5-4f88-a006-92d71758625c", "comment": "Malware payload (NanoCore)", "value": "0491bc38e6e0832364a57ee8264c6e7ae42ba800abe522292c8b3c35c1df44d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734015, "uuid": "b6f15cd0-fcf3-4926-9564-c14cf36e761f", "comment": "Malware payload (NanoCore)", "value": "58f3b313e7e465e2b00ee7597d8f7572c2e4a16a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734015, "uuid": "3392abaf-d7ff-45c6-9a59-f7d179588f44", "comment": "Malware payload (NanoCore)", "value": "e2cf1fefbb77ff24708b6fa5f9662130250fb8b1510f13311383d5d4fbbfd4fe36fde15591beb6e231a024581597561c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734015, "uuid": "6f53e8cb-ff52-490a-8662-26938b3fe06c", "value": "T1C9E4F1D116844C11E66AAFB94AB3E27443B97CA1EB23834D68F86C8B7C55BC13B117C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734015, "uuid": "3b4f9223-7cc1-4bd4-85c0-1f95bcfaf328", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734015, "uuid": "afb7ad07-cf76-4d42-9fb6-a4da078f6dc5", "value": "12288:Otvx0YPX/NqPshSI8+hIpg2txk4gFDgQ3FctNr01FMFpi9m541adoVepv/2T:OtKHPshSehCtycNtN01yC41oVes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734015, "uuid": "7d4b6c91-f126-442a-a20d-3ce0852f0b8d", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734015, "uuid": "fe44688c-50d3-4475-ab26-102cb1d4e762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734015, "uuid": "7b799739-9d7b-4608-b1f4-d9077b4ee12d", "value": "RFQ GIFT (Tender Closed Date. 25 05 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb9a1b4-f8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackGuard)", "timestamp": 1684764528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764528, "uuid": "3342f622-d28b-4bd4-bd16-4a302cb1711d", "comment": "Malware payload (BlackGuard)", "value": "44b65c0e74a1c608b202a663318f966d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764528, "uuid": "d9598c0c-4899-48c8-a146-78f733d7bb83", "comment": "Malware payload (BlackGuard)", "value": "04fb545df05912be1228df1958e6e60ffbc745ce3377162117b0ee59bb18a6b2", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764528, "uuid": "b7553277-6b92-4bc1-9000-f4ebe15bf2eb", "comment": "Malware payload (BlackGuard)", "value": "dfb026a22e11d8c50305a8cf85b911aed5e5f7e9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764528, "uuid": "63e300bc-7202-46e8-84ef-973846f2b658", "comment": "Malware payload (BlackGuard)", "value": "9925d834199ea59e6b4ed3e9c51277e474225477133d3111ee84e48477fe99233ba08c10305d328c31136e1b30e69352", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764528, "uuid": "36a4a65b-2cb2-497f-b6f8-38f61283ad3a", "value": "T170F52314ABD96609E33F99B5E4B284504A73FD236530E34E8DC5A0CD2E72B44EB167B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764528, "uuid": "3ea35b27-c4fe-4da2-822c-3cf0a3631b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764528, "uuid": "5c2e6fee-a68c-41a6-a3bd-1cf650d67e49", "value": "98304:aQBNUcwti78OqJ7TPBsHgMWJ0bJpqcV/:9zUcwti7TQlsBWJq1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684764528, "uuid": "b432321e-b2b1-4389-86ac-8214ab1aac0e", "value": 3511296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684764528, "uuid": "1b64d1af-0b09-44e8-8e45-2076db88b805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764528, "uuid": "f8aa0c0d-fc82-4606-b930-d667a2a68f37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f990d3c-f8c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684777822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777822, "uuid": "7dee4fdc-6f1d-4d47-a82f-852458072599", "comment": "Malware payload (RedLineStealer)", "value": "f252f506f84914c3886e791dc984c9e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777822, "uuid": "14e1c701-d1da-4951-9849-b607cb681955", "comment": "Malware payload (RedLineStealer)", "value": "055e57a625038b3082161f3e2148a5fafc6f767298cd9ae67f5c1cac9ab71dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777822, "uuid": "cd23efd9-ea31-4181-8c70-2df2c52dc730", "comment": "Malware payload (RedLineStealer)", "value": "62dab96df46604f04cd14ee24f27e32840809722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777822, "uuid": "46ae5059-5ae8-403a-bcef-b7af52f8463e", "comment": "Malware payload (RedLineStealer)", "value": "84a02a5404585545ec0054ce4ac0bb638bfadb622ec7381e5a810c560957770dd899864ce5daea2e9ac681e16a3f3df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777822, "uuid": "828d8f68-50dc-4046-9917-8572364191cd", "value": "T189959E0078C1D432D8B314720BF6C7745B6DB4620B5A6AEB67D72A6D8F202D1BA33B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777822, "uuid": "da9937c3-b19b-4d4b-b02f-9b2cf995f6cf", "value": "1760ca228d5e3c2945fdc472a803bed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777822, "uuid": "9f57ceb4-314f-49b3-a1d3-f907301df246", "value": "6144:cG5aR292nLhb3ZDcJbmiRBAOb9W4YbPg02ytpRlt:vaR2knLhJWBvWxMFAXlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777822, "uuid": "ad1daed5-fffe-42c6-adf1-8da64c720613", "value": 1909760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777822, "uuid": "d30038dd-e436-46e4-aeff-6564323c294b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777822, "uuid": "0ed6ec06-4ece-4f16-8380-22d23038cf6b", "value": "Electronic Deposit Copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943dfcdc-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684752677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752677, "uuid": "256a1f8e-7ad6-459f-94b5-ff8818e565b1", "comment": "Malware payload (AgentTesla)", "value": "8635d6918894eb9bc88493e8417d472c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752677, "uuid": "a642c64b-18cd-49be-ba44-86db2766ba4f", "comment": "Malware payload (AgentTesla)", "value": "061f8abfc0e824b3fb3c45acdf6e050f942db15c8900b8a9f58c12286e68fe47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752677, "uuid": "b56045e6-0459-47f7-b193-f696f32087de", "comment": "Malware payload (AgentTesla)", "value": "b8ce092048720812b5e3d50119a0dd6fe4d201ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752677, "uuid": "4d958829-ee59-4af7-9354-df8c08e75721", "comment": "Malware payload (AgentTesla)", "value": "d17cbf5bc6e100fdcdbbf678e54ae234cba10dac7185c66daf9ee9875eb88a75198045ad65337f351f8e06234fe02cb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752677, "uuid": "7d7001e9-0937-4797-9074-5d6aa3fa9710", "value": "T1B4E4F1D126C44C05E59B6FB91AB2E23803756DA5EF27D30D24E42C4F7CA6B827A01BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752677, "uuid": "357837eb-7d4d-4b15-9312-724eb93c2577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752677, "uuid": "f3216ece-76fc-4b27-b8a3-3c93556ddf75", "value": "12288:lTbx0YPX/NqPsP1Jf0ckuGkUMtEoHkYsqucin2CsCVj5:lTOHPs9ZvUM2LqEBsKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752677, "uuid": "8fba7499-6af5-47b9-a722-4bd94d4a7574", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752677, "uuid": "82716c15-f889-46c0-811c-70a3ccd6e0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752677, "uuid": "02ea7fcd-3a27-4a29-8ea0-a7cd485f9231", "value": "PO 4000101479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34de6fa-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738609, "uuid": "ff7e9cf2-9347-43f3-b452-b96515c2605d", "comment": "Malware payload (Amadey)", "value": "a28e356204af52a847b25c124791e63f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738609, "uuid": "a32b4d63-e3c4-4a81-a52e-4ef40ed1129e", "comment": "Malware payload (Amadey)", "value": "063d1fca062fb70f88b28652792f9c94aaa4b7acc2aa58ebab8d1dad800efe28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738609, "uuid": "dcf28d34-5bfd-4228-b09a-e0d38582c568", "comment": "Malware payload (Amadey)", "value": "6bf06b7b6762e301dec2dccc6fb96ccf9119db28", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738609, "uuid": "1ef02398-5476-4599-ab40-348537290c65", "comment": "Malware payload (Amadey)", "value": "2e7a56996ce04db5a42e54c85df70cd658c03fb6e9b331e0f302b6e1a7eb2c170d444264f30a8e7e7c81de6261bc099f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738609, "uuid": "9e4de97e-a2ff-4f54-9c79-010353077df3", "value": "T10D252363ABD58532D9F0177044F217830B32BEB05878536B6B54391F8DB26C4A676B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738609, "uuid": "e6190644-3e66-4fba-94ff-a246b33fb5ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738609, "uuid": "c0940577-d33c-414b-ba46-51665e35bb9d", "value": "12288:DMrjy90WOWVKUhY3MaxRqIfmqVWxrN5KXlggp0PQWgUnW4WZwWMU/rYTXjXEfUiF:UyDK7hLqQVW7Qggp0xgUnWfZw6sYUiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738609, "uuid": "1a707028-a006-4feb-a35f-87175499e019", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738609, "uuid": "b9193251-dc35-41d1-9c97-e06d9b728d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738609, "uuid": "b8026dc9-30d5-4292-802a-d3da00546ba6", "value": "063d1fca062fb70f88b28652792f9c94aaa4b7acc2aa58ebab8d1dad800efe28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e3f152-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745942, "uuid": "82b3ba90-2e6d-434e-b488-070a4b93e04a", "comment": "Malware payload (RedLineStealer)", "value": "7e4cbc0b5b2c7420dc89ff74b5cfe229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745942, "uuid": "0270fe81-1420-4624-ab3e-3643d5ab5595", "comment": "Malware payload (RedLineStealer)", "value": "06888515fa289da2d63fff92fe3c17efb0f35409a2a19df9c45b705ff5fdf4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745942, "uuid": "44428afb-5f27-4d2f-929b-843969f3d3a4", "comment": "Malware payload (RedLineStealer)", "value": "c06febbc19d31b8fbe6719540e2e3eb794ba45ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745942, "uuid": "245314e5-372b-495e-96cd-f7c4b7c3a489", "comment": "Malware payload (RedLineStealer)", "value": "3f6a37304e5507d61e40b574079b224e54a4d1bd599af3cc203bde6da96930980bfbf6b5948253350c66412469c37a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745942, "uuid": "ced01d02-d128-48ac-bbf4-23f6f0928272", "value": "T1C0252312ABDE04B3DE7127B05EFA11D71E32FD608838965E37849D1F49726A4887273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745942, "uuid": "9af7e11a-3c12-4eb3-9482-b4f8495a1b32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745942, "uuid": "4cc18bfb-2f48-461b-8789-6715b458933b", "value": "24576:nyhx8JI5bPOiq9dLzz7vo+aIJtPFrozG/ZF:yjkI5rOiqfHvo+acFuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745942, "uuid": "4dea9172-2ae0-47a3-b90b-a8875e577277", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745942, "uuid": "56956d19-7eed-4685-be76-cd2c6ead9c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745942, "uuid": "9a878604-6bd8-48e5-8d64-55e25db0d61c", "value": "7e4cbc0b5b2c7420dc89ff74b5cfe229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c4acef-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737406, "uuid": "c80a741e-7174-4035-9310-a07d70f18191", "comment": "Malware payload (Amadey)", "value": "34ebde00807d6763e6a4371a8187e81b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737406, "uuid": "78875338-e795-481a-828c-288d4bb1aa3f", "comment": "Malware payload (Amadey)", "value": "07a1878ca14469f06c3abfdc9df9af655f776ae76d790e3a90f888b3b049c726", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737406, "uuid": "1ba7cd35-6062-44ec-8871-03b2b8590453", "comment": "Malware payload (Amadey)", "value": "03893273b15834d66a151c5f0d3411fbabd13736", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737406, "uuid": "6afa8d06-c084-4bce-8dd8-ff94bc2b5e86", "comment": "Malware payload (Amadey)", "value": "752f37388eb8927c0955242f0960d6362fb880ba6c26c23fac2ba79babd206abc8a2cc645a9295b6b6fe88633cdbc78c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737406, "uuid": "81fac9c7-1027-4d6b-8f14-0cbf5e188429", "value": "T171252312A7DAC072DC7527F08CF503C716327CF1586D531B664AAC9BAC72A84A532777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737406, "uuid": "3aa4b4b4-e973-4ab2-86e1-955380ec8388", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737406, "uuid": "06634be4-1fc5-4de3-ad4b-25dd7cef0002", "value": "24576:EypsyZZK0nEfg1/kTdx11e1NYS9JFR+W3HPR/VdjvVtitw:TpsyUmMDfeQ8R9tdtit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737406, "uuid": "3a311a1d-966a-41be-aa4e-1dfdd1ff7e88", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737406, "uuid": "36a03ca2-3434-4036-bdef-eee043511059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737406, "uuid": "a1e01c48-8f01-4390-952f-892311c14af7", "value": "catalog186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43e3cf6-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738611, "uuid": "cdf937d9-fe9e-4332-8141-ee6514521c17", "comment": "Malware payload (RedLineStealer)", "value": "ef4c0e6168b05847b113afe18937ddbd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738611, "uuid": "604cf60f-0939-45b1-a773-3455cb2ad598", "comment": "Malware payload (RedLineStealer)", "value": "07ecbacd9e4a498e72af8af9ae87bcca206c16692c8eddce57aea7fb2eea4e27", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738611, "uuid": "3359d7f4-2b25-4f1f-a135-2377de081423", "comment": "Malware payload (RedLineStealer)", "value": "44bffc5176c2b7961aa0cf2b9e37fcdea154fe87", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738611, "uuid": "70326f7f-f912-4105-89bd-863bc4efa5c9", "comment": "Malware payload (RedLineStealer)", "value": "fd6eb6a4ab5d1d8515e638610688b16ef6024d2d871faabb5cafb5c87429ec993ff215124ee4efa52f9a2dd9cbcff218", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738611, "uuid": "590d2094-e664-474a-84a4-36be14b3a84b", "value": "T12A252302DADCA071CC7467B008F602974B3B7C955D209B6A278D6E566C73B90F83A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738611, "uuid": "570384ed-009f-4468-a5c0-ec78b295ddcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738611, "uuid": "c22720bd-0b3e-4838-ad23-9fe94229a78a", "value": "24576:4YyohvzLj9BOgjH1qyJxsrJ7Z94NvEWo8h5G4K09cOFo66J1Jli9s:4fAzLjK2qmg7XYv1JKv/JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738611, "uuid": "285239ad-e170-44ce-a587-be003a1d17a4", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738611, "uuid": "06dd5964-781a-45c9-9428-13e22b35ffbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738611, "uuid": "0c685f6e-419f-4bb5-bf81-9d93d15f6d21", "value": "07ecbacd9e4a498e72af8af9ae87bcca206c16692c8eddce57aea7fb2eea4e27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e2f54d-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1684762660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762660, "uuid": "56e8bfd5-607b-48bb-b509-7cfdb79a6d9f", "comment": "Malware payload (DarkCloud)", "value": "9a9917e4b7e7c7bc9c301ac03a4b0d89", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762660, "uuid": "2637389a-1187-46d4-8470-be028e2f5fef", "comment": "Malware payload (DarkCloud)", "value": "081d698ce05d76d8762d9f725143095a0c3ee39a663c08e4523e951dfab93507", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762660, "uuid": "d4ce8ef5-c106-46ba-98ff-51707db2fedb", "comment": "Malware payload (DarkCloud)", "value": "7e45982a781c8fdd2a97d7e3600f75d945dad71f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762660, "uuid": "545369ba-cec4-49ed-a9a0-5ee2164c3f05", "comment": "Malware payload (DarkCloud)", "value": "cf33bd69db23c61d8f83f4e5e43305adc263373d59022f82896fbec6515375e3efe91a61835170179c36b04a60602bc4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762660, "uuid": "d98c7ef2-60ce-4953-be0e-a0096d146eab", "value": "T12D842310D289E8F3D1B317310BBF5763B9A1852518B0AB8B4B80DF0C7A762DA3B153B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762660, "uuid": "af321857-13dd-43a1-b84b-c52279b80711", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762660, "uuid": "53dbd80e-46af-4ca8-8b51-c7e4b1341bd6", "value": "6144:vYa6UamiPBqT0E/HSxtrH5ki2sT1119fs26msLkOXvr4k+4L/MTDr5CFxabuHfeI:vY6amipqb/HSxtrHx1Lsz3/rYgFZeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762660, "uuid": "06420f9a-6d86-4f02-b89f-33a53c4a1def", "value": 401596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762660, "uuid": "a71fd51e-e432-4e55-9019-4235beacdfc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762660, "uuid": "fc724f5a-dcb3-44b0-ab39-e0cf645643f7", "value": "Slip 22.05.23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db6cca0-f879-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684743593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743593, "uuid": "dc45b60b-1e8f-415f-b5d6-db724f0cc516", "comment": "Malware payload (RedLineStealer)", "value": "be5e519437339f6fb0349d9c70f82226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743593, "uuid": "94fc542a-7af0-4714-a8d6-842815cf9d59", "comment": "Malware payload (RedLineStealer)", "value": "08b905c737f47d35625855d4b79cfa250353503d4b796dbe989e93bfbe119e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743593, "uuid": "08943f58-6ad6-4304-b264-bd50c02701d6", "comment": "Malware payload (RedLineStealer)", "value": "8d76da256096636c5b9635b1066af04105d260d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743593, "uuid": "61b85d22-0ec3-4b36-bede-7f7a892d7b95", "comment": "Malware payload (RedLineStealer)", "value": "10243374fd8d2bd6482a0c788927816949adf3937be835c47a5e34315c9f4936b3bfeff733bf0d97cbe8239d71a2d149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743593, "uuid": "d2f1c965-6854-4c36-bcfd-408c1a08c586", "value": "T18525D59C726072EFD8A7C572DEA82C64FB6178BB431B4207A02715AD9A0D997CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743593, "uuid": "dfb256c8-f767-42d4-84bb-af034b51e3a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743593, "uuid": "eeb4ddda-cff3-495a-94ef-b889c45effb9", "value": "12288:ioctx9C6SUMM9Q1IzFryXqme47HdqJbUp6tqFEGoiLVpwvxOgON0R6hxle+6J+Ap:iocpOsQupryamP7Hdq9tICGr/wvfUQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684743593, "uuid": "b5d101c3-3593-42ea-a416-e32472d8ea5f", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684743593, "uuid": "904d2090-df3f-428b-8967-200793eb2aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743593, "uuid": "2ffec9ce-aaaa-4aa4-9cb1-b2ab514cfb7d", "value": "InstallersOSIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125dbeab-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755895, "uuid": "86a72a9d-84e9-44e1-b25c-e8ea9917b778", "comment": "Malware payload", "value": "687dea117cf9568b5df6a3b7f6fb69be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755895, "uuid": "fb207e4a-732c-42a2-8458-f3900e27918d", "comment": "Malware payload", "value": "08e9cdd512ae5f6dff24ebcaf53c5425300b79d69f8cf32e617b2e8ed90cf3fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755895, "uuid": "9a53581f-348e-4d3d-a57d-e325e6c4d5ec", "comment": "Malware payload", "value": "7ce80d8593e3b4bae1331f8e2d1b79ba0b160411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755895, "uuid": "658f8084-9429-491a-9a8b-d6502220d0a4", "comment": "Malware payload", "value": "f0c7f3c538406e8dfbe4ab5ae991db885cc3acfee3d8ae937a0c05483a4ad6d6d97018a5184bab1f8c726b0e6e092b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755895, "uuid": "d1194cc9-af4f-4bed-9a54-369cb9df48d5", "value": "T10F12088BF365DDE5C4450E74DE27C4709EA3BA210ABA4185BCA53F6F7EB7295040D311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755895, "uuid": "e6d79374-9fac-4a8c-bd36-c3e3da6d6bdc", "value": "309298478920a0e3ef612995efba0a8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755895, "uuid": "1da05e23-f4b4-42e1-9eaa-402bbb6acf1c", "value": "192:X5vX9kJiDd4/GLeRFJma9Wo1mqmBv3h+m:vfC/SeR+StwJEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755895, "uuid": "cc3167d3-6a3c-45f3-97b5-0cb01031e9ce", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755895, "uuid": "a8126ddc-8618-4253-948a-68c5860ce0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755895, "uuid": "5718599c-1e92-4994-8143-159076a38b7a", "value": "SecuriteInfo.com.Trojan.GenericKD.4899399.24575.3462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb9c5d3-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684762648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762648, "uuid": "507759e5-e5aa-49b5-ac19-dd963bb9eec6", "comment": "Malware payload", "value": "b55c2addbf3dab4824c5f95263513f3b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762648, "uuid": "6bca5f4a-73e7-493c-8204-afbd0dafc0cb", "comment": "Malware payload", "value": "0913558b659789ebbbeef75a08621b8a78397da963da39bfb00fbde8e9ee28cf", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762648, "uuid": "2a6f68d7-6aed-4ae5-adc6-2151c2b188a4", "comment": "Malware payload", "value": "70ad09404a58df5c8683db10e4f0b891494e02af", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762648, "uuid": "ebd1a1af-55da-4c23-9e2b-0ed4e82e6977", "comment": "Malware payload", "value": "73682e699b59d2650f329c9feac3f22dac347d35630f1868b93f1a1052ee126cbf9cef68a6f4bf1ddf2ff0f1dac6ae5e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762648, "uuid": "faafb548-ca15-492c-8964-0e44da1df671", "value": "T1B684DF03250C9E8BD242C3F12F9B7D9D2649BE61A6C536D6329CF78F1B7061A688711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762648, "uuid": "cfbf4079-205b-42a5-9315-059e270a32ee", "value": "6144:xWaFJkKXiDU7w5EIT/qGKdAkOPWxkDB2OcRk63788tWYgF1KkSphPWxIHZWRC8ec:xWaFiKXKGi/6dArD8RRk6rKUrpoaW8xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762648, "uuid": "f7ff00bc-cddc-4245-a93a-41dd79d873af", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762648, "uuid": "4a354b83-7d62-4388-9c0f-49c75e43f848", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762648, "uuid": "5e944db1-32cb-467f-92cf-98d920d4d4e3", "value": "New Order YONGTIAN_Electric Hoist.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886cf02d-f8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684787876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787876, "uuid": "07dee9a0-5b22-43e5-a352-44ad647b8453", "comment": "Malware payload", "value": "c6fea3621cca858371f2d596c9723891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787876, "uuid": "38fd661a-40f9-4a37-81f8-8c4e69d8a8d3", "comment": "Malware payload", "value": "0a4d7ed03798e5257a21afc76553e538486316389bd54c9b9bcc03699ae21cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787876, "uuid": "6eb39e1f-0594-4fe1-8e54-baa8ef2d74bf", "comment": "Malware payload", "value": "48a23b6c768a4a4f8ba2864159f959c0e025f08a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787876, "uuid": "c3385f17-8dd2-4c7c-a54e-f64e6302ed72", "comment": "Malware payload", "value": "ad0a3703f47ba058769a74d1eb4b5b60169e22b9a1a9d37a563fdd283cdbe1bed9ed07d4b0f1c180b75b06abeebb36c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787876, "uuid": "04ca9bb5-034d-47f5-92e2-9693c0ed3fc1", "value": "T12DF4E1E0775CA005E8395C31C8C596B416B1FA25BD1DDD2738B8F9818BB2242FED668F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787876, "uuid": "e343642c-e30c-4254-bdd6-9393db1e1a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787876, "uuid": "a4d47da2-33ea-4a0b-ab30-4f4559c66580", "value": "12288:9ZZYXK0z6bPETqd/a0hQ6o0No0mo09dCAMdCAHdCAwrH/cfwwGHCfu1eUgzpCGKD:9cXKp2b0y6fgli7vwPifu1d0yQ314", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684787876, "uuid": "ef5a5a44-cfe8-463e-9836-d1bf798eda43", "value": 787496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684787876, "uuid": "841b38bc-1804-42bc-948a-48f0b33a9ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787876, "uuid": "70857594-8807-4067-8dc5-103bc0e2eb19", "value": "gookcom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10999fc5-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755892, "uuid": "0eafd239-217c-43c8-bb2a-0c6a6c4fe61f", "comment": "Malware payload", "value": "d2fe835f5638857620ce7ff07f73a8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755892, "uuid": "6968447c-c52c-404c-8308-762f4e307fb1", "comment": "Malware payload", "value": "0a5a92b8eeda621c3d9c9aa8d6e44b326bed58836d4367ffbe81396339f5e0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755892, "uuid": "a3b29bb0-4174-4fc0-8ebd-7724d3d90664", "comment": "Malware payload", "value": "601c939b7d152c2faad2e0703bcd918018e9ccdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755892, "uuid": "0b039da1-3dab-4941-9bb6-7fe69a6b594e", "comment": "Malware payload", "value": "bd3cccb9626b7cb51bd3b88e1f8314c666cae4c63876caff387c278f28323195e6e8e2902cbe3b37b37ed7fecaaa7a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755892, "uuid": "f2ec806c-8e94-408a-9a78-898613926242", "value": "T14C13CF7B26C2C131DE884E3469260DAEF125255123D5B2BB4B912CEAF434DB28F5833F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755892, "uuid": "494ba00b-f8bb-41f5-aac6-4348bb2d2b0f", "value": "384:/7MvIvRgo2yxsortxFPaMTOzkb5MmV+VfjtvdukM9JKbt5rnyxWXHSwg6/2W/:/7xRgoHsorjVSVukMGpZM8U6/F/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755892, "uuid": "8c636f8a-9687-45ac-84b1-113c6fa2d9d6", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755892, "uuid": "2e7917a1-5088-49ee-9251-dd743397a203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755892, "uuid": "4691b3e3-e9da-4f68-ac58-03fc7a9b2f8c", "value": "SecuriteInfo.com.Win32.Evo-gen.31391.1030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e696497b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752386, "uuid": "77148a06-7213-48f1-8821-95eb18151c3e", "comment": "Malware payload (Amadey)", "value": "9394761dc7d085b637323d63b183f08d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752386, "uuid": "4462eebf-f30f-44ae-9db7-69115d71a6db", "comment": "Malware payload (Amadey)", "value": "0acbbfdbf42591dc294a0f7f2eff7d3a63bcd95da911e61744d46d41f79a12e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752386, "uuid": "9aff7211-1107-46ee-9437-ff0480cdf76a", "comment": "Malware payload (Amadey)", "value": "2e33acee54ea0ef8a29e7b5c786707e79ad1a917", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752386, "uuid": "f4725ef5-314c-44af-aa97-1bd650e264b3", "comment": "Malware payload (Amadey)", "value": "2e1c3791a5bb564e0bdd82919d2886cbe41448eb4c0994d042324bc3363bae9936b3a53cabb0e27739411a551e59db82", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752386, "uuid": "fc4d8d8e-f5fe-4319-8bb7-52cc7994efa7", "value": "T11D252342ABD8C573E8752B7444F607970631BCB3DD64C7A7331568098CB26E4B83A7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752386, "uuid": "7eb8d2b3-daab-450b-96a8-f23f7096f032", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752386, "uuid": "881459f7-56ad-4e7a-bee9-850c11fcf345", "value": "24576:/yTqxdGbvnvL5YaX6iRLGKY0taPBu/Ihc7eoUyMHg:KWxylqur50P8/IhwebP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752386, "uuid": "851c27f8-aea2-4962-860c-a51ab3ac6856", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752386, "uuid": "303293e9-a864-4e7e-89ba-b16550d65580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752386, "uuid": "05db9ab1-79ae-42be-9b5d-579522f90f27", "value": "converter430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd129c3-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752455, "uuid": "cc3675fe-cc30-4504-af95-ee98c46ecdff", "comment": "Malware payload (RedLineStealer)", "value": "85d3eed30201a15e926cdb2dee1b252d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752455, "uuid": "1fe523a9-d20f-405e-a96f-1f7cade70ca1", "comment": "Malware payload (RedLineStealer)", "value": "0b68f41d8bca944d34b08a139b5b772e8ef672bfd113d0f8214b54b9f602cc28", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752455, "uuid": "8a41f0e5-e635-4c05-b526-20b7050fb51f", "comment": "Malware payload (RedLineStealer)", "value": "14de8bfb04f818c2bb9dda20c1e929779a8eac54", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752455, "uuid": "5c3fba43-9c7e-4353-9d0c-5dc08f1fc64e", "comment": "Malware payload (RedLineStealer)", "value": "77cb5f4e88709fd5df1e45fc362e718f6f2b39afa022a9cde44bf8ed88ea729c601f8783eea4c1381538ae39c9883ac8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752455, "uuid": "c35f810a-8274-4abf-8fb9-528e3cf4b7c5", "value": "T1ED2522439BD88473ECA1073058F712D72A36BD904E2493773B9898252D727C4BA35BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752455, "uuid": "0134f16c-8347-49c2-baeb-f7812763c30b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752455, "uuid": "20273962-91c4-4ef7-b23f-d8e8de83339e", "value": "24576:XywnF463uVUCpjcjqWAM4Bdy/nUni155nnCOwcHTZg/v3zU:iO463u9jcjqW34BwUnilnn3pTZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752455, "uuid": "0481818c-f73e-4834-98f4-a16dc1aaa581", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752455, "uuid": "10747fc2-9901-4d44-b7a3-1dfb6526d684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752455, "uuid": "1a4a2860-f373-458b-a699-d7812f5f1b98", "value": "helper574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d79ad0-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738612, "uuid": "d40e3e24-4ed9-4955-8e90-ee1554e442dd", "comment": "Malware payload (Amadey)", "value": "045315f00912b8ed9c29d81c77293d25", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738612, "uuid": "093336c6-982a-4eba-b78d-4cc92b0bd13e", "comment": "Malware payload (Amadey)", "value": "0c556f4411fe979215dab0e8f7914e56955a85f9a328f80f1ba65b2c4fb96d8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738612, "uuid": "ede5a377-a055-4443-b46f-c1389aa0bc93", "comment": "Malware payload (Amadey)", "value": "c4b0ddfe4530655a164da426defb606d8265ad86", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738612, "uuid": "ec052a41-8552-4ac3-949d-6fc85dc35cd6", "comment": "Malware payload (Amadey)", "value": "66d9cdc63051ff83d3ddd46812f2ae5f61859c1cb2365ba9e7cbdc559a01eb6eda0462930eb565a5ac03373a98e42462", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738612, "uuid": "eca4107b-7f2f-40bb-8dd5-0a35a644ff85", "value": "T12A25238BE7D88023C97633B52CF612830B36BC525C7497B71B7695935C72E84A872B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738612, "uuid": "119ee20d-6674-4736-bafd-87a359c9ed82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738612, "uuid": "f2dbc99e-0d40-4719-8bb5-e06ffd29b716", "value": "24576:ey0dfS0lGPzTqoyKVUbID/ikkMNEzLJSEbHPbh:t0df7lMTqoxuY/nNEvEEbHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738612, "uuid": "0d2da137-695d-4fde-a871-e3c10f8dcff3", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738612, "uuid": "5e59a8cb-1f02-41a1-9357-b67dc2b238de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738612, "uuid": "85ea09a9-7875-43e4-9b13-2df3dcb58b3c", "value": "0c556f4411fe979215dab0e8f7914e56955a85f9a328f80f1ba65b2c4fb96d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8df2e4-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777223, "uuid": "56058311-72e0-45c3-a3e8-55d89a4b6633", "comment": "Malware payload", "value": "60434a5e50ad499764a8a303a5e0a571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777223, "uuid": "b4c4397e-b906-4143-bbab-049fbcdf5b7e", "comment": "Malware payload", "value": "0cbda82ea8fd76f73e67682f91e9526ab3dc06163964228cd16c91ebd1a521c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777223, "uuid": "b7520130-b0b1-4363-96bf-dfe6a2d1fc61", "comment": "Malware payload", "value": "772756a64cff6f7515d48a126c58995b8c4043ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777223, "uuid": "3f2928be-e3a4-434b-9c9e-a8834cb089de", "comment": "Malware payload", "value": "c8b477b515c3f0bdb1f6f3d7360f203496c0abf009d1c736a057b29350793578bcadca721d3f68cbfc8300c5cde4b9a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777223, "uuid": "75093495-3800-4edc-b573-549c872aacb5", "value": "T16AC40535E6B26367CB9418B2D495E6B641C01E8BC85EE2AB4354FF8CE13D188B713E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777223, "uuid": "d28c9679-8bb9-4ff5-bde1-ec0537ee403d", "value": "5e7b83e3a9123c6ae3bc678ef8b11ee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777223, "uuid": "39e84b57-f234-4a02-a7f4-5ad9b62052d0", "value": "6144:m1p9Ca5I3H6h5DnU/cM0FiGAn4Os8nZHysddKSRgivkQeasklRo:m1p9TI3ah5DnU/oOSD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777223, "uuid": "07814101-bf5d-4d51-b7d3-2f470b59de5d", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777223, "uuid": "be198ab4-aa44-46f1-9851-4c48754a3a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777223, "uuid": "ea406ed6-92ae-4d5f-badc-2e177705bac5", "value": "SecuriteInfo.com.TrojanDownloader.Banload.26499.27375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65683c3-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745970, "uuid": "c1f2357c-ea71-4144-8ada-7419d307769d", "comment": "Malware payload (RedLineStealer)", "value": "15a48553a74e44812755aee8da63208f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745970, "uuid": "1df9437c-a937-4517-874b-be119221a8ce", "comment": "Malware payload (RedLineStealer)", "value": "0dc47812b516238a134db5d6a17092104d909e7487f4a5fa05dcae981b42d262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745970, "uuid": "53346c39-a594-4375-bcbd-3079863bfe32", "comment": "Malware payload (RedLineStealer)", "value": "fb4b9c5e15686061f5ce44b9fe7bf3582cccfb67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745970, "uuid": "eff89509-7137-40a9-b30e-c50cdc1e4fcf", "comment": "Malware payload (RedLineStealer)", "value": "6b1f7bb01a374e930bbc76f93860d3ffa65d8d92fecdd6509465951b4367e9edc3c1e287895e72af48fbb83d9594fb19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745970, "uuid": "08fa6547-0b70-4456-8d15-6a7bd916f0d7", "value": "T152252303AAD95077FC78637058FA1B831B31FDA25DB8536B2742A91B4C71B90A872737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745970, "uuid": "a2388bbd-63fa-42ef-bdb8-327ad0708300", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745970, "uuid": "28dc19ec-6acd-4c2f-946b-a2439a8730c9", "value": "24576:1yqQiv1OZj0NRqYBvk3wUEQ5xEAB/mCWOCpJlR0db+:Qhi9OZj0NRqR3w05xZmD+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745970, "uuid": "52dfd331-7773-446d-b1d1-0328ecb4db62", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745970, "uuid": "e42e416a-e027-4afa-a81a-81c1487169ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745970, "uuid": "573215a7-4942-4885-b3ff-b90bd14e7372", "value": "15a48553a74e44812755aee8da63208f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91675d4f-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684745371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745371, "uuid": "e0ecb5a7-7f87-49d4-bfb6-63c9efa0a32a", "comment": "Malware payload (WSHRAT)", "value": "df16341b546c4513907c10ebe3e5baed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745371, "uuid": "9c8912c5-06f3-4a84-8099-ce4556011b34", "comment": "Malware payload (WSHRAT)", "value": "0f860c0525fc35fafd22e282bc67c688828db9b53b1fb372f8953a2be5fd6f06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745371, "uuid": "6405a8ce-f775-48af-b679-8a8f68c52f12", "comment": "Malware payload (WSHRAT)", "value": "6a36f75cf6f766fe916479f293424bfeb5e22fd2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745371, "uuid": "fec25851-e19c-4f5c-89d1-8de7fd9ee3ad", "comment": "Malware payload (WSHRAT)", "value": "e1cfe18c2aaabd42a7f43128240045f2c7fab8a5934124f38215395ced5295c3f9cee319ee2c59884a5ca4cce74878e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745371, "uuid": "dcf8fed6-50c7-4543-af03-ca596528dca6", "value": "T19E1508C52AB8341A93B3F624C315E622AC34D8633DC726D27EC47F4D9E76E4415AEE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745371, "uuid": "47b71b74-f1cf-4dd6-bd61-21efda03977d", "value": "6144:QQ2zjyhcHCrvrmbQXG9q8liIszutQEHQEBkxkN23pHC2vyLfSjHvPcY/4JGG3Yc2:TWXa0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745371, "uuid": "e8c4f941-56ac-46e2-ba4f-43897bf0261d", "value": 944469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745371, "uuid": "71478795-5d31-4e55-9a31-9d0ef9c2fcd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745371, "uuid": "ad91ac89-a66f-4e84-be88-c4fa18843571", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed422ef-f8c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684775082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775082, "uuid": "297bc256-7015-49b9-b095-4711aaca9d42", "comment": "Malware payload (Fabookie)", "value": "b44b3fd2f45d55238c7e11df70148a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775082, "uuid": "4ec616e9-a81b-4b2d-abdb-ef7df49d6557", "comment": "Malware payload (Fabookie)", "value": "0fbeaa3d0492f83c2351aa8f91c429f063700d1fee4aa355e439c0862f6bb41f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775082, "uuid": "27546f0f-3b48-4a09-97f6-c4e7a966ea74", "comment": "Malware payload (Fabookie)", "value": "63134b1cb8aba77efe75d73a748a72c1621fb07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775082, "uuid": "56850556-a341-414d-87fb-27a03f70e0c1", "comment": "Malware payload (Fabookie)", "value": "429f081b9664f98d024a06fd09051aba491b244e06bf81699893adb55fa6c74fb4531193101a8c0509d6a688bd11f716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775082, "uuid": "9ddd7b03-605b-4eb5-94eb-88295f2938fe", "value": "T15E24AE80F391E195D54E8175C927CAB95262BC1C9A345BBBF294BB5F2D323C3403AE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775082, "uuid": "745b7df5-d26e-4d5d-aa85-996528fab196", "value": "b5bfd9f5c740d22e228bf934c6651a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775082, "uuid": "a3a08428-3eaf-4840-861b-0248289b39b2", "value": "3072:OPVosEAHkKqUa9antF5hvvJkeXp2QhHkKqUa9antF5hvvJkeXpx:uHEKq99UF5hvvfjhEKq99UF5hvvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684775082, "uuid": "0a3a3bad-0ec3-40a8-9127-693bc2a40967", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684775082, "uuid": "c068a8c6-0b2c-4a9d-9ced-2375abea95b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775082, "uuid": "bf44ee72-e03b-4664-b57a-5c80300c0b9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0478396a-f893-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684754583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754583, "uuid": "f69732ec-4d50-49c6-ad82-1bbb58efc966", "comment": "Malware payload (Mirai)", "value": "c6f2c08aa94ffbe16ef2ac0c9d9f432d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754583, "uuid": "dfeea198-a8af-40a8-805c-6bd91a951fc6", "comment": "Malware payload (Mirai)", "value": "0fe3eff4c19341fb5b6c1d34c5e5b77361bfebc845423e38a1b444be52a72354", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754583, "uuid": "a25b7a51-d0e7-4790-a2e7-66397143e641", "comment": "Malware payload (Mirai)", "value": "e91848c220e38d514e28c2e6e306b4f954815d69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754583, "uuid": "4bc545fd-b2ad-4ab4-a36c-e7b2a38510aa", "comment": "Malware payload (Mirai)", "value": "55fc8b3f897a3c70a53842c1e6af1b08876142f3b3e681f4a14c9c6b4bf277b2c4cdcaceb7fe388d0e202c63f92ce470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754583, "uuid": "806e1e7f-4de6-4e14-8c8e-5436ae7713cd", "value": "T1C0730981BC81A626C6D113B7FA2F018D3B1993E8D2EE32139D151FA4778AC2F0D67756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754583, "uuid": "ca61ea6f-1624-4ac2-8d4f-8fda00042b79", "value": "1536:FwCr2i2lEQgbRyNUGAtilhBVB+FSdipwBZxPX51ti33:FwCrN2NgbcNRHBpdiu3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684754583, "uuid": "8518ee85-c1f5-4598-b270-de72d62ce01a", "value": 79156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684754583, "uuid": "ea35a10b-d7d9-4076-9afa-73e5b8778717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754583, "uuid": "332a4d61-60b8-427c-8cc4-b72ea3bd0213", "value": "c6f2c08aa94ffbe16ef2ac0c9d9f432d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769a5561-f879-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684743608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743608, "uuid": "78de76bd-85a0-47aa-b9e1-6818da933bf7", "comment": "Malware payload (AgentTesla)", "value": "53d165d4dc599bb48b5f86c5ae2c7049", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743608, "uuid": "a4ef9e2b-f544-46fa-856c-8241f759bd2f", "comment": "Malware payload (AgentTesla)", "value": "1017578903cc070a31ef5c9dda946d8ecbcb1901662e170c9d057533f35b03fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743608, "uuid": "a994a0c1-100e-4f99-abc1-2fdd203a5dfe", "comment": "Malware payload (AgentTesla)", "value": "7e93e0821ac95cb1217507ef11dee38e0936df4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743608, "uuid": "4c6f7d51-fa3e-4bfe-8de4-93067834ad36", "comment": "Malware payload (AgentTesla)", "value": "38eff32d563ebec400b2b4ddbb0642c9757cae14b1e6e1217498ff25177a302733f103352a9281eb40e6bb9f7f9b3f40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743608, "uuid": "8f0f8c4a-9abe-4c91-ac54-1a0be8aad9fd", "value": "T1FD4548243DFA501AB173EFA98BE479EADA6FB6733B07645D1090038A4723A41DEC153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743608, "uuid": "3c4874aa-d60d-4412-b302-79a7ea61bd08", "value": "12288:2NuC/Qt/rjiMTGkR6HcENARLDK65zt9wT8jqttZWpfnkAicYzrhVzXz7csyBO2kx:1DBE8EA91XWrnb5LpDpP/NwB9qd91r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684743608, "uuid": "8ef34f72-a012-4e61-b32e-75d56fd237c2", "value": 1190800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684743608, "uuid": "cbdcf358-d147-44fd-823e-3ad4c782757a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743608, "uuid": "8787bdf8-478c-416c-b48f-e5cedc291ed7", "value": "QUOTE-272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4475d566-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737511, "uuid": "1dc29bc7-296e-419f-bae5-b398f04b6a81", "comment": "Malware payload (RedLineStealer)", "value": "5a6a9e7e01a43c35fc013782021a9fd9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737511, "uuid": "28cdafd0-1de5-41a4-9fac-07f667a1a718", "comment": "Malware payload (RedLineStealer)", "value": "1031e583bc60e585a75e96f87803e5f5b780c0ae237e189acf5239cf727732b0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737511, "uuid": "928383d8-0f16-4a63-a622-b7b3185bb736", "comment": "Malware payload (RedLineStealer)", "value": "5c0fbe4d38e034a8b345f2682a0f6a089f20e7a7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737511, "uuid": "ee5b040d-70de-4a07-8f4c-c1201f39b8d1", "comment": "Malware payload (RedLineStealer)", "value": "6545fe84b9c45ab315eadf8f728de4ec49b2a0165d31aa93c589a218f854d0b4f41630bba2ea5ef417fbb37311a70617", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737511, "uuid": "2a7d1e56-5a69-488e-a43d-a7a0efd89b36", "value": "T12825230B72D54A73DCA717B508FB16C3073B7DA2EA64862F3741995F1C32288A97173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737511, "uuid": "20af9dae-2c52-4cfe-a1ad-7859b6b11b09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737511, "uuid": "7768a5e6-bdb0-4e85-83cc-a83894062d00", "value": "24576:OyLeU+7sj4tUf/mKtFu8qSWY3S5Xr9KJj6ZE40fKXkKXx0OEd:dQ7sdf/mKtM8qSWYC57ub9fwdxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737511, "uuid": "264ccaca-7ff9-4328-8ecb-16078836c151", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737511, "uuid": "4e49bb7d-db25-4360-8605-5199500b3a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737511, "uuid": "bb9f442f-6a6d-4a60-8a13-b0e00ce222ca", "value": "multiplayer525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32513df-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752326, "uuid": "478abfdb-d6dd-4ea6-be56-af9faae21d3e", "comment": "Malware payload (RedLineStealer)", "value": "cd8854ba747a18caa62e1b6ddc5e9823", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752326, "uuid": "cf5b9a4f-3b1c-445e-bc8f-f0ebdcf91348", "comment": "Malware payload (RedLineStealer)", "value": "107ab22045e2bc7676f7a900b99ebbc462412a6d2d55255c7848e008e496350a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752326, "uuid": "4ac7623d-dd0a-4b16-9e9b-7716ac986e7a", "comment": "Malware payload (RedLineStealer)", "value": "ac3fc5530946d3eba2115226377f0e8bf862cce5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752326, "uuid": "4c0f2358-5619-4ef8-bf89-b5cb63e5ed60", "comment": "Malware payload (RedLineStealer)", "value": "cfa9d4f77d2f6f4035100a0003e404c309ebfd16c449552d93ee8aa51d81ff572a50e381a4bc2afd87cdf526f9d3f240", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752326, "uuid": "bcb0d863-1e56-463f-8cba-e31bb9778313", "value": "T1C8252313A6EC5461ECF1537298FB01531F32BDE0CD78C71E3A84699B98B3584A67272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752326, "uuid": "9917594f-09f2-4d51-8fa6-d715b45116cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752326, "uuid": "e4c443f8-772e-4b8e-b1b6-e4b95d149006", "value": "24576:sydldPf3pBy3qzi03/YCPCJtaN3NsAfCIT5TlXpPuBvkk:bp3pBgqzd3w4CJa3NsY5pXBuBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752326, "uuid": "50e8c7cc-2cb4-4293-9385-0a06af9ab468", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752326, "uuid": "815c2219-a146-4e35-b276-c9525c3626ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752326, "uuid": "bec7511e-e995-430e-a90b-349c0fc0849d", "value": "agent652.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8691e5ed-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684745782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745782, "uuid": "a68b0ca0-891b-4a51-a26c-34418e4a86a8", "comment": "Malware payload (Fabookie)", "value": "2a6346b6a25af0118972453fc4ee739e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745782, "uuid": "d41d6a07-d0f8-4f2e-85bd-9315e2f66bd4", "comment": "Malware payload (Fabookie)", "value": "11c045290ca14b3648efff47a7615c52066f3867455f009f9a729e1a26b96823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745782, "uuid": "d42c1f89-3179-4eed-a892-13c5a2853cd2", "comment": "Malware payload (Fabookie)", "value": "625b85a647e1a564cbc868c596a255a902c97c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745782, "uuid": "84e2f2a8-95e6-470e-9aca-9ab18513c2ae", "comment": "Malware payload (Fabookie)", "value": "d1368e4bb00d0b563d51c52a25862dd49abfca787613ba7523983b2fb821f85eb3f5b0c2f5aea78e2c33c2f4985de866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745782, "uuid": "4731d3ab-f8bd-46c3-933e-9aebc594f9d0", "value": "T12A647C56F36540B7E1528035C993EBB2F6B27C562B20134F0790FB7A2F336626E29B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745782, "uuid": "e5521e7e-1f9e-44da-ac58-92cb47b1b4bb", "value": "279b8a26f65ef80b2fab2ffb5009e75b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745782, "uuid": "316a6f23-3cb2-40ce-bbea-69848186ca5a", "value": "6144:E/ji2H5h8XrWBoWL46JN6VWxtoloBj5rbx:Mb8XypL9JcVJ6Bj5rbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745782, "uuid": "4f0332ab-7afe-4053-8fd7-a5a37de4b1bc", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745782, "uuid": "d56482f4-285e-4509-a4c1-308a461e3159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745782, "uuid": "dad7e359-693f-4793-9251-47c17a983791", "value": "2a6346b6a25af0118972453fc4ee739e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839c16df-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684745777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "bb2730d2-cd1b-4d40-be4e-7f8e47cff751", "comment": "Malware payload (Fabookie)", "value": "0b465ff47cadb059338251bb1ebe5598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "3babd2b8-76a3-483b-ac1b-ac6f03a08b73", "comment": "Malware payload (Fabookie)", "value": "11d5862453a307cea9e7bd0ada50e4c882af8e5ee8d689c6557639f4a397289d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "40020040-9e33-4ba1-ac71-67851054a84e", "comment": "Malware payload (Fabookie)", "value": "44517fe1dfad40f3da83482b99cd546a63d8f83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "6df9ab2a-53c3-4b70-b8b3-583ae4088770", "comment": "Malware payload (Fabookie)", "value": "eea3c6e2f600bf0d6a69da7f04b99a9c83c085e45c61b92d0925048fd76aedc84c226aecc8adf127f3363f40cc7281f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "3730221a-6c5e-43e4-b2f5-ad328c0b4ed1", "value": "T147844A2DFBA84476D163C57FD9B2E665D77238916F208BCB0212862F0E336D49939732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "42bb14a8-66e2-4ad3-9a99-42a4228abb46", "value": "99782e0cdc1c7b57cdc2cde5daff70c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "e548c6ac-6b7b-46c3-a7b8-b0939be5378d", "value": "6144:iq3y9wUepfcisGiKrD8bFaggXWeuCvZEOHHrpm1XUZLxEZEOHHrpm1XUZLx:iA+wUep9vuChtLpm1EwtLpm1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745777, "uuid": "d3ebff27-174d-4207-bdf8-4e270aa70411", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745777, "uuid": "e8a5adfd-dc09-4f2d-adba-50918e6a6ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "a6742acc-5e0b-4e09-9d9b-cdb87df00091", "value": "0b465ff47cadb059338251bb1ebe5598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3afbefe-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744623, "uuid": "eda08af8-3916-4245-83a9-dd96eb2f055e", "comment": "Malware payload", "value": "c6826be141d642344b2962e8997f6230", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744623, "uuid": "85f28b68-5502-4869-b4e0-c2808219aa26", "comment": "Malware payload", "value": "12cebf313000936f495f8635ef791a7197c6059e301f109ed7020ae442f213fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744623, "uuid": "8b0663e2-2eb3-426c-a2af-8896428754d5", "comment": "Malware payload", "value": "699ad4acdbe81fb087ab180aabcd5eb7f0546bb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744623, "uuid": "1445735e-1ea3-4d1a-b344-1f978e0531e0", "comment": "Malware payload", "value": "1dc9b5d514884283a306fc995eb162344a656c6367da64dd4c4832953ddafa710de74742aaba468eea0b5f8c524496bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744623, "uuid": "b28bd22c-09eb-4b34-8cea-755e457bb645", "value": "T115C37C217194C032D1AE1539892587768FAB78A18FB468CB2FF41ABE5F642D1DF3431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744623, "uuid": "efd694a3-8d48-455e-ae10-c7ac259d3554", "value": "5a8c9a7aee9ffaa7416a80bb8ff9fc62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744623, "uuid": "93ac5099-1932-46d6-84e3-a6d76c216eb7", "value": "1536:6ik3l2sD4+yZVxx5ysWy3TyZr+nrArBMoxcPVAuUvYEloMEfVWnBTnBfJiotykJC:s2ssxV/5bR3GZBkVUvkMR5J5tyAQbB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744623, "uuid": "e2737989-3249-41b4-b04f-1064e1e2ca6b", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744623, "uuid": "3e7f1ad7-2ccc-4576-ac6e-c3877085d5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744623, "uuid": "0be90aec-f645-4019-a31f-b3e9ee3f5a15", "value": "c6826be141d642344b2962e8997f6230.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5e783d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752266, "uuid": "e37b42bb-3c10-479c-92aa-52174b0ebaa3", "comment": "Malware payload (RedLineStealer)", "value": "cd008c4f17b6cf3303dc76a271de2ee4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752266, "uuid": "0955cdde-a568-4294-a8d7-ffd24e685dcd", "comment": "Malware payload (RedLineStealer)", "value": "131f8eb1e8d8e1019eefc0a666a56095e00376406a9739cf0ed8e80879373df9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752266, "uuid": "f6c5a5f8-24b3-4e59-b3ee-bf8a334e15b4", "comment": "Malware payload (RedLineStealer)", "value": "dd12301c0e577dcc7a1d14209c82354a0031d1a8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752266, "uuid": "fb9efcc7-2f83-4166-97d9-2d9f2d8aea82", "comment": "Malware payload (RedLineStealer)", "value": "0155235ea4b9ea106776ebe4da878c531d9625cd00ea1748452276f2f933dbd58bfa49ea905b9be286e583311ef717ce", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752266, "uuid": "a8707828-ce74-4594-a315-14a055c919f1", "value": "T1F3252307BADC0077FAF9277098F202D30B397D51AA3513AB175A688B49736D4693237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752266, "uuid": "381a5a5b-e531-4aec-b9b5-4e5903d64129", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752266, "uuid": "2a689aad-21d6-4332-aecd-cd03f97fc2e1", "value": "24576:py0NRbD57hm+asP/LQrqIDExefL8OZw43xZgA6bKq5jG:cOK+v/LjIBT8OZwViq5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752266, "uuid": "ddf4564e-319b-45c2-9147-ae381f29fd49", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752266, "uuid": "bb005674-cf0f-4fe3-8973-9c59c6aa59ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752266, "uuid": "1b7ef551-be4b-4da9-a956-f6754387940f", "value": "526758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f31dd7-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745937, "uuid": "c72eb008-8d90-41aa-9160-194d72e735e1", "comment": "Malware payload (RedLineStealer)", "value": "b3f9076b68415e71ccc2cad89e54cad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745937, "uuid": "1fea0045-8df1-47ad-a0fc-2c7b76aa907a", "comment": "Malware payload (RedLineStealer)", "value": "13bdc82d55d199ea3b08feb90bd0705890eed43547ec7e3054cf1cfd1e27e68e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745937, "uuid": "90a5f81b-a61b-4907-a1b0-1292a7876773", "comment": "Malware payload (RedLineStealer)", "value": "308f9db2f4af3decabd714c651f6fe5a42f867c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745937, "uuid": "f3f456d9-f356-48ae-ac47-b8f215b6597e", "comment": "Malware payload (RedLineStealer)", "value": "4d838c30c09a36802f49b70a8b98a1836eb8465e918d7359cd516b689a2854612574fea95c6b23b25a556439f3e5b862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745937, "uuid": "9b889ed5-de8b-4d83-9124-68bc82c012d6", "value": "T15D25236567E88537D9B4ABF09CF642430B30BCE16DA4835BA35355AE2CB328475307BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745937, "uuid": "a7a43c05-b281-4023-915c-fefe8356394b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745937, "uuid": "1af731d4-263d-4e7f-bce4-4ff076c830ac", "value": "24576:yy5ZfQVL3kdrOVb61if63/f6IGM0vQs+LPhfeYUfmB3krWATr:Z5ZnrOUiCVGJvKfpCAMWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745937, "uuid": "3e43b022-c61b-4907-b51f-c774b93fbb68", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745937, "uuid": "13a2fc43-68ca-417c-8e8d-e7721f38dbbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745937, "uuid": "50a67475-a93b-4855-b678-b30737a5786f", "value": "b3f9076b68415e71ccc2cad89e54cad2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad361c8b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752289, "uuid": "faa1faf6-d3e8-4396-b56e-7f2aabacab70", "comment": "Malware payload (RedLineStealer)", "value": "35dd751bb308b59b52fdcdcfbb6cdb53", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752289, "uuid": "4240a5c9-3c6b-4766-a3fc-55555f697b9b", "comment": "Malware payload (RedLineStealer)", "value": "14abe45e504eb48e7b40b51fc134864e917268dee6df5362de2bbf391c1a264c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752289, "uuid": "f0ce7a4e-5119-43cd-9560-1d5248c6fbe7", "comment": "Malware payload (RedLineStealer)", "value": "0a53833d9fa7eb711cb51258edddfd1aea81a2da", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752289, "uuid": "3cf7c2b5-060b-496b-a721-800caa230cf7", "comment": "Malware payload (RedLineStealer)", "value": "2b410dbc30989f6b1b53273217d26194b82246d1f68d75e01472c6b75a75894fc991605b4d2f7624224937d0a56186ff", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752289, "uuid": "2ce38433-0f98-4f01-b842-6a41ecfe2ddd", "value": "T139252353FAD490A3D9F927B0CCF207930B31BDF1CDB6832A264696164E72590A831B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752289, "uuid": "c315e391-f7fb-4b2a-b4c8-21a7e792e53c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752289, "uuid": "fe9cc043-9b7f-4ac6-9ea7-21d88e5348d1", "value": "24576:pyx247UMqI1YsK5/VCGLbM73BtglpN10KVpPf4:cQ4oMqlH/VCGL473BtEx0KVlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752289, "uuid": "5f000066-4d7f-48b2-8b74-6662c545c66e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752289, "uuid": "e1b91bbe-c36f-430a-bc79-a8d6a931d59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752289, "uuid": "0c91b6ed-c0df-4e9d-9b7e-4fdfc2b65b50", "value": "999985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1afee6-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684751962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751962, "uuid": "1e66a112-f9d1-482a-a3fb-92d39f7861f1", "comment": "Malware payload (RedLineStealer)", "value": "bf667bfdcc14362e8d2fba790f1fb1f9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751962, "uuid": "274b1ad6-ae89-436c-b03c-1de7ce89412a", "comment": "Malware payload (RedLineStealer)", "value": "1512c79427cb292294d7ff29bd5e85a8f6e9ee79014c613f58621e40b83e9be9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751962, "uuid": "fac79533-6abc-42c3-8cb4-f68c13e95275", "comment": "Malware payload (RedLineStealer)", "value": "5a6771b3556d5a0664f90cb36f4d299abfb20738", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751962, "uuid": "ba033802-9bb4-4be4-b835-993d1d17bb14", "comment": "Malware payload (RedLineStealer)", "value": "a4cc16f9e870404d07618a807ed811a568f44f99cb3b7a5fe6365d56be91c90225008cfe11ac57cc2c0962dd8f49adae", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751962, "uuid": "2faa0db6-ab58-42b0-afb5-bf5ec834ce7e", "value": "T1CE252313A7D02462DEF51B745CF306C32A35BDD25F3881AE0B86A79D18B29C8683A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751962, "uuid": "2e2fc4d5-554c-4378-b108-d09bcb78a74a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751962, "uuid": "e754a7b6-6612-4258-a691-da210f071d31", "value": "24576:OyEswKu8ywVIezM7viPT2+BGBeEBg/kRp0JbLBa:dEsZuWIWsJBgsRpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751962, "uuid": "4e1a9986-4a43-4e69-8161-cb0505777a4b", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751962, "uuid": "6642f3a3-c22d-4d20-9b18-4ae111a731d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751962, "uuid": "f0f5af92-5f72-42b2-96ce-3f0974515d57", "value": "handler869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28148843-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684779554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779554, "uuid": "9da2b624-07e1-47fc-b896-6ee333f56bc5", "comment": "Malware payload (Formbook)", "value": "9e07e82773ce214334e2f6db415a70fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779554, "uuid": "2e5b6496-8531-4081-adbf-c0b404ccbe3a", "comment": "Malware payload (Formbook)", "value": "151eacb26f65117d4a4abb8473c8650edd42b079a662f7dc4c4ebdd966045d1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779554, "uuid": "912934e5-2f68-4429-bd7c-2e38c406a2f4", "comment": "Malware payload (Formbook)", "value": "b71a03a87cc12ad4cd7f2456a254ebdc120d277e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779554, "uuid": "0813594b-06c9-4d3a-99b7-407640cadbbc", "comment": "Malware payload (Formbook)", "value": "7526ba650b7dfdc22c3dc2e1007394d2feeedaa6d30cbdc55f2b0b870fdd304f43d5e33e652fd4c6e2157a784f7ce9ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779554, "uuid": "8bb16888-f67f-4737-b452-d03821d47993", "value": "T17FE4F1C126D88D45E5AB9EB459A3F2344375AC65EB27D30D24F06C8B7CA2B813B11BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779554, "uuid": "6adb4e1c-466d-4203-8950-3fd115708131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779554, "uuid": "f3f91d86-320c-4a9c-8835-3633aa9b01d2", "value": "12288:otMx0YPX/NqPs7H4GNaEYF56cn0luv1Xv6cvOpS0a9cdJWc5EvJ27y:ot7HPs5ih0lP6cdJfavJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779554, "uuid": "73d957ca-6b31-45fa-9a8b-53bec7f53520", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779554, "uuid": "3da6abee-17e6-4dab-b997-770302bc5a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779554, "uuid": "9a7565fa-458e-4799-8b63-3d29dbe310fa", "value": "HSA - Karuma (30 Oct 17).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd65c7a4-f8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684773469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773469, "uuid": "3423a096-b4b1-428d-822f-f6691c1ef6d5", "comment": "Malware payload (AgentTesla)", "value": "450c68303600f6bc4e6761e771e7b6c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773469, "uuid": "b15c193a-8229-44d5-8e08-cd2a189ffeef", "comment": "Malware payload (AgentTesla)", "value": "152d09a5037ea51e0ed7e7f7dce2551dd65f0805f6c0d6da9a0157b9c406c9e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773469, "uuid": "c02eef27-d25d-40ab-a36c-972ec870701c", "comment": "Malware payload (AgentTesla)", "value": "53b2d6204572b97afb9875ce135af6d3607876c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773469, "uuid": "6ff9a0ee-7e39-4c4a-b09b-3f058f7d88bc", "comment": "Malware payload (AgentTesla)", "value": "87e1db382515e02953f3b5001e5300f8a11061076650c6d89082bb777d34140f7fafb1c9c4b564a1893c09e78e3c875e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773469, "uuid": "674f8c20-9f40-4304-83e8-833168a0d339", "value": "T14DE48B5633B57621F47D73BD0119638CCB38B04A2022E21A1F5A3AD556E37EB770A6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773469, "uuid": "bfddbd17-1ac8-4aef-a025-d05bc812aa08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773469, "uuid": "18611e23-5a02-4a59-9791-cdf9faf6e93c", "value": "12288:nvV+s1bSQT6tjjdB4Y08uPQYweTeo6VfnjjvXGT0s/KfA6ISiJIXu8Y9Dze:ntqbujweqCT05fA6IrLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684773469, "uuid": "25e8dec0-5d59-4b21-b007-83c2f8c7259a", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684773469, "uuid": "938f9e5e-a6bc-4b22-837e-0d3ad9587891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773469, "uuid": "1d937da7-0e19-430f-a565-5a1ccc29c69b", "value": "GEOCHEM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60bd78f-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738614, "uuid": "92b53d5a-1b68-49fe-a193-47a2753deeba", "comment": "Malware payload (RedLineStealer)", "value": "787f8513c980416c32db91b56286e21f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738614, "uuid": "88d96a80-da8e-47d8-9d8f-401c24394d1e", "comment": "Malware payload (RedLineStealer)", "value": "156c64c2c1d083a10b77b5bffd372fae8a77f923267c96d0fb8103a36c36f100", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738614, "uuid": "970eceef-8c42-49db-b9ef-0b683baf4036", "comment": "Malware payload (RedLineStealer)", "value": "54dcdda0816aa558ff52bbb86990a8523528fa6b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738614, "uuid": "c8cd0387-68b6-44c0-80d7-0ff80ff2a7d5", "comment": "Malware payload (RedLineStealer)", "value": "14623f76d60450d3221230765253b8229934f3bd1b0ff8ad345e3f9387dde16f59efb89ac124ca7665c179588ebddada", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738614, "uuid": "9671b167-563d-44a5-ba43-fab0c268c961", "value": "T1EF252383EEF89031DC321BB499F353831E357DB06861921B3746BE9B49B39849872767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738614, "uuid": "4bf7622e-17f7-4cbb-8725-b7153e4dde73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738614, "uuid": "bf587790-82f2-406c-aba5-583e96a799a1", "value": "24576:WyzGMzI7vUOqD8aSCIUZm1oKJoUCkG23tDjYOr1:lzGMzwcOqD8aqJTCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738614, "uuid": "763ec898-365d-4ac9-882e-bafa2d61ea6d", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738614, "uuid": "c6ba1540-6969-4227-a32f-4047eedd2c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738614, "uuid": "0ca41051-6650-403a-ac12-7013262895c2", "value": "156c64c2c1d083a10b77b5bffd372fae8a77f923267c96d0fb8103a36c36f100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9fe02c-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762595, "uuid": "a6938d01-607a-4d32-a0a9-6e3bca7eec37", "comment": "Malware payload (SnakeKeylogger)", "value": "4189eb520f01cf0ffb20cebe35190f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762595, "uuid": "891a0868-f860-4261-aca9-1201d5fe5e02", "comment": "Malware payload (SnakeKeylogger)", "value": "15994314eaefe9e800a2f5028dcf65d886e15f35089df8bf6d114e954a601e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762595, "uuid": "3fa0b316-3960-40d2-8474-51f66cf73df7", "comment": "Malware payload (SnakeKeylogger)", "value": "d3f346e61198f126874f0442201fe95c757696fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762595, "uuid": "df04e6cf-6d1b-4e91-b37e-37e78db2a55a", "comment": "Malware payload (SnakeKeylogger)", "value": "240012081d795ac05de7d9be1ec5849ad1af8e586d9adf31d147e1fcf798a5da7a0395be682d7dc8635454aa102cf9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762595, "uuid": "e6a74a7f-cd0b-419b-a14e-f557ed48e312", "value": "T1E734121437F6CD63D87246B218BB16A55E95E637296A07837710AB88BD332A3D50F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762595, "uuid": "b30e50e5-72c9-400e-9135-98d8581da710", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762595, "uuid": "75650be4-a37c-4ccb-a64a-6a7cf006d32f", "value": "6144:ZYa6MXC8bgEgz1L5a9YV5VcvpW2G3EveONR3Gkv6O:ZYeC8BgF5aSHVR3EnGkCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762595, "uuid": "47ec46ef-77d9-4f6d-b83c-05a9f1a93cc1", "value": 236989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762595, "uuid": "23f68c59-1b8f-437d-acdd-517a77fa8ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762595, "uuid": "53f41837-4d68-406e-b4e4-e1b01083c5b0", "value": "S8600000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e724e92-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755888, "uuid": "4af1d951-6f47-4d5d-832f-613890095eb5", "comment": "Malware payload", "value": "9195db2e85661a2e701eae78110201eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755888, "uuid": "f958056f-493f-4a9a-8118-aae2a52a219c", "comment": "Malware payload", "value": "15c404c79e02396e9b40b4acef7884ea5466157bad37933e226638a2870304fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755888, "uuid": "404abe16-d3de-4f5d-838a-07c5d2ba6c3b", "comment": "Malware payload", "value": "e1a9dd4afe2cef4e316b8412a4e6acc6fda9dbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755888, "uuid": "f5990f16-772b-4e01-b4fb-51dfeeb9058e", "comment": "Malware payload", "value": "94781f2a112eaf4abd2b2cd974485efb6ea9a9d06b08f8bdb9ebac232d2dea4c122c399633ff1bb5c0967b285ec68a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755888, "uuid": "3589bc36-354f-4fe6-8a4f-3a68c674ecbd", "value": "T1B8365C41F987C0A1EA55A57010B6673B9AF056F743339FC7A7B8DD2FE1220426B3934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755888, "uuid": "8e0d9896-44a3-4fa6-a230-1f311888c303", "value": "24576:/dzTe0OMHpdLBYCdzbKSclu/YkktgGsETJVfm6:xHEltgGBTHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755888, "uuid": "27de3e11-b74f-41d7-89ac-7f8551b4d97e", "value": 5075968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755888, "uuid": "469ab3b0-94f7-4ba8-8961-9de1bd674e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755888, "uuid": "dc1fa96b-ad49-43e2-b05f-8cb3694172e8", "value": "SecuriteInfo.com.Trojan.DownLoader1.54378.6967.30943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6141f72-f86c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684738211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738211, "uuid": "c5e4866e-8e54-4f07-9c4f-b4b630af82a5", "comment": "Malware payload (Stop)", "value": "20f8a08c2afdacb0be5536509705222f", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738211, "uuid": "eb523277-31d3-48ec-9f1e-866b141917e2", "comment": "Malware payload (Stop)", "value": "15f5c3765c83e7f680aad1eba19d771eb275b60c500028e9d0f6259b9c2c533a", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738211, "uuid": "76908f8d-5c2c-49c8-80d9-1e75a419b46b", "comment": "Malware payload (Stop)", "value": "3fc30498044538a18bbd8fad14b1cbccd3a412ae", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738211, "uuid": "6a787208-b7aa-4222-ae89-ba8eb2d50d4b", "comment": "Malware payload (Stop)", "value": "c88ba3c48e111b9d8bd5a85a268ea22e7259c344ddf9a3f73369df804aed7da52a486bf951eb65ed549b73ba32f701ec", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738211, "uuid": "896681c3-5ac8-41ca-ad9b-157948f429af", "value": "T12405F113A291BE71E62746768D2EC6B8652EF4604F4527E71B1A6B3F04702F2DA73F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738211, "uuid": "1fbf734b-f1c9-48d5-a920-92e3484791b8", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738211, "uuid": "36e60c58-bc2f-4274-a148-c84825c1aa4b", "value": "12288:Vrg7z1d0M9qeCuk/+c/hEcVlW2zBrMZSUlOJWszHaEOXN4iip:VrUf0MY/+4EElW2zyUWshnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738211, "uuid": "c1df3073-a64a-466f-a65e-8b0322009aeb", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738211, "uuid": "87dd72ea-567c-4777-9ef1-fc2afa8cdeaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738211, "uuid": "484335fe-4093-4d51-b3e8-50d6e1e48e79", "value": "downloader155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b73835-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737025, "uuid": "675f2ac6-26c0-40c4-91ec-dcbb47c1fd76", "comment": "Malware payload (RedLineStealer)", "value": "4a7261dfa76011b1a9b826efb8a8e45b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737025, "uuid": "2e7e896d-c823-4660-9ddd-8b05897c299e", "comment": "Malware payload (RedLineStealer)", "value": "15fda3fa3a6c93a2c3b5e8620f8e0bf65e5d66edd81b5e5fd23917e28d44133d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737025, "uuid": "2ee07cf1-574d-4fcd-a7d6-9c01487c8dd6", "comment": "Malware payload (RedLineStealer)", "value": "d9219fb33597fc48386a654a070fd535426934ae", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737025, "uuid": "05caa2a7-48be-4764-99ba-d275399e9590", "comment": "Malware payload (RedLineStealer)", "value": "fc6801c746dc7134608d6fe73a387d6e3ed54f674d9265f8980e3fcab600c86d63edf019896c1abf437d0196d1f472b3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737025, "uuid": "50362ed5-d771-442b-aad5-99147eb54108", "value": "T11C252353D2D890B2EDB813348DF606D70F7A7CE05ABCC36622469C1D6D33294A576B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737025, "uuid": "4a49812e-d9c6-4f75-8b99-a9c027bbea2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737025, "uuid": "14abfad6-04bd-4726-ae5f-9e35176767c7", "value": "24576:GysSi9r0RqMuIV5tc8ZIcTNUkf3WWo2KKx9s:Vti9ryq1wKcpUk5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737025, "uuid": "3c351984-b855-42b7-80cd-bc9e0117e08f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737025, "uuid": "be3a4c95-5ac3-4891-b483-23a0b7c0f06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737025, "uuid": "e05eee31-7cb9-4c90-b3d4-db8d8cb832bb", "value": "24468579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74cb8bd-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738616, "uuid": "c24116be-2e21-4dcd-9548-ee37bf3f6627", "comment": "Malware payload (RedLineStealer)", "value": "44efdb18c708aeafb17978c6eff62efa", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738616, "uuid": "6dfcf929-fa41-4cc3-aa72-cfbd19ad52c6", "comment": "Malware payload (RedLineStealer)", "value": "160c36e5d33c1320ff1cb8909dc8d760ba615223f4ac903b6254d6c854a089b5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738616, "uuid": "7d013758-1174-4d0a-8ad3-9c2dd595c1c5", "comment": "Malware payload (RedLineStealer)", "value": "7f151397945a8b9031d0d7a2e593b08e71847aa5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738616, "uuid": "83cee039-9b2e-445c-8f6b-1a5d977cd2f2", "comment": "Malware payload (RedLineStealer)", "value": "cca70840335505e6eb4b397cfe83422338f427a76af637be6347e2537a0b9d076b05f2c96ffc5b9a48e93520c79de07b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738616, "uuid": "bc46a24b-c2f3-49b6-b774-50800ab38815", "value": "T192252253A9DC88BAE8B517B5A8F702E31637BCB15E24431F2304A55E1E336C4A47973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738616, "uuid": "a2809953-2257-48de-8a9e-1a04d0d91846", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738616, "uuid": "9c7f6e13-aeed-4285-9717-d077aab5dc8d", "value": "24576:yy9wCUn1Xrrxcwua2YmjopWkWg6t6+Suh0:Z9wCUdrMNYmjoD6cih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738616, "uuid": "8782f77e-1da2-46df-a627-06da00714506", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738616, "uuid": "48dd90a7-97ca-47cf-b55a-16735d8d7d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738616, "uuid": "eec5c224-3c3d-4c6a-a4a2-b61992e66dee", "value": "160c36e5d33c1320ff1cb8909dc8d760ba615223f4ac903b6254d6c854a089b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4a0dc6-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684747914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747914, "uuid": "568abb0a-b3b6-4bc2-91c6-a5459b864055", "comment": "Malware payload (Amadey)", "value": "fd1975fc1ded0e32241e209ee52d1c6b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747914, "uuid": "6c44c744-5d78-463b-98c2-ff04abeaa37d", "comment": "Malware payload (Amadey)", "value": "160feda6a532c4c8a65399df1feb17db014f08644abff2bc2fdde5a7b0a8603d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747914, "uuid": "6cd92c83-7b93-43a6-840d-34654d962e15", "comment": "Malware payload (Amadey)", "value": "9f10693bff3fbb4128c40f27c972258b51bcc000", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747914, "uuid": "856266ed-6fec-4379-bc22-7ce3f3b5b2bc", "comment": "Malware payload (Amadey)", "value": "1d49bad7fbac1783fd5fb7b0900e03e311d99f8674468cf8fc7b37baa3d2c44fa86fab975b1f51983ceb2b4585a5189e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747914, "uuid": "81a74f3c-6748-4c43-9834-53a3bd56ed8f", "value": "T13225235267D854F3C47427B068F642C329707CA38E78E2673782696B1C33949B937B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747914, "uuid": "40095514-2d42-4f4c-8f2b-7916aeb81b17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747914, "uuid": "4268a2ee-87dc-41b8-b68d-3bcc016a0170", "value": "24576:KyEMSxrb4pNWIylvPZTJhmk9SoZ8CYMXCJ5G2TxlmcFHo6:REMS5bSZcIk9SmYM+5G2Txlmc9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747914, "uuid": "ff357451-d2c8-4b8f-9402-a234ef04fed3", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747914, "uuid": "8aaed41d-6a60-4acb-8d09-838c00eb69fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747914, "uuid": "51eab35c-5870-40cf-bdc1-c88f10241957", "value": "debugger997.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb849fb-f8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684789009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789009, "uuid": "da2a6349-fe71-4ef5-8852-b22052e53a91", "comment": "Malware payload", "value": "b99290063c63c1449c6d61c62f95528d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789009, "uuid": "8348c823-78c2-4b31-9152-7e329b3f7720", "comment": "Malware payload", "value": "162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789009, "uuid": "14ec1d89-0d3e-4823-a290-d1da976017d5", "comment": "Malware payload", "value": "dc80d751832030dbe05bb34e691a6237e2a224b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789009, "uuid": "edeb2aaa-dcb8-42e8-8a18-0286f14989fc", "comment": "Malware payload", "value": "993961a22a0c718936f91d22c681d2ef26aca36b3aa2650dc0dfc957cb9ef0b6a468c5c62c72584c0f787016522be900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789009, "uuid": "c64ed569-8682-410c-bef1-618bd760dd84", "value": "T1554539243DFB501AB173EFA68BE879D6DA6FB6733B06645D1090038A4723A41DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789009, "uuid": "9815cf19-cac4-4a18-b89e-983999d093c5", "value": "12288:UPqvdlwvVVmpmiUkWnbaczXSisUFhiqNnuJCbM/C3irgP92vjy9jhBvcS5K+xlBW:Uy5iV7bTEyhBVdhPTyITdOqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684789009, "uuid": "bec515c3-5c1f-4ac6-b6b1-a28792d51053", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684789009, "uuid": "ecbe68d2-1608-4931-91bf-3d9ab71853b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789009, "uuid": "151c8c46-8f31-4d95-b7dc-9140f81538f1", "value": "bcbdacb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2c1879-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752286, "uuid": "3313a48e-efe7-4382-9cfb-ceb4f246b5f4", "comment": "Malware payload (RedLineStealer)", "value": "a03ffde064bd872242437bf335e1d027", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752286, "uuid": "9a1c5d3d-171a-4ef0-9106-13f31915b3b2", "comment": "Malware payload (RedLineStealer)", "value": "1671f03ceb091a49f373d34ac68f24a15fb8f8f1f751ce5f4ba5ee3a96b35129", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752286, "uuid": "0e2f43c6-ba27-439e-a878-e6bf60f611a5", "comment": "Malware payload (RedLineStealer)", "value": "4b75c4214e38b15e7143edf7ede26033849f1dd8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752286, "uuid": "b689e8ca-79e7-4b4e-9378-7d0eaf354234", "comment": "Malware payload (RedLineStealer)", "value": "d452df01b39213918e14c419020134f4779325c6936822e18b2712f6e31875948cdab38253949e57d09110327e2be51b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752286, "uuid": "8c8e868a-6fb9-4970-b2e4-529a12287e1f", "value": "T1992523076AD1A072EDB567B40CF302870B36FDB19DB883962356989A4DB39D4547233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752286, "uuid": "58d1153f-4453-41bb-8e59-aec00d6d8764", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752286, "uuid": "b1971845-8f65-4af8-830e-f33f4915720e", "value": "24576:5ytOoTG/pSSuDLuv+zwwnmJyNmKSx2GEwbTDvnegN9xG:stOvo6wmJqmn1TDPegF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752286, "uuid": "624d80d2-22de-4120-a326-cebeeb4d75ef", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752286, "uuid": "41a2362b-e364-4ad3-82e4-0f0d0b74d52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752286, "uuid": "4ed650ad-c220-40a2-8e0d-6a67faa7abdc", "value": "99242370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9253739-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752336, "uuid": "fa36b18d-0fad-4e49-9cf4-81e0cb033fc1", "comment": "Malware payload (RedLineStealer)", "value": "f18389b76266db146bcad78540a3882c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752336, "uuid": "026a0a9a-7286-4d84-9aab-cb4988752845", "comment": "Malware payload (RedLineStealer)", "value": "168cb493074b8464973d3cba902d34e618efa4d8ba9e90489fad11ff985c7ca3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752336, "uuid": "67f43b47-8695-40a0-8336-48ff83cf3e4f", "comment": "Malware payload (RedLineStealer)", "value": "880bd62c08934f8140c991c4b424573a3ea0978d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752336, "uuid": "07308001-d3ee-4699-a29c-78ac931c1bff", "comment": "Malware payload (RedLineStealer)", "value": "9ac59aebace7597db0de8137ddf077f1d288f512232329159ad1353ecdf03fea21979502924b3d3dd7d6a30b05d91f75", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752336, "uuid": "d0c2cd53-07c2-4b3d-9c08-2d7311d509ca", "value": "T146252307A7E884A2E97223B02DF352D706357CD19E65C30B2BA9DF5F0DB3684993171A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752336, "uuid": "1b5ef05f-1a39-45f1-8ccc-9be7027581bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752336, "uuid": "312de834-010f-4992-a5b4-d1bd6fe75435", "value": "24576:tyoZwlEuNgFlnGtDPFlmX+ckRmDLcfMyUKplkTwCRLEgUv:Id6uuFlnG7ww0vrTVpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752336, "uuid": "e2f33fdd-ab20-4c51-9df1-73ca14e0f052", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752336, "uuid": "2c4ca804-397e-4caa-ae4b-f2c7967bbbcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752336, "uuid": "a4accbd2-0a29-45d8-897e-577e85d9f675", "value": "backup170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ead57f-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684734961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734961, "uuid": "d25de102-aec0-4c94-87ce-cae11f4638f6", "comment": "Malware payload (Amadey)", "value": "54f0fede5693d03936b99897805fa6e6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734961, "uuid": "ea1e464b-b0c7-4ce2-a38c-3b83639e2009", "comment": "Malware payload (Amadey)", "value": "16bd1eede6a66e78715d09cae4f68597ad23c8f0f5efbe25f7ab7ae3cfce5882", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734961, "uuid": "2456cc80-8017-4f59-9c4a-e19d281cd024", "comment": "Malware payload (Amadey)", "value": "0cf42e39b6053c7726fe21ac19440a27fce56555", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734961, "uuid": "e6245427-34fc-4e4d-bd19-6309f78b70c3", "comment": "Malware payload (Amadey)", "value": "e452e487869ce1a52a7144eccad1feb3f06b7ddfdca0a459a29be6a10dd88821d992193620ee92aa972b9d767c7c1def", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734961, "uuid": "4339f5f4-48ea-4047-9c8b-7bd406e051e0", "value": "T18F36335360BA4756A2E65380CFC8884D1A5AEC4BF0894167AFAB6D74C3F1850F73A5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734961, "uuid": "4df5ed21-1174-4624-882e-d1bc97a9e376", "value": "98304:ba7zEZtLpNuUlC7Uz/mj7Ehbf1Tt6H5pBRlr3DEN20E2GY+/:e7zEDjflUsJ6/t3EtE2N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734961, "uuid": "ab7d284f-ad55-4287-a345-0600ac744785", "value": 5247891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734961, "uuid": "913f0fc7-43e2-48d0-b1c5-de810ba8bdf4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734961, "uuid": "911b4ccf-f11a-4a37-8be7-e9887852ff1b", "value": "54f0fede5693d03936b99897805fa6e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9bdc0c-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737415, "uuid": "adf07702-7d87-4c4b-9bfa-5dcb66217549", "comment": "Malware payload (Amadey)", "value": "3d42dc2098aede978ad1e115f65b58bc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737415, "uuid": "a3660fea-3aa1-422a-8e24-0de1d7825130", "comment": "Malware payload (Amadey)", "value": "16d79ee5e27240d4f162a42ec730a5f597762d4997808b02eb58f1397a331f98", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737415, "uuid": "3680debc-2bec-4c04-9254-cb29f3c83b45", "comment": "Malware payload (Amadey)", "value": "90c222c7e375c9cdc502b5a711310f63271bc73a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737415, "uuid": "3e7c3c3a-560c-42af-8fd6-05797d2380b6", "comment": "Malware payload (Amadey)", "value": "2a8d5a18329ee4d5c656560b9b7d8eed2d4edb088cafeb6d25d928af507c5624e06eaf16bc6887855250682aeb2cba95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737415, "uuid": "8589b7b2-3ffb-4c29-a2db-70adb75b0ec0", "value": "T179252387AAD85566DCB42B7084F65AC30B34BC404E34C3AB27C5B61B1D729F4A674B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737415, "uuid": "48669485-df76-43b1-a600-9b962d241713", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737415, "uuid": "0983a0fb-1ac1-4cca-af83-ddc8108cd52d", "value": "24576:IyMlqGn2D9iXWgsqp5nImkLfpreR+vwTgjUNK:PU8D9iXWgsqpSPISQgjUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737415, "uuid": "13104b53-ef54-41da-a67f-bba03efa3391", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737415, "uuid": "57e6252e-adaf-4b99-a86e-169cfc2e38df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737415, "uuid": "9ffdcb5e-b57d-4333-8376-0943c4386c09", "value": "discord_token466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc574c-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777233, "uuid": "3cc58c3a-f1dd-4b12-9595-64f61ec78778", "comment": "Malware payload", "value": "b27eae6ff491de6115df220d89c2bc00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777233, "uuid": "6e7b9985-7b43-416f-b73d-29bfe9ae8e41", "comment": "Malware payload", "value": "1805f0716979e164b655d595c54545cbeea0f4ec923acb19e309b55aa1ec2d79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777233, "uuid": "873724e5-fa07-47c9-b534-57c2ca6a628b", "comment": "Malware payload", "value": "84dd0f30ff9983c9dc6eea46d5f30941194e3722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777233, "uuid": "c8d3eff7-26ad-42a6-9145-62566103184f", "comment": "Malware payload", "value": "c117c6bff948f88d345ad6d01710162d5951fa3fbf4d70c7f904e451eecbfa1c1782b0c0919e54df8405346c497d6888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777233, "uuid": "785fca1c-0075-42a1-b87b-8b08d21b2c3d", "value": "T12FC4F535E6B26367CB9418B2D495E6B641D01E8BC85EE2AB4354FF8CE13C188B713E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777233, "uuid": "313afe1d-c169-4cc2-93e8-02db2bad95e8", "value": "5e7b83e3a9123c6ae3bc678ef8b11ee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777233, "uuid": "79a706f2-c8aa-4c2b-874a-2e741a4d4e44", "value": "6144:E1p9Ca5I3H6h5DnU/cM0FiGAn4Os8nJHysddKSRgivkQeasklRo:E1p9TI3ah5DnU/oOmD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777233, "uuid": "3fd8da0f-e9e7-4520-8869-2aff8b926cd2", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777233, "uuid": "b932748f-07ed-40f9-8f0f-0ffb17ec630a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777233, "uuid": "414a6980-03b5-4f43-8b34-25b6e98e5bb5", "value": "SecuriteInfo.com.TrojanDownloader.Banload.23589.18003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ddc81e-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747920, "uuid": "36984615-b42f-4b0c-855b-c20294e04b65", "comment": "Malware payload (RedLineStealer)", "value": "8fbf4d5ca91f4032ceaad3cf6afefb36", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747920, "uuid": "9c4cbd36-c33c-4a34-a2c5-195ea572d970", "comment": "Malware payload (RedLineStealer)", "value": "1809f17ecede9bace1957d19df8d14ee2c45264f9320ee138793451993f2eef3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747920, "uuid": "3984ad03-2e66-4d24-bd2c-03c7ec150c19", "comment": "Malware payload (RedLineStealer)", "value": "4229546a17c11d7014ca42eac78e63b01dbfe19c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747920, "uuid": "4b410079-102c-4052-99ad-ee4fb27774db", "comment": "Malware payload (RedLineStealer)", "value": "2efe10b8a2d6f3dbfa4b193b472e70643746d3a0b4550fd0266cdd77b4a6bd066a5a51100388d3015779b7fd909e3e0b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747920, "uuid": "5bda51f5-2b72-4aaf-8587-e187a0ff5292", "value": "T15BE3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747920, "uuid": "1c29809d-539f-4126-8362-7c5bb1374890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747920, "uuid": "d86ad853-807e-4a4c-a0b3-ae7a1f8e74b6", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747920, "uuid": "0174bca0-6267-4101-845b-30b9d187e8ef", "value": 149373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747920, "uuid": "0db53b3a-0848-47c0-8837-b394d1bbc6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747920, "uuid": "b286e10b-b333-4cb8-b188-eb52ed2692d8", "value": "extractor164.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb18092-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684735219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735219, "uuid": "0f35692f-d2b1-485b-9687-322cd832f041", "comment": "Malware payload (Loki)", "value": "956a37c29ba71fee62b73c6f9fc9eb0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735219, "uuid": "9f6e2808-2c9c-45ec-8311-fe4d76776855", "comment": "Malware payload (Loki)", "value": "180fb1754473bf66ac639baf329875582efa35331da108954b658107be7f2781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735219, "uuid": "2f8868e5-ba70-4df2-af6e-10c97d62cc27", "comment": "Malware payload (Loki)", "value": "50b9bf5d29e3a0cec35d13254e5ce57b27b94d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735219, "uuid": "62055213-9b26-44d5-ac08-2eb4e94e931a", "comment": "Malware payload (Loki)", "value": "4c2210689f76931a246a8ba79b52202601452d35e9c63e1605444b03814cf00353ff2f70e7554c4fb78abcbbf959ca8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735219, "uuid": "621003c3-5a02-4618-bcec-5d129f3a2dac", "value": "T1C3D4E0D126948C11F6AB9FB55AB3E27843B56C61EB27970D24F42C8B7C52E823B017C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735219, "uuid": "df817cd7-05f0-4413-a794-4ec9fd17cf8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735219, "uuid": "c45b9474-632b-4359-8fd5-ea4fe592bb08", "value": "12288:JTdx0YPX/NqPsxtAoHoTsrlONMw/AoFtfc0J6oitb2JrsAP2UCw:JT4HPsxtAoeUlkzHEorgnUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684735219, "uuid": "a2aca14a-a266-4390-a506-1f222b46b14c", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684735219, "uuid": "87914a17-81de-4174-8247-ffd47ad732f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735219, "uuid": "f28d763a-bae4-440f-9767-0d11905dec7a", "value": "TNT SHIPPMENT NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd80c61-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684748046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748046, "uuid": "21a2a7db-0f5b-4793-8159-dc22afa914be", "comment": "Malware payload (RedLineStealer)", "value": "d11fbae039bcb326433ba6a01468d027", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748046, "uuid": "60fef9cd-7aaa-41fb-bb80-fd98543ee134", "comment": "Malware payload (RedLineStealer)", "value": "181aab0ffb463dd4f8c595a5b2fe53328d4b5d53c2d409464fac837da294b4b1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748046, "uuid": "c95a0dc7-b8cc-4d74-84fa-7f6df350c0d9", "comment": "Malware payload (RedLineStealer)", "value": "bb2b1e0145a3e2b87b455f30287492eed05f8e8c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748046, "uuid": "2c7e49c0-0366-4926-aef6-85edb56e1dd2", "comment": "Malware payload (RedLineStealer)", "value": "bc9ca9143da1a9253473939c02da38da3d5ea355ebfb8c4ade4f5551a4ce08e8f80d203b915b3c3235f42d3aadf781b7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748046, "uuid": "837a963b-4c0b-4ad1-986a-beab2f3caf80", "value": "T1F9E3E824279F8930D6BB493DACB19DC076BCEC12A942D34A4ECDF1593973B80DB116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748046, "uuid": "f959e52b-0b23-486d-ab05-005ac651280c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748046, "uuid": "d5109aaf-6ac8-4b41-bdd6-d458b11faecc", "value": "3072:oV+m5czQmRS9Ynk5QXNhhRbG5h5Zx8e8h/:ojKtM5h5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748046, "uuid": "38df916f-ca71-43d2-a938-46c10314aad2", "value": 149326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748046, "uuid": "6f4608f2-6548-455c-a69e-9de9d8ad4196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748046, "uuid": "64793d43-26a9-4478-b439-0a47d43231ed", "value": "router247.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277c5153-f8f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684795444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795444, "uuid": "bb763184-114b-4b1e-90a1-430333eb34c0", "comment": "Malware payload", "value": "473f6d656d2f3e9cfc5d2cbab8bfaf3c", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795444, "uuid": "fb3f078d-bab8-4e61-8378-0fa41c3690eb", "comment": "Malware payload", "value": "18dde4749b1fd76aa3ff96ab7bdc8a4670e99bf5a3f3a1d1773ebcb2d289f70f", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795444, "uuid": "a2276de6-e26e-4f8f-8fc8-691671a10b2d", "comment": "Malware payload", "value": "95ee686198837b771f1b974bd4c1f8cda74bae8b", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795444, "uuid": "b8cc51eb-5abf-46fb-ac9b-6d478939afa4", "comment": "Malware payload", "value": "fbfd4ce5736f7589dc244c11dbc3534f403e62594a57cd6271a5a691caf1094b68d07b87eeb04a3f702db02e5b7dfe70", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795444, "uuid": "3d33f360-75d2-466f-8a02-1c1b399e710c", "value": "T18F8533E9C1B6C90705B2BFEEF22BBEF534111B447BF0C9D89895D0449D8AF118DE9A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795444, "uuid": "ccb77764-953c-466e-92b5-46b7a8938088", "value": "24576:Mg3XSstcBLyFGiAMU1JRCgXyFKa6S1vZlakrVmPLU2hAMVEb+eNWdAFUIyqAmo5I:PXTcIu1nCgCFH6Jo2hAaEb+uEAFyd5T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684795444, "uuid": "3dd9a27e-d37e-4766-953d-44e33cd9c709", "value": 1735582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684795444, "uuid": "23e47372-d592-4e35-9425-1a4497c9efeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795444, "uuid": "d20059f6-94da-4aa2-afdb-c837f1b34289", "value": "Guy-Watches-Industry-Report.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee547aaf-f860-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684733071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733071, "uuid": "6d32e26e-560b-46d5-b78d-c4461bde4e5b", "comment": "Malware payload (Formbook)", "value": "5b35cd229afdd0871dfcdbe9ee903406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733071, "uuid": "738af3a3-0afb-462d-8eac-731354904519", "comment": "Malware payload (Formbook)", "value": "1950034453da28649135d35016d5ab7ee791cd4bbbc1e4a72f7c56ce3aa9dd9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733071, "uuid": "0b3ff0de-35a0-4e3f-b982-9763e5b8210d", "comment": "Malware payload (Formbook)", "value": "5f3a4a6fe93590cc459c873767c9e292dce7496e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733071, "uuid": "14c19ede-d0a4-4780-b84f-5d3e51aeac6a", "comment": "Malware payload (Formbook)", "value": "9967264d3ee696d17d4c846554728d4fda455048a31417a164c9d94e81593523360da705705a3ec59b98f8bdc71241d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733071, "uuid": "ce78f9e8-33af-4ef6-995a-f8e7d6465622", "value": "T139E4F1D126988C15E5AB5FB94AA3E23443B96C90EF27C34D68F42D8B7C56B813B017C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733071, "uuid": "9a816c20-ebd2-4d44-9042-282d60c123e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733071, "uuid": "54b7b1ef-bac5-479c-8454-65ece2ce2bef", "value": "12288:DTpx0YPX/NqPsn41wERBpGkf2cFOKaOofgPIOqCj04+g1W:DTcHPsn41wcMk+WOtgPI1c+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684733071, "uuid": "21ced6d6-3db9-4be0-9227-803b2890cbbb", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684733071, "uuid": "fc12cbae-aa94-4c27-ab09-6cd17d36afe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733071, "uuid": "b06da9b4-a428-48cd-9a71-6b7201b06a21", "value": "sat\u0131n alma emri pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8972c1-f868-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684736185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736185, "uuid": "97bcc972-bcd4-47a7-99cc-ec097be7157b", "comment": "Malware payload (AgentTesla)", "value": "4a801dd7a0e3dde542a373e12c268510", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736185, "uuid": "7f8d909a-ba37-4d79-bf56-7877fae5126d", "comment": "Malware payload (AgentTesla)", "value": "1aad8a04f82d296e91f7fa3d3c0ec03ae6eb0239f1bc43e8d2dbdc70772ccc94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736185, "uuid": "76797087-9745-4ac0-ab5f-e3e30cc90fc7", "comment": "Malware payload (AgentTesla)", "value": "e0f702bf548a48a3fbf451a3b2eac9919f8e66fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736185, "uuid": "4e3bfcc1-172f-40ff-a542-b3399195055b", "comment": "Malware payload (AgentTesla)", "value": "8f32b5f1b17622e4fc5c17ea63cded638c779a18e5755204241900fd6758e0ee42d56aa7893fba07be4dcb3afa7de126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736185, "uuid": "6df782b1-6be0-4ed6-966a-6c3d333c9db9", "value": "T1E6F4F1D126948D15F99B5EF959A3F73443B47CA2EB23D30A64E42C8B7C62A813B017D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736185, "uuid": "3361998f-78f9-4aa7-8e36-3b9dd77107bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736185, "uuid": "7980a1b4-e135-4066-8297-c800a45246d4", "value": "12288:sTTx0YPX/NqPsci70o+9134M3lvuZfWgVrW53/bQp5F4/PkWoWleTY7B:sTWHPsckz+9mzZfWgVrw3ms/7oWleTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684736185, "uuid": "80b97386-ec6e-4ccd-b808-02f444650f0d", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684736185, "uuid": "ecf0b9d0-60f0-4f38-b257-cbfeccd4373e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736185, "uuid": "8be68ace-ad83-4d7e-95b8-8847e965d3f3", "value": "dekont ( 65).pdf Garanti BBVA scan0010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ca97da-f8a3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684761722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761722, "uuid": "870a93e7-6393-4a18-8f84-06a6f9458070", "comment": "Malware payload", "value": "09cc933ba6719a1e0d1df52b475dcc4e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761722, "uuid": "39b55d4e-595d-4601-9fb9-d49072505415", "comment": "Malware payload", "value": "1b95608177ad27861ad5574cb51a8c47097e89e36a409b978ed801debe12dadc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761722, "uuid": "8bc4cf3c-1e15-4652-9db9-c5bb273b7c45", "comment": "Malware payload", "value": "1a674add6b428ece491fbd9a3609f294dd151445", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761722, "uuid": "7003fc9f-8cba-4703-9332-b86e71b4dab1", "comment": "Malware payload", "value": "a80c2bfd44c4f06d90d56ea7b53962826a057bbc703521f2acfe4d60007572c1cab25c395e6e9e293dda3f11f974b476", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761722, "uuid": "3065f3c2-a893-432e-a88b-5a61ab0ac04a", "value": "T14786335B5A19DD51E68DD02A093719A3DF39438B3CFC960903DB4F92B343A06A9AF31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761722, "uuid": "25f6fa4a-0bcf-40f6-b1ab-73028178cd00", "value": "98304:KeHRF33fzaQG6KXAJjOfihtMsALulHY7sM281KMEvY/VXsolE9KaW4XXS3E:K0z/VSEjOf+tVeI534TUY/VXRlh4nAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684761722, "uuid": "aad44035-7559-4085-bc53-942b7283c85b", "value": 7863939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684761722, "uuid": "05e7c531-448b-4224-82dc-0697e7d1abd3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761722, "uuid": "c661943e-73bb-47c2-8cab-078805f055c9", "value": "Samples.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914e16fa-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752243, "uuid": "f98a6832-b922-4d93-b413-6748a477709d", "comment": "Malware payload (RedLineStealer)", "value": "17014f5ad657506f2b7770295eaa2c93", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752243, "uuid": "9140063b-c0ca-4b04-9805-dbb3a3efd597", "comment": "Malware payload (RedLineStealer)", "value": "1c0c8ef83633067144cf02eaf9c192b07f47d5bdf869a10757f116c01d85392b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752243, "uuid": "f930ffc7-af10-4890-bc41-ff1b172e78b8", "comment": "Malware payload (RedLineStealer)", "value": "232d795637cb4d5dede1235a8bfdeb7ce2fd6f53", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752243, "uuid": "10eff801-4b9f-40b8-be9a-8d11c0c1eb88", "comment": "Malware payload (RedLineStealer)", "value": "ae8815f8e9c1cbf167bfa995e29ae438cefcfc94bb275b2941907de37e9a1c3a1ab425bc51c02260b4fed31d0f998d24", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752243, "uuid": "0e5685e3-c43d-41ab-8579-fd1c0e41ae4c", "value": "T1D9252356AED89023DDB8077198F701831F35BDA1AAFC962F3295DD0B0C326C85A3576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752243, "uuid": "53816f91-793f-4a5e-90d3-c2ddc48dd407", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752243, "uuid": "40028ac0-64a8-44aa-8b89-c8a833187ae2", "value": "24576:cytQoCruRT+xZP5q/4oUbGOneUMxrWX1EegARDD:LtQofRTyP5q/wneUMxCalAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752243, "uuid": "be17a8a8-c99b-4f58-be8c-0563e9ba53f0", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752243, "uuid": "ba6df1cd-7eef-4f1c-aba6-25fc5b7a3b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752243, "uuid": "a7adc2f2-4e31-4054-964c-3b7ab280a49d", "value": "345996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a80778-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752471, "uuid": "3e4fe483-3268-4627-884d-517f594d774d", "comment": "Malware payload (RedLineStealer)", "value": "91fd63235ed15c8d6e152aca1db4004c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752471, "uuid": "95b065de-e993-4443-aa86-855f7be799cd", "comment": "Malware payload (RedLineStealer)", "value": "1c5afab51672ebf4744bc50faef841ed19aef2682786bb6984e96769e3dbbdca", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752471, "uuid": "01aca57e-7eba-42d7-b117-945ef3134716", "comment": "Malware payload (RedLineStealer)", "value": "4a2f8daec397ae7ba0beb98a9acb17c3accddb7d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752471, "uuid": "7f1df6f7-e839-46a2-8354-a6b302419111", "comment": "Malware payload (RedLineStealer)", "value": "7a3ffb26ee73030219702929497be5d8af9c0ba0acebb58c96ded6524b3c5a0e1cb3c5b6616c2ca2e35c2052ec034655", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752471, "uuid": "abb0bf7e-e91e-409e-93f2-a6c60897e835", "value": "T153252303ADE85426FDB1333098F643E31E3A7DA18A7859762346FD6D5832684B43637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752471, "uuid": "56cd9efa-f7b3-4130-bcb0-a54964f51627", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752471, "uuid": "6296fa79-f57b-41f5-9371-9235afa7a870", "value": "24576:4y4Y3GypqNCoeHR6MEh59PmUuQGigbrgo1n:/4Y3lpqq3E50UOgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752471, "uuid": "39fcb82e-0b1f-4114-ac1e-4dfc4141d866", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752471, "uuid": "39ee1c90-0754-4013-a9b9-4223691eefe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752471, "uuid": "ac7febcd-68f0-43c2-bda6-e0f60c780613", "value": "launcher247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8de18b0-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752363, "uuid": "d54e9b02-b953-48dc-8d37-1588c90f83a5", "comment": "Malware payload (RedLineStealer)", "value": "d345d714805602439466386913fa7a00", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752363, "uuid": "99508cb8-6a9d-445b-be27-5c30d17e681c", "comment": "Malware payload (RedLineStealer)", "value": "1c93523c7f22acf7d86eec381a81578f8098c65176f198b0557c23fa383a7f84", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752363, "uuid": "fffdae40-6bcc-44f3-bf3c-b184e5fe9da0", "comment": "Malware payload (RedLineStealer)", "value": "057c72bd417b8417025ceea4d9222ab61994b7af", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752363, "uuid": "5f5cbeee-d377-449d-b711-6160acda7c05", "comment": "Malware payload (RedLineStealer)", "value": "ef1063f49a708ccaafb63cc4cf7a8ed195a881a778bf61d416b5e7008444d4c8701041591d7aa7ae611b33c17860a599", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752363, "uuid": "7afab2b2-da5d-43b7-9472-adaaeacb1470", "value": "T1BC252306A5DC9433DE72637014F203D31B36BD516E31871B3746E96F6D32AA1A9B2732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752363, "uuid": "3b00fcd8-b272-4bf3-a3d3-5b327df8db89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752363, "uuid": "03d6d011-50e3-4e77-8195-04dba2c3b2c0", "value": "24576:JyBAQqP8ESWM/ATqgNIAMOgPL02HNuSIXwN/f8r:88vtTqgNIAfgPLBHNumFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752363, "uuid": "9c932332-1b72-4fc8-9ca4-22643f23af69", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752363, "uuid": "f6719762-90cf-4ccc-8b3f-00b2c0e390cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752363, "uuid": "d3dd248e-5156-4a06-a266-42b50338de71", "value": "client395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ae76b1-f8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684764482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764482, "uuid": "ac8055ae-61fe-46ce-96f1-53670de889ef", "comment": "Malware payload (GuLoader)", "value": "2841ee5c1c1e51d5c657e517a0227f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764482, "uuid": "268b6a2a-1ffa-4a8b-8b09-703573d227d0", "comment": "Malware payload (GuLoader)", "value": "1cbbee9b00f9510220882fc5a6daf414800b64d814f9938dace5e060d58e56de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764482, "uuid": "712a8bbb-f226-4f84-b3f1-775141c335d9", "comment": "Malware payload (GuLoader)", "value": "510e8096e9bd54b91ff7f7c966ccd6ed878b596b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764482, "uuid": "c629f3d7-355a-4307-b47b-7b53b059be94", "comment": "Malware payload (GuLoader)", "value": "cca3c7ee1b2fe1448c1349a2a9d5183fc7eed176f34110a2d746a06ab963cdc026915cfb6f4177f3cc6854369f3d2d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764482, "uuid": "881def73-7551-44dd-8921-ff850ae1eea5", "value": "T185F3020673E198BBE16B99B70FB0CBB9D9B67B0656211B0B5F806F541C36AD389071C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764482, "uuid": "1c6ebf45-05d2-4724-95e4-2845a533da49", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764482, "uuid": "77e84d48-88c8-4ef1-bfbe-fdc427bef89d", "value": "3072:1DQkrZoosbIfXJ/ppJCMNOZhwzK9+k/078SZTTcr7wVGOqc9HtcP4aYjd+/Qze2y:1DpoeJFehwQs7XcuGrc9w4a6d+/UEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684764482, "uuid": "e7a4d82b-94ec-432c-9175-fdbcd5122e08", "value": 172580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684764482, "uuid": "d1d43579-307d-4c4d-8b65-eb7191a33455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764482, "uuid": "8c47bba4-865b-4c65-91fa-46e8ebaa5d0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0260ab5f-f8ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684779920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779920, "uuid": "49c5f84d-ca3a-4c93-b090-4eeca99937e9", "comment": "Malware payload (Formbook)", "value": "6d6f8e26015409149146b0632124fafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779920, "uuid": "1074458a-81a7-4f07-814d-48b06ef9904d", "comment": "Malware payload (Formbook)", "value": "1cc318613830f916bdbd91c8bba57d82473262361b46abfb9c41bc4bae0687ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779920, "uuid": "a447a73c-6c24-4245-aad2-1e4b1ba1462e", "comment": "Malware payload (Formbook)", "value": "2c26109d10f4a2c059c47fa0d23e3d1af0978da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779920, "uuid": "8d1eec58-57c9-4c0b-bce0-fc7afec8c226", "comment": "Malware payload (Formbook)", "value": "78fd42aa383d96409a8280a0cd5dc46f0b56969b548bc1555728acab3069b8f24c9e0516d98df2aef16d3a1f413df17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779920, "uuid": "f215fc67-6a50-4ab1-b762-9289ab041234", "value": "T1DEF49C9133B5DF2AD87D83FF46F0608C0BB874067026E11A9F9735D67270B666A48B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779920, "uuid": "68728505-f403-45e6-a988-821c26b763f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779920, "uuid": "c25fc3f5-18ba-4cb9-888d-5316eefd1b1e", "value": "12288:3DX91T3fKaj53zPfbbJdQvtMVQdQTfp6PgqTQJ1x+qDz4Bhm:3R1T3fljJhdVgs/y0D+qD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779920, "uuid": "d42adbe7-433e-4447-9155-b4d559657361", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779920, "uuid": "9ff215b5-e8ef-4870-b70c-648588228a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779920, "uuid": "384d7c15-4c7e-4284-b95f-8feff8f9e9e6", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0eb2e4-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737468, "uuid": "4a289658-e00d-4c3c-847b-05f088ff4c2c", "comment": "Malware payload (Amadey)", "value": "c813e0b4570e0d8c5146ab735d3f13c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737468, "uuid": "928b61cc-a54b-41f5-8d8e-5799da16a66c", "comment": "Malware payload (Amadey)", "value": "1d2461f3b4c400ab9d4a941a9a4c54e697d470621bee3ecbfe0b374ee718d76a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737468, "uuid": "7576ebb0-f67b-4541-a936-388a97dff13b", "comment": "Malware payload (Amadey)", "value": "b278ed04447d5c5a76fd64f840089ed512aabd06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737468, "uuid": "e91915ce-8f0d-4982-adae-bbfc6ee0c595", "comment": "Malware payload (Amadey)", "value": "87dfc437fc30caa2249e7be4d34054e62e3aa4f676e97512c6581ef420939a703b2faa2922cc7258e8bf4e710d7ffe72", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737468, "uuid": "09a2ca5b-6b92-4055-8437-ded0d3f6112e", "value": "T12E252313E6D48433DE712B3985F107870A36BDA10934C76F33467A9E6D736C1A53A72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737468, "uuid": "f05f6458-b5fe-4f4e-936a-f5c64d285127", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737468, "uuid": "f0975a21-af53-4c09-890e-8596862dd210", "value": "24576:7ydABFqt3XPqv49mWkqJi7VlPApimTPEq:udqqtPqwLEPIp1TPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737468, "uuid": "77334e2c-025f-4718-8ba0-3ad6ac1738e6", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737468, "uuid": "ef79804f-eed0-43f2-906c-ff122427c62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737468, "uuid": "0db224e0-d5dd-4978-8a78-ae724c0afffe", "value": "gameplay296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1ab0da-f88b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684751192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751192, "uuid": "76f3e5f6-3f9c-43d7-8495-8866a74b1168", "comment": "Malware payload", "value": "6bf6d8a789f4eed9f946c1b45ba67128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751192, "uuid": "a5b6eac3-10fb-4763-9394-ee4ed546afd9", "comment": "Malware payload", "value": "1d698181db27e774dacc30b210c90d48787f98daf94e2d9fccbc326f3341e4cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751192, "uuid": "64c41687-b022-4f91-842c-b199e069d856", "comment": "Malware payload", "value": "2ed97029ca12a3cd78a5d10a8314587232316c4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751192, "uuid": "ad372f1f-13dc-42e0-bb8e-f110734f749b", "comment": "Malware payload", "value": "e600ed9f76bbce6f3eb4840d6068cd86b8aac0b3d41d6c4c91a4884ac6be670ce53dc093447d2a4ff3cb36abaebc74df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751192, "uuid": "0e8d2438-4476-430b-a965-90274cec43d4", "value": "T1D4F32363B3D36C54DE56A6EBC9DC3168173E81A8803A24FD5B1FCFF70D6A14048A5B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751192, "uuid": "2684ca56-297c-4a4d-8105-bdf443f7169a", "value": "3072:wgrqyV9aJYvs+Jb/WoQhboxybtOSo9uiXvztucaRp4Xl3RFjOfvp3MLCUHqnkqDF:w/yKJYvsebtoiybteuaR+CBGB7kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751192, "uuid": "e96a1c9d-f2ee-405e-b40c-c894b8d285df", "value": 168512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751192, "uuid": "f11ae9a2-43b0-44c7-8959-4ab2fc6d678a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751192, "uuid": "9c4a1edf-f6bf-4d69-ad0a-226c84da943c", "value": "njEESzEdsuVlLeQVHAidKcPRLjVe153.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86a27dc-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752416, "uuid": "ae56703b-6936-417b-b660-e35900b310e7", "comment": "Malware payload (RedLineStealer)", "value": "81041df2650efbe7a478202db46c4890", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752416, "uuid": "6bc99161-11a9-4103-8582-3d70b0d1e4f9", "comment": "Malware payload (RedLineStealer)", "value": "1d91da4982e766b96c89cf031d1d38485fc1b735b07d677c7f49386bcaa65a77", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752416, "uuid": "9b537075-d7c8-494a-aa46-a98977e92cc2", "comment": "Malware payload (RedLineStealer)", "value": "42c387ce7907576a770f7854e6c41eb56cd22c7e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752416, "uuid": "3403ab3c-9e26-4a68-8233-46a288a317f8", "comment": "Malware payload (RedLineStealer)", "value": "00974aefbc00f529608dd4a46a97787a554453619af3a42e0000f741946fda55b9d2c859de9b52ea2352bfadce02db43", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752416, "uuid": "2d9dfef7-498a-44fc-ad30-fb7bde30ae10", "value": "T17D252317AAC8A476F9342F3044F60B931B347DA2597593272B48B89A0C737A0AC7577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752416, "uuid": "0c7ffdb8-9ea9-4d9a-acc2-4a52005af0f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752416, "uuid": "3b52f35a-853b-4c0b-b819-792ad05d3bac", "value": "24576:Oy2PUD9MykJfqSP9ouQae+o8Vqn6+6tuil+IzIe:dkUDyymfqc9ouQcoMqKl+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752416, "uuid": "3ebd38b6-63ba-4d20-8079-91ce666c7c05", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752416, "uuid": "400cf192-b4b9-499d-9bcd-9a4016af403f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752416, "uuid": "420cb022-74b2-4fcc-a124-220f7517705c", "value": "engine637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0503625-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684748026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748026, "uuid": "fef37239-7ad3-40a9-9415-cff367089739", "comment": "Malware payload (RedLineStealer)", "value": "1ab0651aa235df30f8fb90fd8549ab43", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748026, "uuid": "b5710bd8-4d25-4daf-b3ac-999aeaa0adb8", "comment": "Malware payload (RedLineStealer)", "value": "1d9cc3a6dff326194666f5f52eab2e36a62158dbb97e09d85b16df3d5b5c3a5c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748026, "uuid": "8e9771a5-131b-4198-9d4d-a8320d4d60f9", "comment": "Malware payload (RedLineStealer)", "value": "3ea65b355d830e5460e63fc8742478130b96a18e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748026, "uuid": "a336b0d2-bf41-4049-95d2-87ad6404a2e4", "comment": "Malware payload (RedLineStealer)", "value": "4d5e71af11b6a7a11bd205de3fd84f35d24390b5e27f5ec47be46f0e27752d4ccceedc76953bc0b2fbd549f750379855", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748026, "uuid": "7de84967-7d7f-40f9-af1a-03324e050f04", "value": "T10E252302AAD49173C9B53BB049B60BA32B39FCE24DB4835F3B41582A5C73580E575B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748026, "uuid": "9192d59a-27f8-40fc-8e41-994cbaf2511d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748026, "uuid": "e9797d62-87fa-46b7-a68d-de8a7ffdf48a", "value": "24576:OyLWdICMbpFLvBHlwnedPenanSqgpmtmA:d11VjHqeJec1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748026, "uuid": "9e8211a3-3e5d-4470-a712-43f15f6f8bd4", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748026, "uuid": "4f55466f-fbf4-49de-8ce0-4ce9fafe346b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748026, "uuid": "00232f27-1bbd-494d-9f80-78c58d1bea4b", "value": "registry211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12704e59-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737427, "uuid": "0253b85f-5daa-4f62-9967-13c581d9dbc6", "comment": "Malware payload (RedLineStealer)", "value": "1015190834ed2ef9582e54232a336d57", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737427, "uuid": "2923a0c9-db8a-4c58-824b-027e1395b57f", "comment": "Malware payload (RedLineStealer)", "value": "1e244d9a5e260ced196b3e6d4c85b281d3fc7db5fc16c8bb9ddfec770985c50b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737427, "uuid": "e534ce34-79f5-4a46-b4b9-f9be8d94d901", "comment": "Malware payload (RedLineStealer)", "value": "aa8dbb795c4665eed4b2e41b356fe9d6292ef294", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737427, "uuid": "f1ef503e-3bfd-44aa-bc4d-b192880d0a50", "comment": "Malware payload (RedLineStealer)", "value": "70cb653f11f1e1db3d27d850b4fb98d12478dfa2064b214a0200121f40c7c6757929ae57a6f183517535eada09e47de1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737427, "uuid": "0bf6f23f-f979-4b93-8a5f-b30be6896828", "value": "T198252303BBE894A6D9B24BB44CF702C70B31BCD65E749319275BA98A1C712C1A53277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737427, "uuid": "3bdd9c41-5f6f-4b2a-bf78-ee25e0c5c81e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737427, "uuid": "f3dea284-ebf5-4028-aebb-b82a496a41d1", "value": "24576:Uyi9eeYnEdsDtq5A4iQFld5ZUlDZdDweH+cTKHSa:jS1AHQh5KlDZqevTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737427, "uuid": "b775ab63-e2af-46a3-b826-5b615c33e2f4", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737427, "uuid": "dc353216-789d-4bdd-9958-9d0c529fff1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737427, "uuid": "477d35cf-a5f3-49af-aebc-c8008885aafe", "value": "driver847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23c6465-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684762659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762659, "uuid": "c87b3ebf-2900-4706-baf3-ecb0713fe998", "comment": "Malware payload (Formbook)", "value": "da69ec614d0d3885c5a88cac8a75facd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762659, "uuid": "4dc919b6-f464-4eef-8681-b1c235e0087c", "comment": "Malware payload (Formbook)", "value": "1e2470cf5042f4ff269c98c7a33dd27ca36ddeed91d9fb18df591f40a2d18131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762659, "uuid": "6f9c1f20-226a-4d7f-a412-53566c7e82ff", "comment": "Malware payload (Formbook)", "value": "19508ae57240da4c9b69ed9bee3d74a4db6d4fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762659, "uuid": "f82b92e3-313c-48f4-838c-b045670e397f", "comment": "Malware payload (Formbook)", "value": "169fd32764d32a436a817cd60ea09ef54da9fe0b67a57c8894b4ea06c821fdc648de6e5f4339bb4e7c4d5ca0141f134e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762659, "uuid": "667f5c29-b4e5-4bee-b893-94aeb50894ab", "value": "T1FAF48B5633B57A21F47D73FD0119638CCB39B44A2122E21A1F5A39D056E27EB770A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762659, "uuid": "4935eddb-fe1a-4259-9151-25b8ffe4910b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762659, "uuid": "79814576-782c-40e2-ad82-7b0c2d767988", "value": "12288:yvV+s1bSQT6tjjdB4Y08uQcdcU00f2WCYO+DDQ6ZI7XpiKdPhBxz0AwPg3BqPPw4:ytCvuLf2YOjKI7kKhhBWA0IqPtfGH5er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762659, "uuid": "39d50b2a-1330-4436-9fa6-b29efc22c34d", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762659, "uuid": "959797c9-1f54-4110-b7ff-a6aca2d7ffae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762659, "uuid": "22cca27e-64c1-4033-a9b8-0bdf7167c99a", "value": "Halkbank.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7302b44-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752387, "uuid": "4a6b3e6d-2766-42f3-a8a9-37c3836f23c6", "comment": "Malware payload (RedLineStealer)", "value": "38a3fb525ad43da0dad7d339927cddf3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752387, "uuid": "04af2daa-47af-40fd-b41e-5991f22ecf96", "comment": "Malware payload (RedLineStealer)", "value": "1e77168ea09fb7dc6ae4667306d1a8982bd634ae4ef4615225c169b12ecb50e0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752387, "uuid": "e4f0f0a2-e230-40fe-80a9-8832189e5518", "comment": "Malware payload (RedLineStealer)", "value": "b5e736c5c82f8e5e97263600fb94c22554aba083", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752387, "uuid": "c30fc86c-2db1-4e3f-b782-14f1514592ad", "comment": "Malware payload (RedLineStealer)", "value": "b79888ed1266a79d842f14c47de70161ed738f402dea59de765409a013856997964d46bf31fe4a9855dfb178313a52fe", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752387, "uuid": "8a669cde-f6ce-41cb-86c2-74794643e4d7", "value": "T1DC2523229AD804B3E932333455F947D30735BEA08C75D36B2785AC186CF3AD5B472BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752387, "uuid": "cfb6acc9-f46e-4a6e-a6a1-9b685f972db0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752387, "uuid": "1d1931a7-a52e-431f-af46-6205fcfb5c65", "value": "24576:AyqcZgdMC0M6qk6d1jT6Cf46Q+QN58mZtQUsd:HxZcv6qpd1jGNjnDfQUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752387, "uuid": "14004903-c5c5-4c19-bd54-35638d184119", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752387, "uuid": "a2dc6097-454f-4a01-96d6-f5c532544712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752387, "uuid": "a726394c-3bea-49dc-9209-808b2de9241b", "value": "converter478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c91866-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752247, "uuid": "a6f1b29c-d6fb-4b29-98af-177fe012f177", "comment": "Malware payload (RedLineStealer)", "value": "3f5d3abf4576f379a798186873e8475b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752247, "uuid": "224d3848-a6a7-4618-86d3-c161c885a730", "comment": "Malware payload (RedLineStealer)", "value": "1e77e106af0c61aee6cecd332e39e90c0de6b4a1d6b56fc7ffce230a71e6efe0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752247, "uuid": "f99554a3-5925-4a5a-808d-16b717650831", "comment": "Malware payload (RedLineStealer)", "value": "363b36b63272e3fa7847641e008cca7879883c25", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752247, "uuid": "69f6336c-3310-482e-82d8-81f28827076a", "comment": "Malware payload (RedLineStealer)", "value": "ca1cab0516b46e37bd6bfbbffd87ae456a5b7914c024deca81cc4a963d17f8ffc61b26f05d695208fe04e025e0730f06", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752247, "uuid": "30123fb6-5d1f-456c-886e-39376cb875b1", "value": "T1C0252316E3D5946ACDB46B30ADF712430F37FC94987891222785AD2B1CB33A568B6733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752247, "uuid": "e2f0abb3-6809-4185-aeb6-78568c1c94aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752247, "uuid": "50322d81-b1f9-417c-83bc-e0330b5b6e66", "value": "24576:EylWdDLgBqCJmiqoTzLmJQ92ZI3U0giM69Ep:TWgqXKXMQ92DiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752247, "uuid": "bc83561c-b3f6-455c-8a70-129279d740a6", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752247, "uuid": "015d43a4-6597-47c6-aa59-2b5cf3e4ac3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752247, "uuid": "5c5cfac0-2c6b-4072-94b2-dc7b62963a69", "value": "35352876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a46e45-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752376, "uuid": "4ecd1c5d-808d-42bc-81e4-ff37739983ce", "comment": "Malware payload (Amadey)", "value": "77bb881b035660759f1672c4e60cc771", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752376, "uuid": "9fd0aff2-adb6-422d-ac0e-4ad8057c6746", "comment": "Malware payload (Amadey)", "value": "1ea0e9dc01f94bbaaa5856585a92faf87fdb41c1f1efea05298d0f5a11bc10f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752376, "uuid": "a7b97577-c5bf-486b-aa45-00f94a732794", "comment": "Malware payload (Amadey)", "value": "37449f14b6e0602b75fece6861fbeee10d4bebe9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752376, "uuid": "1df7207e-fc4e-4583-a927-fe7c333a6572", "comment": "Malware payload (Amadey)", "value": "de57947506db2ceeec5064a4b6fda7be90b5faa16cd9c6725c3029a07d8463e4c2aeb18ec9523c102de7e4024debf31f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752376, "uuid": "f1a95aca-fd17-4696-86d0-d78985355ebf", "value": "T1B9252316A7FC10B7D974177058F60AC30B36BDE29A34462B17176A5A18B3AC49931B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752376, "uuid": "6f998e93-6b0e-4e31-8590-26bdb42a5817", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752376, "uuid": "72a6cca4-b937-4eca-b185-ab069e6e86b1", "value": "12288:hMrdy90adexL0hwNQzlSMUmr2Remr4v6odNE5ZUbomzXfvA0YP6Ob3PyHed1PsXQ:gyoWv3mkvfIU8mzXfvePbfEeDkUP5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752376, "uuid": "19c3a79c-ed55-40ca-bcc2-5d9fbef29bfa", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752376, "uuid": "81659ce2-8eca-4222-8661-434e29132fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752376, "uuid": "ad988fad-a4ba-4204-960e-dd86e662d147", "value": "controls139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8eebb17-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738619, "uuid": "1e38ffdf-db9b-4ea5-aa7a-81b8867db89f", "comment": "Malware payload (Amadey)", "value": "83b46c876f495b5815c6cedc695fb71d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738619, "uuid": "27396152-3c12-4b8e-b9e3-5026efe99994", "comment": "Malware payload (Amadey)", "value": "1f9f6c30d2284bdf8585a7d5fda7d191bf432f41bc24fa7f64e53cfcdedd853c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738619, "uuid": "10d658f4-614a-4fef-95f2-22d41d620181", "comment": "Malware payload (Amadey)", "value": "b5440c0970c7f157e20ecf7d10a1ba008ac09add", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738619, "uuid": "d811fa2d-2953-41da-abcb-496e1dff2851", "comment": "Malware payload (Amadey)", "value": "44a63851b6113917d92f3b84ba2eb051831a257bacc51039f97f515a4d796920cb26aff71af87377b6b0e9164ed6f108", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738619, "uuid": "6c41dde0-5fe1-4a18-8b3d-af18149cd2f8", "value": "T1FD252313DBCCA879DCB667B059F706C30735FD619478A21A7781AA6B1C73584983233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738619, "uuid": "ffd27c2b-30ae-4a03-8b22-e3ac7b6b8c95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738619, "uuid": "92bc3cd4-e5f7-42f8-8105-52486e23f7ca", "value": "24576:yymtOO07pgLqOSDe16qJOaHXyfmvVm3IyZLFzIigVO/YsA:Zmt107pgLqOSDe17fHXyfmkLZ5sipH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738619, "uuid": "4e0d9c75-8e14-475a-972b-02c3d7a15c6d", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738619, "uuid": "769f1f03-f748-47f1-8547-207debeb0c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738619, "uuid": "2329f6d1-8364-4b76-ab67-21a5590c5748", "value": "1f9f6c30d2284bdf8585a7d5fda7d191bf432f41bc24fa7f64e53cfcdedd853c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12728bb9-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752459, "uuid": "d372f166-bd7b-4ae5-a250-73e57bc2be6e", "comment": "Malware payload (RedLineStealer)", "value": "40b0d6c79816527d8fb2de9da1c8b449", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752459, "uuid": "0bacd7c6-8692-45fb-a149-d76739c9a7fe", "comment": "Malware payload (RedLineStealer)", "value": "1fd8d9c48073071f20dea590d9052544b053cfdef11ce98c9d65de5c89dfd04f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752459, "uuid": "a9915060-076c-4df4-98a0-bfcb3829511a", "comment": "Malware payload (RedLineStealer)", "value": "e1c002007b5e623f23724d81f7c5593d3b1952bc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752459, "uuid": "3ceca318-5c79-454b-bd15-3470d4d04a53", "comment": "Malware payload (RedLineStealer)", "value": "09dcc7b393edb05130e5f4eac55e3f7b93c13d1774b4f1eb2346c3924bb08c236b428ba59ca03572cc8b0a5704239166", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752459, "uuid": "0bacdfd0-a2ff-49e5-80f6-45ac239d894f", "value": "T134252367BAE894B2D9BA27716CF602E30736FC615C20737A3315496E1C732E0A539367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752459, "uuid": "30422a39-ddf5-4071-932e-985f2226e402", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752459, "uuid": "f139e218-e0b2-4ab0-885c-91209fe92a1f", "value": "24576:vyeVdP8Squ9ZNdqC+PV7/yEZp3Mgbh2sCU:6YdP8x6DdqC81bh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752459, "uuid": "4a55f712-4a39-4abe-99eb-e3bce1baee6a", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752459, "uuid": "76437477-19c8-4d71-bbbe-e30dd63d8eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752459, "uuid": "6b282687-9dff-4e5f-a2e6-68c4da6c1ba2", "value": "installer116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93414e2-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752390, "uuid": "a475cb82-5495-48d1-b059-a77b77a36b8c", "comment": "Malware payload (RedLineStealer)", "value": "e2cc1b06f3c5d712b91191932190fa7a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752390, "uuid": "c4423806-6436-41e5-8861-a4f064876f06", "comment": "Malware payload (RedLineStealer)", "value": "20dd7b332eea6d02c29d6b0a290a6fab56eb1cd0788bd55b2b5ebd201c5003ea", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752390, "uuid": "f78d9621-91ab-4d68-ac29-4ad74192f16c", "comment": "Malware payload (RedLineStealer)", "value": "1957e15fb78baa529d6130159d4d6909f3c2b51f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752390, "uuid": "f1cc4550-ee81-415c-baec-0428ba8c39f5", "comment": "Malware payload (RedLineStealer)", "value": "7d8f99dda6742a7ce150ae47228ab03fa279786b0922caa312f306d803b4264ae175bd5e42beceddbba2558f7999c368", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752390, "uuid": "46d9b128-2ebe-4411-834f-db24d30eecfd", "value": "T1EB252316F6D95463DAB823B044F71AC30A36FCB4DE78935E2398699B3C7318466B03A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752390, "uuid": "7232967a-c856-46f9-8939-fdbeb627dc95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752390, "uuid": "c4e4bf23-e55c-4c09-994f-832e10359690", "value": "24576:iy6WNKKh8qk5sxSXwLAoPGJUnALWmZtfTD/rJTWZ:J6Ol8qEgPe6GBTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752390, "uuid": "f42f9f83-84d8-4595-9086-9d8372aed283", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752390, "uuid": "805b7e69-8947-4795-9730-2a34d15f9e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752390, "uuid": "bf3ac5ee-ff05-4d0e-8343-694d99466284", "value": "debugger308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee254db4-f890-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684753687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753687, "uuid": "67970064-e014-47a7-8584-4dce6d77e202", "comment": "Malware payload (zgRAT)", "value": "38891367c62a42639dc9aa7b37c11903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753687, "uuid": "6515e4fa-2c6d-4bb2-aa71-8ffaf910bd45", "comment": "Malware payload (zgRAT)", "value": "20eaada2d9f224b14c08cd25e73332e4d68ab284fb1df3b1d01b4b27b67a6fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753687, "uuid": "1c230214-af86-47cc-bbb9-544f057edc9b", "comment": "Malware payload (zgRAT)", "value": "590d113d3356d0cebc55a735204ef43005b747a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753687, "uuid": "9f489a32-40e9-46de-8c7d-1b60d0cf1227", "comment": "Malware payload (zgRAT)", "value": "519ff58c4728f073d16c12d89e1cf7411a0c3a09124b5fa4a89c323879100c98d54c93ec862e45c7b6140f4347dd8e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753687, "uuid": "3aa43916-5a3b-4c0d-9658-dd956921c194", "value": "T1E56402857BC74851C9EEA131A1C2934522B9DB8F30E3D78671CC17978E533C7876B4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753687, "uuid": "0d3b3b51-a429-4ccd-a165-ae2447b4abe1", "value": "6144:2w2wWkGqQFmiYJBoD6R+G1efWwuI8q2BAhbG3fZymuFTHpxYBXXtnRU9kX8CT4vF:2wWkGfFkvoD6RtYewudq2BhSFjAXRRxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684753687, "uuid": "ee0ec1d3-57dc-49bf-b36d-dc1ab15f2324", "value": 336448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684753687, "uuid": "f9c8f2c4-47ae-4409-aa35-8d28c2cc62ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753687, "uuid": "c3f6ac50-1cab-4543-83b5-957ec06f4067", "value": "OUR INQ 1000-1402152.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee37465-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752319, "uuid": "7960fe9e-ff5b-497f-9920-bbf93c1b8949", "comment": "Malware payload (RedLineStealer)", "value": "95b3e6077d5a8eb7d694c644dfb934a9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752319, "uuid": "45e6ac61-d7ad-452f-ad06-63113478b4db", "comment": "Malware payload (RedLineStealer)", "value": "219257cabe493eb33f02638da7f56ce2550323fc08a8a6594b64de6d987317c9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752319, "uuid": "36e18132-55fa-42af-b2f2-d7a7c3ce8248", "comment": "Malware payload (RedLineStealer)", "value": "248a548998ee73103719bb1be0c5930eb14f68b6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752319, "uuid": "ae50feb9-8d68-4b7f-8c51-b92aa86cd67d", "comment": "Malware payload (RedLineStealer)", "value": "c3e7102e0687a9cd029242011fcf1a32552f723026f903a2aa224d9696f21114f1170ca53e2c8e715fcf8af3b108f151", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752319, "uuid": "f2d09868-cd9e-497d-84a1-fdec5107d359", "value": "T116252353AAD98472E87D1B3068F74BD31A36BE209DB843273705AC9B487369C50787B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752319, "uuid": "c1ac28e4-fff2-48b6-bbe7-df6dd2c860ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752319, "uuid": "c9f848fc-8395-457c-aee4-702caf0aa988", "value": "24576:9yQmN/gPEmr+mhIyC19joDTjlAT5QXGmd:Yd/g3CmhIbETCiXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752319, "uuid": "09cd93de-625b-4fd4-8327-872f9244b1d2", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752319, "uuid": "3b6cf9bd-073a-4969-8769-40345649dcac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752319, "uuid": "5cbca843-66f7-4192-94cb-864d2fd39b6a", "value": "achievements437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c842ef8d-f85f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684732578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732578, "uuid": "e861f758-5f0d-4dd7-b38f-4405a9e866cb", "comment": "Malware payload (RedLineStealer)", "value": "e06270ff0394b5fe5635369761647075", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2323", "colour": "#CC82B9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732578, "uuid": "da89e9e5-c1ed-4aaa-afca-08cbf25eb75d", "comment": "Malware payload (RedLineStealer)", "value": "21d9448dbdd97d74e6024010a74b0652dd7841de5c0529c28ef563f649a8e777", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2323", "colour": "#CC82B9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732578, "uuid": "b54d4748-a05b-4503-bc48-4c3087de572c", "comment": "Malware payload (RedLineStealer)", "value": "990147dae75522b68c7bcd9f66c4ab6f0011ddd0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2323", "colour": "#CC82B9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732578, "uuid": "9d87a9ee-e0fc-4003-a4bf-af2b9565d76b", "comment": "Malware payload (RedLineStealer)", "value": "8e779546409d122744882b124ee289cb45e5092efbd077115060f4f6da6d466b71aa1a584273173458f2ff1085ddfe0b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2323", "colour": "#CC82B9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732578, "uuid": "087d8105-0a30-49f5-8fe0-16ba04a27954", "value": "T16A0533F30D68D97315994290E33BD84E9F738D87B8BA0C0D9F8FE1696990DEAA51C085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732578, "uuid": "e46576d9-647a-456b-bfea-e2afcc020ef9", "value": "12288:82IpCvaca2YubFR8l/ZCg1eHUxpvxGfiCO9FijzTlFKs2blkdExfDW9d:WMaFLubFCPIHU4fq0jzBFKFblkdExfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684732578, "uuid": "86248850-490f-4b74-aff2-1f3818a23443", "value": 841445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684732578, "uuid": "6095b1d8-9bba-418f-a908-1eca2801f80f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732578, "uuid": "cc4cab9b-5b69-4818-a6c0-ee32f7ceee7d", "value": "InstallerSKl.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cb8bfd-f8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684764620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764620, "uuid": "3232c196-b122-40f5-9173-6861b85c3932", "comment": "Malware payload (Loki)", "value": "b1aa4f227fc62318d5a720e2bddbf206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764620, "uuid": "44f5f917-53b7-4b88-a20e-f50522e3b769", "comment": "Malware payload (Loki)", "value": "2200617356a044631447d18a7157e8e73999076a93e065c7db2d8aafdef9fcd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764620, "uuid": "241a0825-3572-4970-ac5c-7468445a3912", "comment": "Malware payload (Loki)", "value": "1e362a8c3e0d84d1ba4cae8fbb33b27de6d811aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764620, "uuid": "419a22d2-adfc-4705-8a73-c7f3ca2b4363", "comment": "Malware payload (Loki)", "value": "d4f14113d8bbfd483c36f0e5132bc75d9b59c8033962768bdc7d973ffc7d518e44b4ed94cc4661e6536eec0b7d2c08c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764620, "uuid": "b431d1af-47c2-481b-8150-25ef723df28d", "value": "T1E2C4E03027E9C70BD16A523880E1D2F16776DD84B576C7D30EE9FC5FB68A3A21322256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764620, "uuid": "ed1fd5a8-1c60-44dd-98e1-fd517378c926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764620, "uuid": "5386e656-b976-4470-a556-ddfc5e78dba7", "value": "12288:alSgit9KhYn6+arRb9O48amTFCvIKmc5gQhOt+:aUeX99xmiqc5g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684764620, "uuid": "fe060abf-a517-4463-aa27-2a8f3711c241", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684764620, "uuid": "60a3434e-644e-432e-8ec6-06f962889257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764620, "uuid": "8ee66e97-d75f-4a34-8a83-7197369d7d00", "value": "b1aa4f227fc62318d5a720e2bddbf206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98b6a46-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738620, "uuid": "ba4e546c-1e33-49a2-9a6f-2afebcf65a08", "comment": "Malware payload (RedLineStealer)", "value": "58e3377bb274511125b6a2ee4b4de4d0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738620, "uuid": "a378bc5f-c0e3-4c98-806a-4073504adef3", "comment": "Malware payload (RedLineStealer)", "value": "22431f71bda13017de5efde7d966451f4f909cd1e0e5cf13e27905a09d6fbd9b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738620, "uuid": "6bc8c77d-e79d-4897-963b-ee759a72737e", "comment": "Malware payload (RedLineStealer)", "value": "e3dd2494ea453bc41fcb5854a75eb7806dfe8cf1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738620, "uuid": "997f27e3-fb02-4c24-b2e9-9ad56e7a164a", "comment": "Malware payload (RedLineStealer)", "value": "35538783e8e5a6db6cb51257769ab0ba052c859c395e74c4ae5a735110c6fcaa099400540b9123c6ea4624dd72cc1c8a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738620, "uuid": "b44dfb1e-c151-4083-95cc-ebdd7d7367ab", "value": "T1F5252347A7D99033DEB0573024FA26C32937BDE1A93453AA2385A86D29737D0F4743A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738620, "uuid": "1a5c1d88-6424-4d38-acbb-9bb36f8db81f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738620, "uuid": "1a5dabdc-aa52-451e-8312-7ef5071cd032", "value": "24576:cyGkgw9luvA37Ybpmsm+DdsL8Sx3r5qOSTnrMMA:LROVDmcdsL8SRr5qTrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738620, "uuid": "7f37abb1-d5e6-48c8-8a8e-f3a1e40fa643", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738620, "uuid": "e0f17c5b-b6ee-4418-ac37-884db19e4752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738620, "uuid": "e7a143a8-638f-48c9-81ac-b409297fdd45", "value": "22431f71bda13017de5efde7d966451f4f909cd1e0e5cf13e27905a09d6fbd9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82ca560-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752308, "uuid": "9fcf1cda-cad0-490b-99f0-c4419664d6c8", "comment": "Malware payload (RedLineStealer)", "value": "dea5ea2d4436405625b19479b19c3c56", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752308, "uuid": "87264a92-ff4f-4308-9817-ba1f7c85251f", "comment": "Malware payload (RedLineStealer)", "value": "229851c7fcb05f163fc909fa8d68b9ac06a3bb4d7717923cd932e7924224afb2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752308, "uuid": "adca2b57-dd23-470d-a8bb-4ac5b685fbcf", "comment": "Malware payload (RedLineStealer)", "value": "d2300c0d775f7915428b6009c92d45f60de38156", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752308, "uuid": "85baf5a8-6ac4-424b-bdd6-a965edc8a7cb", "comment": "Malware payload (RedLineStealer)", "value": "fa6adb6607f15ee765b87356ab3c675c9b1feff7a9649887cc208f65e84501e164b3de7f9d6350c8f2c26616185907f9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752308, "uuid": "1ac01df1-d6d9-467b-ac30-66c3bfab161a", "value": "T18525238AE7E48472ECB52F3099F807D71B3ABDE0A875871B2701D8599DB3A81487531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752308, "uuid": "3a8d9779-b53b-4c90-9641-00b0d4eae4e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752308, "uuid": "88646e85-8a5d-435f-b895-b4e9acb0c7e4", "value": "24576:Xyfp6JBpdeT0RTDuzqbZHvmTBU5xGqyObrez0sgzXVTn:iMJwTDzqdHvmdUHG8bre6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752308, "uuid": "1e45609e-852b-4a8d-9122-b3410f34d03f", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752308, "uuid": "6525ed79-9100-4346-a938-33e2c548f720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752308, "uuid": "8f815a14-564d-43ba-89ab-97c15f2d5b15", "value": "Startup514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76258915-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684744896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744896, "uuid": "0004943c-20b5-47fc-bd43-02f0c1bd540c", "comment": "Malware payload (GCleaner)", "value": "26d0ad2cd1511f032d1a1359d8133643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744896, "uuid": "d298252e-bdd7-4236-84ec-ed2b828fb133", "comment": "Malware payload (GCleaner)", "value": "229bc5e0aefd7296641a5d4788856514eace642ae482698a660767a1ec71850e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744896, "uuid": "ffc0fa09-8979-4c94-969d-900772ae6192", "comment": "Malware payload (GCleaner)", "value": "504be79340962135f019e5cfdde646fea3e6a643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744896, "uuid": "85e33baa-bbfe-4401-bfbe-ccae0bac8f3f", "comment": "Malware payload (GCleaner)", "value": "bb1e250534d4bc498e668849d4ff37fa93b6700bce4455bfff9d8790d286a4c2ef54953edd436135dcb1806a9d47cfc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744896, "uuid": "735b2d3e-34f1-49d5-89c4-0873a4e1ce27", "value": "T1EA948E439291BC60E92567728E2EDAF8362EF9504F1837DB22186EEB19711F2C533357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744896, "uuid": "67302628-c434-4a57-847b-d52bab110bd4", "value": "ae9915252ab3bdca2ee2d4adbefb02c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744896, "uuid": "c7da782f-2bc4-49f9-a265-335abd98e929", "value": "6144:nhs3HmD27oKlM82jH2VMKacrr4AwXf4+kZYGTst2n4dZ5X/qTdKm:2He2EQF2sZnbInkZHW2gX/6dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744896, "uuid": "5e0879b3-5904-4d4f-921f-06bd878b2cf3", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744896, "uuid": "02f6d027-cbe9-4779-8553-d6d2829504dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744896, "uuid": "4e87379b-eddc-4ea4-9c7d-d30950439f6c", "value": "26d0ad2cd1511f032d1a1359d8133643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb12b4bf-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684737790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737790, "uuid": "41aef38d-f05d-4ff7-acc4-9e647ba7da87", "comment": "Malware payload (AgentTesla)", "value": "c3681f1d0664c277cec547bd6f1824ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737790, "uuid": "b1c0ae72-892c-4daa-8a22-69bd3c055ceb", "comment": "Malware payload (AgentTesla)", "value": "22a5519a921481a059e0dda9325b40aa6e0a7709a0b969d3821a26bed2753b89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737790, "uuid": "f014d479-cc8d-4811-98e4-6bc6ea851a4e", "comment": "Malware payload (AgentTesla)", "value": "91d1b3bb71bf0e1d80c1c7b36eabe5300743389c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737790, "uuid": "9e36701b-8787-4689-acf3-e79da08eaf24", "comment": "Malware payload (AgentTesla)", "value": "e6535f8a1c3b2915b8680453ac751b70b49ad3dd631d416967a65a50bc9adb783db94405378b9ced61eadbe88af11716", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737790, "uuid": "9dcf9eed-1faf-4c94-bc14-91464d914094", "value": "T194E2195AE79F02688F4113B2271B0E8996BDB23EB35551B1785C933433EDC3E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737790, "uuid": "9d2084d5-5791-44db-b92e-11ef9989c4df", "value": "768:BFx0XaIsnPRIa4fwJM0VWz7N3m5YmGuO9psPLxRx:Bf0Xvx3EMlz711jsPVRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737790, "uuid": "986852b8-78de-4916-986b-ed860b1a7e68", "value": 32822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737790, "uuid": "5f0990b2-c553-489a-b732-bdc41b9e6458", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737790, "uuid": "bfe284ed-71e1-4863-a34f-e7d7ba48c575", "value": "Order-P220523.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c00795c-f834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684713874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713874, "uuid": "e3514241-74d7-451e-8596-0f07d399aef0", "comment": "Malware payload (Stop)", "value": "3b8bad21fa80fc43a512cc96223991f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713874, "uuid": "c55830ed-0371-41a7-aefc-99112e575868", "comment": "Malware payload (Stop)", "value": "23185e86c704b52a6bf4d9d07c9eea4d66a86256a3d25e04f0e0cb0620790b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713874, "uuid": "38d7c290-9774-4a20-86f8-46cbfa62cdaf", "comment": "Malware payload (Stop)", "value": "9da61dd7bce77c79842a8f26a2df7dd53d320b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713874, "uuid": "3e7f609a-0a75-4ec1-8724-dd516604a570", "comment": "Malware payload (Stop)", "value": "a05d3e96a40b1c989fec921e035e53d7a8d1ec2369f987d076a5d967fafd11ef3b96719a815ce153a539979eec7d097e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713874, "uuid": "58e7f2c3-4745-430e-beac-b43ff796a06a", "value": "T16A05F103A291AC61E6264AB18D2ED1F4751EF9608F152BDF2A186F2F14732F6C572FC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713874, "uuid": "ff062075-6dbb-4701-9953-c27987865bb3", "value": "ad1da3007d39bc21ababd35f90247ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713874, "uuid": "2fe0661d-6210-4793-9365-54a7db56181d", "value": "12288:IARVj4YDfedR2JI/MhW+K5cxgQ3fs0mL0aNDynFJYRu02GtBq//bveOMKmI0q7:IUj4rdR2G/MhjkI6YFO80Fo7/0q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684713874, "uuid": "b76cc530-abb4-4dd5-be44-22549c3ddbc2", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684713874, "uuid": "d75d970c-72df-4f8d-90b8-b6b488bc1699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713874, "uuid": "c1ba3aca-ea4c-4ad8-846b-14c3a679548f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c015ba6a-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777232, "uuid": "c965d3c0-d15d-4b75-a25f-96370cd2d8df", "comment": "Malware payload", "value": "a26056d4e9072ce6d33fe432488cebe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777232, "uuid": "50efaa17-81f0-4741-8a24-c1c4ba339bf9", "comment": "Malware payload", "value": "2325d938e14eb391e31417ba5947be01ab019835d659761f7e2e25089bfc58ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777232, "uuid": "84b80e48-2aec-4050-b18d-5fc237efec18", "comment": "Malware payload", "value": "6f190f63905cfb0613e2eb08ef3c76d4da7420b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777232, "uuid": "78fa45f5-a092-473f-9067-afd3e18f9f56", "comment": "Malware payload", "value": "98a5577d747aea4ac47552298c89a2a67e7470caec23c3efa8898cc26b7c579c224064fe35d3125bd6188ca936a1d2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777232, "uuid": "51f10aad-4452-4663-a208-b4dbadf66f03", "value": "T1A452BF8BB34A8EC2D87900326F0FD518E21CB6011A395B577809DC273D3E318AAB5295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777232, "uuid": "01c0101a-30b3-42ac-bac6-783b35397f97", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777232, "uuid": "4d379151-d774-410b-8495-68c3a2ed788e", "value": "192:OHMFzwFtKyvteS7rSDlGX6nghDNYZhlsQKnhYykokVnuqZ3iKWe028OX:7BotxeEWJGKLPlsQKnh8oMuczW2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777232, "uuid": "1215394a-a18f-47d2-8b7d-7cf6b5b5c3d7", "value": 14518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777232, "uuid": "d6f257f9-b3cf-4e1b-aba5-c9f5309363cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777232, "uuid": "f27ac97b-114c-4cdd-85e6-090e9f1c5646", "value": "SecuriteInfo.com.HEUR.13105.17052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a194c13-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752230, "uuid": "d38e6e42-1ab9-4268-b340-03c2e00ff067", "comment": "Malware payload (RedLineStealer)", "value": "803e34490011e68939d48d00e80fff67", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752230, "uuid": "25c0fa5a-78db-4ea9-bcfe-6de12d121a98", "comment": "Malware payload (RedLineStealer)", "value": "2496c73f134bd37b04abaa12e9915a14892728f056a6858279dc0942a6af4ab2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752230, "uuid": "d7377a34-ec2a-4832-8890-5a4012fd67c8", "comment": "Malware payload (RedLineStealer)", "value": "cab0aaee773482b51e40906b44dd12ecd0c10012", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752230, "uuid": "a3d02096-61b1-4310-a848-675a7d74d845", "comment": "Malware payload (RedLineStealer)", "value": "487d0f17f3a882f76790a9e5b5d19c9c6ee530a2fd6aeb038e78a290e4a81fa89bd693bc1eb29f9518df84b5384af632", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752230, "uuid": "3db2b417-938a-4a67-acd3-785e30bc17b2", "value": "T1732523039AD8A433EC7527B0A9F602D71A75FE42C9A8C33F27919A1B4433684B935777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752230, "uuid": "20c414a3-b88e-428c-96bd-6628590e13bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752230, "uuid": "b1972443-57d1-4bc3-8216-d04b7095a7cc", "value": "24576:wyV2bdmk8CEVNq75sQucaGf69PJa6UGaet/:3VUdmk8VVNq75hu/U0NUBet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752230, "uuid": "30329f9a-e804-4c2a-8271-d53d03a49c4e", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752230, "uuid": "5fa5d442-6dd2-4000-b2b7-a8817e4008b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752230, "uuid": "7681400c-ffe4-4a32-a073-b744d3b86c5c", "value": "2724243415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae94fc7-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752339, "uuid": "ba5cff0a-efe5-45b8-b37b-46fe4f3d1bc9", "comment": "Malware payload (RedLineStealer)", "value": "6946c430578bec85507eb5e915b9422d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752339, "uuid": "c21984bc-31f2-4e85-a042-a82f59f5a2cd", "comment": "Malware payload (RedLineStealer)", "value": "255ebab39a3c458e66495029acd0b4359c4b9c588c75048c9f60b8453daae237", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752339, "uuid": "2787dbd7-79bb-4fdb-8eb5-f616ed9194da", "comment": "Malware payload (RedLineStealer)", "value": "a09d81fb453abcc982de3ae66425074729244a50", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752339, "uuid": "0dccb92a-4253-47fc-95ee-8f4e07a171b2", "comment": "Malware payload (RedLineStealer)", "value": "1dd0cd8e2935b0fa80ddc67cd0e0bb88959b1121b388ae9e2029c0ef75099db4e7af4a0f86df8dbe335bbbf021e5adc5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752339, "uuid": "379dacae-b47c-4059-80e3-52a68eca22da", "value": "T125252303ABD88162C6F5177098FA12D30775BCF18EB8C3672399998D1DB26C49C717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752339, "uuid": "294c65df-f701-4028-80b4-cabbad609ad5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752339, "uuid": "108eb2b4-6b5e-42f0-9623-24510ab2fbca", "value": "24576:HyvZ1wcRxfBrtyvmRBvX/5O0EZ0t64/iwAGGnX:Sfwcn1xR1vk03t64/XZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752339, "uuid": "462fb9fc-c0a2-49a9-b305-c92d698b6655", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752339, "uuid": "27b0c452-ee9d-4d54-bea4-82b4e54f00fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752339, "uuid": "7a071fd3-8dbc-4015-9f0a-77e8f66ae6ad", "value": "backup701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27062fda-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779552, "uuid": "e78e285a-70b4-40c1-b425-fdc1a0577357", "comment": "Malware payload (AgentTesla)", "value": "9798656cc43b702c0cd5c34500a57939", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779552, "uuid": "38c3beaa-f0b3-4be9-a7ee-f9e502119145", "comment": "Malware payload (AgentTesla)", "value": "256ea055c6552920ec84ce91c5e9caae6bf9ed5a262c1f237adf8be1a99e8272", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779552, "uuid": "3e57002e-16e8-43f2-a023-1a94bcfb7c38", "comment": "Malware payload (AgentTesla)", "value": "38834807d29625561a5fda2b8e7cbd67c8a2d5a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779552, "uuid": "8e77e04c-bbb2-4622-85e8-bb854d5c46a5", "comment": "Malware payload (AgentTesla)", "value": "9296c72c993e8a5c0c0e90a4e7e8670e2c0059ce1d07eb9f6f3439f9ba2218bc72eea66dd927079bc0d02e3e5be92457", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779552, "uuid": "133d71e1-367c-47b1-9e3c-0c8f7cd732dd", "value": "T13FE4F1D216949C15E65A4FB85EB3E23413B5AC60EF27834E64F02C4B7C6AB817B05BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779552, "uuid": "315b9b92-1d78-4a32-b51c-15a5f342aa08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779552, "uuid": "566ef35e-55c2-4fe0-ad27-6f3d69c7e27c", "value": "12288:ATWx0YPX/NqPs9+graHkksoRPNgvlX5U2jYH4EfsVtVSBUXTFV4o:AT9HPs9FHUOXq0YHnEftjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779552, "uuid": "81b5f263-1a65-4fe0-a095-5fffbe12a368", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779552, "uuid": "ba7dc00f-cd6f-4a87-af1d-e3156b52543c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779552, "uuid": "c6407261-930f-4347-afd9-dbf853dc8318", "value": "TKHA-A88160011B.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0435da52-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744704, "uuid": "f648afb8-9c66-4bfc-823a-f71b6700accb", "comment": "Malware payload", "value": "6c1edef12a2878dc079e5a5bc4dac9e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744704, "uuid": "1f682ceb-c625-4adc-8728-1af4f37dd429", "comment": "Malware payload", "value": "25c4dfdcad04e0183a782ad66435b687e08c27639eb6a3c75bc7122deb2ddfd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744704, "uuid": "17073cd0-f459-425a-a7b6-0e8831c13eaa", "comment": "Malware payload", "value": "e9a70ccb17ae821fd4b491609423ff2bbb32ad8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744704, "uuid": "c5f4a23a-e28b-4ccb-8dc3-20f039f30ade", "comment": "Malware payload", "value": "da9cf042eb181f3b6369c102afe73a1a8b5e48541409fb5edf7629005579cf36e79db897165367f4523ce854719caae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744704, "uuid": "cda3a7c1-e830-412c-882e-d8d28f1ba4a5", "value": "T193252343F3D9A071EC77673048F601C31676BDA09D72961B2B42E4AE8EB12D489F6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744704, "uuid": "94fb410d-16f3-4aa5-a927-727583c486c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744704, "uuid": "662fbf2f-431f-431b-814c-b198e1199349", "value": "24576:Dy8Ar6BACimpfLIRUUYGqsAJtOZeR0bOzFlgqzDcx7vha2lpRy:W866BACfIRUCqsAZ0bOzTgy6zA6p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744704, "uuid": "4ccaeeee-82e7-47f1-97c2-eeb16f1e1095", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744704, "uuid": "af4a4d91-0096-4072-977c-09a81a5b8ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744704, "uuid": "db345582-56f7-4bc5-9073-9a4af465846e", "value": "6c1edef12a2878dc079e5a5bc4dac9e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3310b57-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737670, "uuid": "657a1b39-04c8-447f-925e-194ad713b271", "comment": "Malware payload (RedLineStealer)", "value": "8fc64e178eeea4f5b939b60aff3403da", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737670, "uuid": "c66bc905-cdb7-4d98-b7a5-f9e8f06da5b4", "comment": "Malware payload (RedLineStealer)", "value": "25da8d9b4885d0de3628b768e855d8698da6736c692565c86dfa24d77f741473", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737670, "uuid": "3d6588c4-839f-4862-ae25-c801a591f44f", "comment": "Malware payload (RedLineStealer)", "value": "f44e424b1b77672f2926a38a1fd62ae3b4f9faa2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737670, "uuid": "9c6e639c-5d73-45bb-a1a0-e066d50af445", "comment": "Malware payload (RedLineStealer)", "value": "08584c35bfdf1fe1bb2042c4ec3de85768ad699427362c23ead9f245dfc6ad63b73948fd1fa2c12ef8e69d92f9b02667", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737670, "uuid": "85bec669-90b5-4684-8d99-6220fa33d52c", "value": "T1A5252323BBF484B6E9712BB819F703830B30B9A05E7C953A5389E65E4D717849231B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737670, "uuid": "ab6401b0-9826-4aab-95ac-493adae8d75d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737670, "uuid": "cafd1bb7-4e32-49d0-967e-e077c784e0d6", "value": "24576:wyQ7MHwHQ9Iws5SqvEuqh5BSXuJWD7uiZKC+8fZ3xGsni:3CMQHQ9Iw0Sq8LhTSXuJ27uiZf+MZ3xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737670, "uuid": "cc4fdb72-04f9-4e71-af4c-3854d1e0eb42", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737670, "uuid": "c4b2ac3d-1cb6-47b4-af02-e62213a74dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737670, "uuid": "df054349-270d-47aa-86ec-ce50f98b67e9", "value": "stealer953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411d8d45-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684744807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744807, "uuid": "c9de6da9-bf0a-45f6-9526-fb505ad3442d", "comment": "Malware payload (GCleaner)", "value": "c3b1f140b62886eaf73c5e1d3d6b8f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744807, "uuid": "27501603-0482-4012-a3cd-c041934053d9", "comment": "Malware payload (GCleaner)", "value": "25daab07ca2cfec41c83e5f81202524b20ddab22b32eadb71ed2787394f4a269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744807, "uuid": "0c0f96d5-174e-481d-a9f1-ab92085d17d5", "comment": "Malware payload (GCleaner)", "value": "ba50da45342eb245d022eb688b6a5078d94285d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744807, "uuid": "6a14d79e-2c0d-4a9d-9059-d0ec7f8cbc5f", "comment": "Malware payload (GCleaner)", "value": "0ab570ee29126963651999c77eb2131ac581f2501cc20e3599686a10fcb9b31fec6596c85a8a35e49197381c6f3c07ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744807, "uuid": "c89898ad-abbc-49c0-b047-ead573e50c12", "value": "T1FD74B03366D0EC31E9655675CE3AC2B8262EB8517F1827CB72A47F6B1D311E2C636342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744807, "uuid": "f15630cc-e0c4-495a-aa09-8c9ba89975ee", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744807, "uuid": "2a3bb9ca-03a3-436a-a836-0825385384b3", "value": "6144:dFgyrNgG91l5wsdX8oLcTuSFsGrbk6UwLRTA:n3ggl55dX/LcTTF7/kaLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744807, "uuid": "aadc9e40-ea39-4c86-9443-e5109c10fe6c", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744807, "uuid": "02a2697d-eaec-44e7-b90b-c6b5cba510ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744807, "uuid": "bccc43d7-9e33-4b75-8120-4e7c9ad3b1d2", "value": "c3b1f140b62886eaf73c5e1d3d6b8f9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db92fe54-f8b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684767829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767829, "uuid": "676cf802-0c23-4968-9075-6cb82b95dee5", "comment": "Malware payload (SnakeKeylogger)", "value": "1f6a85495e46b1c7cc1c400f326762f5", "object_relation": "md5", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767829, "uuid": "01505d09-8659-468f-8d76-da5473533369", "comment": "Malware payload (SnakeKeylogger)", "value": "26969921baa34c10f19e16987def5c7c640214907867e51ebdd2fcfddc5b684b", "object_relation": "sha256", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767829, "uuid": "4b216d8d-cb08-43ae-9193-59057223ba47", "comment": "Malware payload (SnakeKeylogger)", "value": "313c448f365deac4dd0ea2e5c5a13cfb3c4c7b0a", "object_relation": "sha1", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767829, "uuid": "744253ae-86c5-4238-a7bb-6cc7c5abc737", "comment": "Malware payload (SnakeKeylogger)", "value": "a7abc183ec4b4b548c27027609aeebb1412e61633f34419e74d84c470efc75bcb9c7d839dfcedb3c5651f1fad5533a43", "object_relation": "sha3-384", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767829, "uuid": "a22b4a25-5b71-4cd9-8ba9-979744846b57", "value": "T144E48B5633B57621F47D73FD01196388CB38B44A2022E22A1F563AD156E37EB771A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767829, "uuid": "f2492f1a-9969-4958-9a1e-0cce7a066acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767829, "uuid": "4611dd9b-6df7-43f4-a86b-9c5188a16798", "value": "12288:svV+s1bSQT6tjjdB46+1uiXYrOfPQ0/URGEYlp0jBfruFfWkXq5hzjfQ1:stEou/rOfPQ0/UAplpQBTuFJ6Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684767829, "uuid": "873b3c8f-b6de-44b8-b5f9-7e40acb91bed", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684767829, "uuid": "43b59363-9a79-4106-9783-67eb36f4bdfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767829, "uuid": "9056ca2e-5488-470c-a1a1-fc22c26a5b84", "value": "CaixaBank _ banca digital CaixaBankNow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc72f976-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738625, "uuid": "16552473-7ce2-441b-95bd-cc81ced20f03", "comment": "Malware payload (Amadey)", "value": "4cb85c0d0a54fd65f5b154a413c4f70d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738625, "uuid": "8bacd816-3acf-4525-a23c-ec8031a151d3", "comment": "Malware payload (Amadey)", "value": "26990508d95d384a2164b81cc9e90ab2ae0cda1b71bd16d71777d24c5c3edcaa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738625, "uuid": "db9eb3aa-1dce-443a-9e3a-6249e9e5c36a", "comment": "Malware payload (Amadey)", "value": "75c44af661f94b9821fe48f3c9ebd2b893849095", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738625, "uuid": "8b501c5a-3e0b-48e4-bd9c-9649f8e18e3b", "comment": "Malware payload (Amadey)", "value": "21fa566d721eb597c00295840112e40776867b164bd02138b61555bcf1878e6012868a3d1aec118b2f101a5ea1cfa5f4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738625, "uuid": "833f880a-f561-49ab-b446-215f05a63dfe", "value": "T12B25230BDAD95072D8B227309CFA13830B36BDB18A78CB6B27959D565C738907632773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738625, "uuid": "927a0d85-b1ed-4f4f-b438-809b0191f06b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738625, "uuid": "925a6687-183c-4a3d-a5fe-055ced16441c", "value": "24576:KyFO8+kKf1X6qZcYzX+wDnBHSfQRS3TTTmSb:RF7nKfZ6qZcYztDnEfQRS3TTyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738625, "uuid": "516b0c60-610c-4815-8d09-e5e7881ce4e4", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738625, "uuid": "40e1be34-7616-47e9-8720-a7a123f48a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738625, "uuid": "eb590994-5936-4026-8aa2-26267a40a781", "value": "26990508d95d384a2164b81cc9e90ab2ae0cda1b71bd16d71777d24c5c3edcaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17495b17-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755903, "uuid": "39fa2a42-8af3-4d9a-82f9-77d8bc3d486e", "comment": "Malware payload", "value": "982d74dcd87978493230ac7363e3f484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755903, "uuid": "7e30de2a-f79c-4162-af31-3975c4e5ba57", "comment": "Malware payload", "value": "26d7752e6722f7c9e4f0fea8ba0e69d4d864b9a9f8a1088f23c1bc4b8599b4f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755903, "uuid": "3d254f65-a8a8-4c91-9f94-9ad2cccb9e3b", "comment": "Malware payload", "value": "fecb5f49c8595b1bd5f9481021376c23e427b731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755903, "uuid": "568ea84e-964e-4d29-af82-cba01dc7bd66", "comment": "Malware payload", "value": "3264644080ce9e70fcf93a29052f95ea981bf21cadbb18530b6958cfbb7bb9ebac44c463d3a19f81b4738c8990ca09ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755903, "uuid": "4060be83-89da-4ca3-b426-85d6803ecad3", "value": "T1FFB31293D957C1D3D56833388B95D28872B1E867FA1A5B06500CE32E72CAB507F9712E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755903, "uuid": "e559d3eb-4997-45eb-8955-e97d3ada5416", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755903, "uuid": "603757bf-216d-44f3-95a1-edeee25cd6ad", "value": "1536:Eut+pnJDX4dkN8c3lIGu2Z3U/OD5Va1rBQZqWY1nwx8qJn06N8koCFcQBBuHznYl:OJgcVIQZtza1tQZA55qJn0JkP37anWSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755903, "uuid": "28e85a6b-d794-4f51-8450-6b832d06f04c", "value": 110625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755903, "uuid": "43f12745-07ee-42bd-ae25-41664b868e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755903, "uuid": "c80bdc5d-2841-4011-a8b5-7564d756e6c8", "value": "SecuriteInfo.com.Trojan.GenericKD.44554522.29283.17227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3abd399-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752381, "uuid": "54fdedbb-1bf9-4be1-a973-a953910f32f4", "comment": "Malware payload (RedLineStealer)", "value": "2251d2fc9ef1c951e92f4450a53dcb1e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752381, "uuid": "ace72a50-100d-4060-bcfc-dcc591b260df", "comment": "Malware payload (RedLineStealer)", "value": "271589600bc99cfa5228ade142a28cec2d18b8e02cf21f1ef2b1e963e8408c5b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752381, "uuid": "87ac9068-966c-4827-a17f-d2c98cded747", "comment": "Malware payload (RedLineStealer)", "value": "ba059a2d071ffeb7f02a84618f81b0ad12983d5f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752381, "uuid": "bdca7cee-bc2b-4477-8f07-e37ac6471acf", "comment": "Malware payload (RedLineStealer)", "value": "7a6200e7b6429fcaf5b6b027e408467aafee94ac6b3e9381769ac48580b69f43c94ff584e3f540e49ed46c3a40b501fb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752381, "uuid": "0b4909f3-9a0c-43be-83cc-6b41209a0b25", "value": "T1AA252341A7E8A4A7D4B21B7148FA47D30F36BD96ADB5CE2B374546290D72381E23133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752381, "uuid": "bcc39c33-c5d9-43de-8187-76ba7ebdc320", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752381, "uuid": "a7abf583-a966-4908-8d54-5bb3aac6aa14", "value": "24576:lyMlcVcUY9tsOVAX/rZwPPzpasqhWGiBgJFOkTGCesIH4sr:AMicUYxiDZwXihWBBgJFpTGCesIYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752381, "uuid": "4d6f4f29-88b5-496a-8bef-5ac592701702", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752381, "uuid": "7ef02d9c-2ac0-4f4f-b70b-b78fcb394a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752381, "uuid": "2f9397e9-3a9a-4bd3-b45a-43d74cb9db64", "value": "controls950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274cc163-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763661, "uuid": "ad581fd1-4e08-44b4-b0e1-d214a2719f7c", "comment": "Malware payload (Mirai)", "value": "d98a437a7446c31ae14621813f789477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763661, "uuid": "72faca04-514c-4d97-9d62-bdf672e8fe32", "comment": "Malware payload (Mirai)", "value": "2729bee79117c3bd1c9dce48aec76c3c62211353b4a8a60d08099b37203be640", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763661, "uuid": "17849218-4129-43ac-9564-01f8f9289515", "comment": "Malware payload (Mirai)", "value": "922fbbe2d5d2bdb37a48607ef2309fd41ba19870", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763661, "uuid": "9b0fa4e3-15d4-4ab1-9f7e-0898b672f521", "comment": "Malware payload (Mirai)", "value": "d051891b9f93e373c01b9f1726a4b725725c58ee9bab861b873c902427c40a82ec724ad44e96f9110d7a057761cc4064", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763661, "uuid": "cad8132e-001d-4968-a12f-3296a3ecf7f5", "value": "T109C2D166F0CA1911EF6619B21965DDC713E14F78E76EEDD22178ABC2340A31A770ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763661, "uuid": "3cb14596-9723-438e-b112-8992a2bdc255", "value": "768:Xj+9u1SOGLaCOwQz4STyKpD4uVcqgw09g:8uXGOCJQkAD4u+qgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763661, "uuid": "4455ee6f-e771-46b6-ad36-1074a3c3bb54", "value": 26756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763661, "uuid": "f599d1c9-605b-4491-90c1-ba6a1b5a930f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763661, "uuid": "9e2dea09-94a0-4e2c-b3de-3892252be61b", "value": "d98a437a7446c31ae14621813f789477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c3a361-f8a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684764440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764440, "uuid": "6ae72a4c-d2ea-4250-8038-5f4a7700537c", "comment": "Malware payload (AgentTesla)", "value": "c7965c347bd45f529a0244948e63c1c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764440, "uuid": "f41ea5bc-257a-4e29-aa03-bab8e397c78e", "comment": "Malware payload (AgentTesla)", "value": "27e36aeb932b11f7f1a9eb8f7cc2ff7cc7d05549d3936aaaf5a6566cfd72166f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764440, "uuid": "46bdb287-6f74-43fd-9ce2-a7ff514e1653", "comment": "Malware payload (AgentTesla)", "value": "8702f27dc6ebf59178e3d2ccb7446e1a94869c18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764440, "uuid": "32d6ccb2-c1e7-4f08-956e-7b2aa1a92640", "comment": "Malware payload (AgentTesla)", "value": "ef5ab819573b5b6432bee4781e7d10406a9c470dc6e4508a844a8c7aea545c8af11dad0c3d9f9609a79e92d37d93b37c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764440, "uuid": "b983c423-87e7-4c5c-b8f7-2cab9dda9a81", "value": "T107E48B9633B57621F47E73BD0115638CCB39B04A2012E21A1F5A3AD546E37EB7B1A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764440, "uuid": "3ee60405-4d37-4adf-a47a-d9acfb8df246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764440, "uuid": "1aad82ec-9004-495e-929b-7ecbaff1b6b0", "value": "12288:jvV+s1bSQT6tjjdB4ez3uIY1JEbEvKj0z5OPenxAKFnMNGOE4vYoYO3egUn6F+:jt4DufIIvlUenxAKFMNGcvY/dgUn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684764440, "uuid": "ee92b3f8-00f5-4059-9dc0-12c2ad14c74b", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684764440, "uuid": "f1ccff64-6c05-4dc1-a2e3-2a3fbf7c3a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764440, "uuid": "1771e475-2d9c-443f-8fd0-d2b3ca0666e2", "value": "CTM request ETA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda0d815-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738627, "uuid": "9273c6f6-32a1-4b29-a317-f056ec7d99d7", "comment": "Malware payload (RedLineStealer)", "value": "b4fafbd40caa3f935d9928a0b1581439", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738627, "uuid": "dbf3ec73-ea97-4f8a-a9ba-0f83dd368372", "comment": "Malware payload (RedLineStealer)", "value": "27f56ed6d4a4728406f537b1d3bd3677fe612e25c721d9bceebadc2aa3a954b9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738627, "uuid": "2607cab9-1936-4eb3-aa37-ca167c8c7811", "comment": "Malware payload (RedLineStealer)", "value": "7410a66c3993997fbcec79ff33a9a19de536d9ab", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738627, "uuid": "9db56dab-56ec-45f5-818f-e4f53dd7655c", "comment": "Malware payload (RedLineStealer)", "value": "1a4d1051907ad5fffa3edd5f2ee89764b61009156517861882c1b79d75b4d11cdce818e04630aa9b882abca674730961", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738627, "uuid": "b40dfd36-75cb-4298-8314-68f82f78c574", "value": "T16F252356BBE59031EC751B3018FA4A8B0B36BDD198F5C72A2B85652A4C736D0FD36332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738627, "uuid": "973b18b4-af64-47ba-957f-27a3bdbf068f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738627, "uuid": "709dd3a3-9d36-4fa4-9172-8d19bad7bcfb", "value": "24576:fypM2hkm5aTPq1WyAKeI0IhPoXVRjwDSS3V:qff5aTPqcKKcAXbwWS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738627, "uuid": "5cf3cf8b-5ce8-48f7-ac8d-98fa922781ed", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738627, "uuid": "89488577-7978-4875-ab93-ea028078a32e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738627, "uuid": "2a9d34b2-b0cc-42a3-8449-49da6bc3d097", "value": "27f56ed6d4a4728406f537b1d3bd3677fe612e25c721d9bceebadc2aa3a954b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f2a992-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737240, "uuid": "f6a64735-62f3-427b-b4c1-aa56b153c17a", "comment": "Malware payload (Amadey)", "value": "6b001a060c1ec4b888e54b5ad2e3f4a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737240, "uuid": "6c50387f-721f-4a3e-809e-d3f8582f1eb8", "comment": "Malware payload (Amadey)", "value": "284a611d153ca201e96417e5be0d71ca1ff1cab79bd92ef25bfb3b2702a28c76", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737240, "uuid": "85176cf8-0973-433b-b19a-605a052e3839", "comment": "Malware payload (Amadey)", "value": "8670e9332c84dd8a6ea753d35aa8e5918ea9909e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737240, "uuid": "f97b438a-caac-48af-96ea-b620bcc36e77", "comment": "Malware payload (Amadey)", "value": "d5b44799b7fdcdee8412d06f55b89de35cc305fcf8d27c753c6cdbbf54439580fecc7468200113428b42a570b8931db7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737240, "uuid": "8470ae37-3231-4a0f-be78-8138c1034ddb", "value": "T17A252363ABC54432DCF623B268FA038347367CE5A931525F3748958BAC737D0A972366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737240, "uuid": "5cbc302b-56a5-4f64-8b51-4d44080f119c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737240, "uuid": "352c969c-4e6f-4269-885d-2eb1797a28ee", "value": "24576:cy+zwNJx1KTYB8O6qw5me15QvuTjWH/dlg7TX7EzEwc5:L8KnpBYqK15/OH/dOTXozEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737240, "uuid": "0de4c7dd-3b59-4d62-838d-d034bd150b14", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737240, "uuid": "c7599f66-a30b-448d-9d64-d733217344cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737240, "uuid": "c4ef3d7b-db8d-4e3b-b69c-a5291dd1dca9", "value": "62263263263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a888cc00-f834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684714056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714056, "uuid": "b5a3276d-0eed-4b10-b95c-deb6094febd4", "comment": "Malware payload (RedLineStealer)", "value": "c3f45e278a12aec803d3c906e7bbb19f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714056, "uuid": "9d96ef65-2321-4d0e-80c2-256c9eee9405", "comment": "Malware payload (RedLineStealer)", "value": "28f0a8d4b9049870065f77e4031587fb4217820ffa774aacd7e0c4127bbfe410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714056, "uuid": "627d7edc-f996-4cff-bc7d-684e74661bd4", "comment": "Malware payload (RedLineStealer)", "value": "cc5fbc8fa4c8d7b7533d6f88688d91dd8021afe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714056, "uuid": "ab55e60e-c5f5-477f-8451-5965a5126720", "comment": "Malware payload (RedLineStealer)", "value": "2f02d5cffa7013591a2e2bda5dea5dcf840547cb538c2651d6a6ed8fbe47b34f64e1380c189789293d4ed706bfe43749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714056, "uuid": "d8035b1c-5158-4dbe-9c39-f4331b8539c2", "value": "T106252213B5ECA277E8B52B7088F10A831F35FDF096B8416B2749789E1D72694A930367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714056, "uuid": "229e1893-b63e-43d5-808e-52f979ac9862", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714056, "uuid": "0afad80f-b32c-4fba-8c15-e1f305316178", "value": "24576:eyt0kklzhA2ZBqgkSmIf9toynZxWXxelftTXagJD70laT:tt0kklzhA+BqkmO9+Anqx6ftTXagJDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684714056, "uuid": "6a51b9b7-4e46-486d-9a99-1d8842aec72a", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684714056, "uuid": "ced2a109-4d35-4a9f-adf6-12c5fbd725f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714056, "uuid": "9b51ef8a-1898-4262-9576-b1907860d0e2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86188e6f-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752224, "uuid": "ef4090b5-9fd8-4bce-9f16-90b995212cc2", "comment": "Malware payload (RedLineStealer)", "value": "fc144d1fe99c85997610f4b3dcba1b8c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752224, "uuid": "5ed68ef5-f6ae-4c65-8069-8b68ea47b09d", "comment": "Malware payload (RedLineStealer)", "value": "295413c5252523fdab918b41beaa3e06e9f059a5c148b5b56aab7b41fb896b9b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752224, "uuid": "1289758d-7150-4070-9698-7f93fa7f1ff0", "comment": "Malware payload (RedLineStealer)", "value": "bf246e1a7db5b26636b5217f8167df10b6db2c53", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752224, "uuid": "ac399144-788e-4c87-928c-1ba9edbbd83e", "comment": "Malware payload (RedLineStealer)", "value": "9908b4819fe6e598735ecc49fff7858c7d57ec67030f321ca171dc6600846c2eb6b25d02fe22c8bdecb767e96f7d363d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752224, "uuid": "fff12728-bf6f-4f7a-b392-3686fc042eb4", "value": "T102252302EAD88232E1B55BB014F712A30B387C528978965B2744BD5E1C73AD5F8727BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752224, "uuid": "6e6f732c-90ae-4688-b6a2-63345567a6ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752224, "uuid": "a6b2a10e-427d-4ecb-9f2c-dcd6e44a3af3", "value": "24576:Iyw2wPL6emh7JSMWh+9VbugsWWthTVweTmQWn:Pw2wPLPmPST+9VbDkthTVwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752224, "uuid": "ba54c3db-5935-4d36-b5dd-0308a0fbfba5", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752224, "uuid": "71743f1b-acab-4003-b83b-154a7e9d6a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752224, "uuid": "e1eda93a-992e-448e-948a-6c9234717dea", "value": "2482792.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fdab82-f8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684773351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773351, "uuid": "f7621708-8f23-4751-9515-866c6b7088ae", "comment": "Malware payload (Formbook)", "value": "c064d51ec078dea29120a759e6ae010d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773351, "uuid": "45cdfd5a-6a06-49bf-9264-b91ba2716ac3", "comment": "Malware payload (Formbook)", "value": "29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773351, "uuid": "1c006f11-5bf0-4cb7-840f-806c61a3d942", "comment": "Malware payload (Formbook)", "value": "1670c3b05c6324da0a41dc390b302bae82458c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773351, "uuid": "e4c0f0fc-3b2c-4ad9-ba91-5769eaef2676", "comment": "Malware payload (Formbook)", "value": "c4a4ea12e2e392ebd50fecee6a6e1b0283e3f7ce701402ae98cdb35820d9d7dc51f05110a0bc211d2c6e2fb8dc3c5f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773351, "uuid": "0eb90a90-dec9-4e03-b0e0-3a7996ace010", "value": "T14D64F12176D9C032F22225344A72C6A18B37B8729BB19DCF2F91567A0F653C3DAB4716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773351, "uuid": "cd1011e0-1127-4cd1-bc0e-97bef79cf9de", "value": "dcc3403437adbaa710d120d49b019308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773351, "uuid": "368e95d0-1dc0-48b8-a9cb-dc3a360b53e3", "value": "6144:XzcBM+Mi0nEWxxy04Mdy/oarwbBARmyfbLB66w4cDUdCF:Xz6ii0EWxxy04MdsT8AUMLc6JcICF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684773351, "uuid": "8a283ad6-e1ca-4ad6-81a3-7e07d9772509", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684773351, "uuid": "fc2ba1b4-16ad-49ab-9ae2-3bdb7236e460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773351, "uuid": "bb3cc77b-96ae-4305-933f-b9c32de3e99b", "value": "SCAN-ZAHLUNG22.05.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5578526-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752330, "uuid": "0243f5df-5333-45c3-ba0e-276c960a72b1", "comment": "Malware payload (RedLineStealer)", "value": "4354469feb1ce140d484b4a04ddb93a8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752330, "uuid": "eb21d01b-f3a2-44ec-b237-a1db1c5634b1", "comment": "Malware payload (RedLineStealer)", "value": "2a0593cc940a171705a470a0babf0309a5c5ca95cb0e7b70028b541d133ccfc0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752330, "uuid": "b7d1643d-6e7d-47d3-9a0b-73d4264ed2db", "comment": "Malware payload (RedLineStealer)", "value": "be6c1b7ff282ff9001bb4c2c7a396242528a3a3e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752330, "uuid": "fa8783a0-cb6e-476f-b276-b94b3cc4d0e9", "comment": "Malware payload (RedLineStealer)", "value": "8d5692447b3faeb3b98fdca3629dd212a149fd35944cf4cdfd1fb02e2227ad28bfcb154cf70307f7b574eda0f405bd1e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752330, "uuid": "4e97b381-319a-4d36-a04f-73d389bb69a3", "value": "T119252305E7CC90B3ED7C7B3408F612430F35BDB79AB4436B33485A625E72696A93172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752330, "uuid": "1ecf3c4a-1d04-4a53-8a08-9ad863014791", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752330, "uuid": "023be093-9e0c-42aa-af1c-39a885aae474", "value": "24576:syXhq/R8taHIS3q38zya+M5jYOM8DimgI3swis:bRmuaHIS3qQ5jBRBDswi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752330, "uuid": "45652525-ea94-4584-993e-653b54630ae6", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752330, "uuid": "4b6495b2-d276-42d1-bcf4-77f7d6a9008a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752330, "uuid": "24aa842a-0ff4-4080-9a1a-ceb8e12bdbe6", "value": "app210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6935c1b-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684745406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745406, "uuid": "bbb2d2db-ba82-48b0-b0f6-ac1ae46a5825", "comment": "Malware payload (WSHRAT)", "value": "e6aa5b35052a7db7a2fd0e5efb6216e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745406, "uuid": "c38128ea-871b-4bac-b8bf-05285de63f7f", "comment": "Malware payload (WSHRAT)", "value": "2a773f8a565116d3d666fddc8a0d767497562b0f65530a71a15dd3f4fd09765f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745406, "uuid": "7f1e1615-ddde-4741-847b-f8196bf3e0cb", "comment": "Malware payload (WSHRAT)", "value": "63e7eaf2ed555512f6a8f9c19844671ec6b36c49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745406, "uuid": "784e49e2-5b10-4177-8d04-e014c21c02b5", "comment": "Malware payload (WSHRAT)", "value": "d45b955e052adb21c55992fa4f6b9d60d5881071d5bb52f4247617f2fcb669cfd6c1fb1bbbffadb323248ad296cdacd4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745406, "uuid": "38fb2495-c837-4149-bb8d-dae24f3e5f44", "value": "T1343515C627686BBF93B7945EC1526F13D0390E6B1E7219042E925A0DEF49C135CFB8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745406, "uuid": "1c96c8b1-e310-4ad7-82b0-aef584171c95", "value": "1536:0N86LJBJZtqptvmDekNXSuR7skySWihwEaREBRbyHWhZiyX2jhEXEehgwNhNylr7:2sKar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745406, "uuid": "359818cb-8a31-45ce-a242-34229030c3a1", "value": 1163562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745406, "uuid": "a59019b9-7445-4613-be68-5c9ff642525b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745406, "uuid": "897ac557-4eca-4620-9fa6-2084dc162798", "value": "Scan00518.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af6b636-f8a3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684761600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761600, "uuid": "a09460e2-a5da-420d-ba22-0ceb39b00fb4", "comment": "Malware payload (RemcosRAT)", "value": "d0d95a0d9e857661d3307ff61ffad67b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761600, "uuid": "5e7a5633-b9be-4214-95c0-f88499ee384d", "comment": "Malware payload (RemcosRAT)", "value": "2b19bb425c2b5cca7afd379ef516caa667c6b9b06147af3528c8d3166d07c631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761600, "uuid": "42b7e043-4167-47b0-b06e-ebb3795c7539", "comment": "Malware payload (RemcosRAT)", "value": "735f58c707cd513892f6c9951b62318b2104ea51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761600, "uuid": "fffa1453-547b-4775-a7e0-b25e201d1322", "comment": "Malware payload (RemcosRAT)", "value": "2be6754e3ff1894acf420c2ff82c4cd418549fd5fba752476a3da9fbfe5a4606f4530a00cf18f22a456f0823ba83b139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761600, "uuid": "eacfdc78-7bb2-493f-bd52-a223f9394d5e", "value": "T157059D63E7A1483BD07339389D5B5764E83D7E212964744A2FE82F785F393823D291E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761600, "uuid": "a753db94-4e6c-4c15-af23-6b2640b0bc50", "value": "a3a08b0a4cedcc9e41a1672f90d9ed21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761600, "uuid": "2f5a1bb8-05fa-4379-b32c-9f2e12d89c4e", "value": "24576:FLZHTxdmboHmta+pa9w5Wm8XIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIB:FLZjVOhkueG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684761600, "uuid": "3a6c5389-cd43-4ce1-8d51-3b809afcefe9", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684761600, "uuid": "d178d58b-3539-4eac-965b-259adbbf141a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761600, "uuid": "57c4a6b2-557a-4279-9909-ef06fe2aa189", "value": "Invoice 990989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8cc1b2-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738628, "uuid": "6f3bbf0d-b926-466e-988b-49a7e58f1528", "comment": "Malware payload (RedLineStealer)", "value": "7a812867671398509108f4598e518028", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738628, "uuid": "1c2caf37-e440-41df-9498-e741561ac156", "comment": "Malware payload (RedLineStealer)", "value": "2bdad494329502cc6ad3874c34bd80e72c912b204065d40f60e28db67c241645", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738628, "uuid": "a5db5a3e-db78-40cb-b61b-1f343a81766c", "comment": "Malware payload (RedLineStealer)", "value": "85ea2f7b8a23bdee61c2bde1f9a751cc16f300b3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738628, "uuid": "907df091-3398-4b0b-8123-bc56b3c7c680", "comment": "Malware payload (RedLineStealer)", "value": "a951cc14b1485c00d99c24eb967e13fc035be7cbe666595ef94671eed8d57c2ea55d5026d0983647a7918f8ba9a254d0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738628, "uuid": "5e4d679a-a7aa-4a67-8744-25a124acd5c3", "value": "T130252316EBE84436E8B627F458F603C30E35BD90EC74C3AF4355696A5C729A0A93137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738628, "uuid": "5d1e4bb3-f399-4ed0-acdb-2f6e16ebaf57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738628, "uuid": "7fcfa8ad-de87-4e88-940d-ecbc925bcb21", "value": "24576:3y/lO1RAUey93Hq/VlZgfSq0d5n3rGRUJxkos6mtjyjR1:C/gLANy9Hq/qH0DCUIoDmtjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738628, "uuid": "cda5b247-91c1-43c2-b452-5886882378bd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738628, "uuid": "0f593e2f-517d-4f1f-bf6d-be315cc96d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738628, "uuid": "998c99c3-da9c-4596-8581-e90f4a2adce3", "value": "2bdad494329502cc6ad3874c34bd80e72c912b204065d40f60e28db67c241645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6737fe-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755914, "uuid": "5deab3cf-a5b3-450c-90bf-f653ff54671d", "comment": "Malware payload", "value": "dc4566726a63e0a3ce12c4274f9d81f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755914, "uuid": "9e4d2920-cb7b-497b-bf17-f06669bb90b7", "comment": "Malware payload", "value": "2c3dc80464fdf76bc52b2ab3400a128fd4e4bc939e6533030515e5c7da8debe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755914, "uuid": "df67c472-9ac3-446d-813b-020fe6f77bd6", "comment": "Malware payload", "value": "f7acbbfd9c3f10a98e0df764c52031056e04cd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755914, "uuid": "9f77cafa-5a07-4d4d-9d16-d1b5b2ce94ff", "comment": "Malware payload", "value": "f5590dd2fc29ddc755bc7fcd85c1c9b30f661636c6b96813e40c6df56d610a67a92647c870b3b8dc75701bdfa24486e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755914, "uuid": "ca69a335-9f96-4ea4-a2cb-61d0ce5e7faa", "value": "T11482BF4633A86346D41F01B57E3FA352DC2F75254A31037997F0909FBC942A2AD4AFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755914, "uuid": "2d530431-8980-4178-a25e-e4dfb5a862c6", "value": "384:LObMi5n1WXhRc/VR4UZPDSAoy8+TK3cQE7XZiz1QC1vIL+NP5jWvY:LObMzhRcNBzy+TKU9ipt1vIpvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755914, "uuid": "1654926e-cea0-4e96-9eb3-1270cddd6b8b", "value": 18276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755914, "uuid": "e8262b3c-cf19-44da-8ef1-7a5fd53f5fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755914, "uuid": "5a574836-eb03-49bd-b31a-a5478a91c08c", "value": "SecuriteInfo.com.Trojan.Generic.3143452.28839.11411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102cfd6f-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763622, "uuid": "e707ffaa-9965-4d31-af30-cb608c7edb96", "comment": "Malware payload (Mirai)", "value": "6038b5713c77eeecf3168558c6e9e18d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763622, "uuid": "eac7691c-3bd3-4f2f-9d6c-d781003f98f5", "comment": "Malware payload (Mirai)", "value": "2d4a14f91ba86666362f2bb6b318b01b55b9bb698f70e87f58320acde71b9463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763622, "uuid": "94d91b57-c299-4afa-9ac2-1457385bc0a9", "comment": "Malware payload (Mirai)", "value": "1529d79efe159a559a23e54c8fb4338bdc01cf52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763622, "uuid": "ea31d9cb-1751-41dc-8df9-cdc7adf16316", "comment": "Malware payload (Mirai)", "value": "8a503166c59aa3b83cc5ce8bee3a866332efa134e1da8bca4c18fd1f218b61646cefe20c4e8f70816a79a7626a39507d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763622, "uuid": "71fab9cd-985d-422e-a7b3-9468f382ded3", "value": "T139D2E0F466D6B9A1C9E0203A5C75D65AF8A5ADBCE0EE36D2768061C490830C95FEC7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763622, "uuid": "2d9e0ed3-4d7b-43b5-a41e-e53412a7076c", "value": "768:l1noBwNPI4Jis1dwYFACHbrz96atiRV+w8h2PM9q3UELt:Pf1iUGCH/UX8hAVLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763622, "uuid": "71fc5035-e101-4853-992b-4537d9569d5a", "value": 30612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763622, "uuid": "a0a7e4c6-bdf2-4bb6-b3c8-848787e12c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763622, "uuid": "175a6bc1-c898-4db8-bea9-7e77de8035c1", "value": "6038b5713c77eeecf3168558c6e9e18d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94592247-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737215, "uuid": "5f1c5914-f8b7-4bff-9c9d-96a171919e8e", "comment": "Malware payload (RedLineStealer)", "value": "e9a5ce9ef93e79bf3dc2d54caf96b1bb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737215, "uuid": "65c86fe0-7a33-4104-a3bc-373abb0508f4", "comment": "Malware payload (RedLineStealer)", "value": "2d540f13734922bc8fb03ebdd2ae3493443b15d856e561cb298b7eecd6671d65", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737215, "uuid": "c6d2c674-67f6-4a7c-9253-d470d300bf86", "comment": "Malware payload (RedLineStealer)", "value": "489f01441ff2ad2f6d2af4d9f99920a99fd9a817", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737215, "uuid": "f8308c1c-83df-4177-b41b-6a2af74433d4", "comment": "Malware payload (RedLineStealer)", "value": "b0cba18fc136f1395461c5db905d3361e83276b4262ae554f88b12b59b1bdaac4490c44d9f3b9b20b5a5f2b905b9be10", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737215, "uuid": "24a2c79c-97d2-4ef9-ad21-c640b4b411e4", "value": "T1EC25238559D960B3CD3F53B011FA02A32737BDA169788367229AED264C736D498B133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737215, "uuid": "20bc03db-3ca6-4f83-9779-db89d6b671a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737215, "uuid": "e5d4d5b6-b435-4190-b754-027ddfded90d", "value": "24576:9yjJIEPqoX3TIqsFidriU7EKLrofxwQ7So6:YjJakEqiihr7EI2+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737215, "uuid": "51d6338c-ec1d-4efd-9bdc-b6fdf22033ee", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737215, "uuid": "d3544e76-2fc1-42d9-a42a-5c8da4065af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737215, "uuid": "73fdc70b-a5e9-4c7f-96c5-81ee226ced8a", "value": "4743313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396c9a21-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684734915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734915, "uuid": "e7a75c83-208f-4f06-8c0e-fcb299805635", "comment": "Malware payload (Loki)", "value": "bddd80ae39eb5e20652aead1473f9188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734915, "uuid": "f3bdfad7-32e6-46ce-892d-d03dbc994b6b", "comment": "Malware payload (Loki)", "value": "2d77d7ddd1e8196a342b4b660d0ca60c53f01efded9d244d374c5649f40a2542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734915, "uuid": "1cf670de-32c8-4d1d-a63d-f39b059a079a", "comment": "Malware payload (Loki)", "value": "d28911686b11ba7cbb625121fffb165bc77990d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734915, "uuid": "61e9f69e-b0d8-4d28-8cb2-203506717dcd", "comment": "Malware payload (Loki)", "value": "d4dbe9380b7af87a1f68ba180fc39acdf16915d688cc7710a43103ca29c12f2154f9df7c00d2c63a00099ca879ff359d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734915, "uuid": "2b1b0d09-4dda-4d01-9f2e-33d21e6036b6", "value": "T1E5546C13E2E17C61E7264A768E2EC6A8761EF5604F19A7DF1B184A6F05B01F2C673F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734915, "uuid": "bda30a84-6805-439d-87db-967db8168a0c", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734915, "uuid": "a59b685f-ca22-4fc1-bf50-5b769ec02543", "value": "3072:V1Ygul1lNGlVtxPGbOgO5jz2Cs+E+OTDL/sdEEvWK8/x7JocMVrv3oF6JXrTr:YFlLu4bPw2Cs+E+afq9AZ+RPjPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734915, "uuid": "6b36e827-e7a2-49a7-a573-cdc919c318fe", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734915, "uuid": "a7d3399d-8743-445e-ac5f-cca3c7b522c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734915, "uuid": "8cc22fc9-5b18-45c6-a860-e77141744b77", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c741b9c-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745175, "uuid": "2eb2b98a-c1ad-4535-b1f3-81bc683668c9", "comment": "Malware payload (AgentTesla)", "value": "325184151e460bc7038bfb69f5f6a67b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745175, "uuid": "09814a85-bb66-4298-8b6c-1106f6ef2ae6", "comment": "Malware payload (AgentTesla)", "value": "2e122653f2f213fea66143fd3a80af76a38bda77fe06b9450d4ba795d98704d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745175, "uuid": "94e7110b-0540-45c5-8b41-7b531ce4b395", "comment": "Malware payload (AgentTesla)", "value": "4e42271c594cb78775bffd15a93a31ab8e6db39a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745175, "uuid": "e40c4ab4-fadd-4c1b-bf71-ce5c516e6585", "comment": "Malware payload (AgentTesla)", "value": "c5e857581f555f795532035d83cb1ea652ac7d679964b16d86369b78e54ac2c1983ec224e609c323c7d3938a59bb4727", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745175, "uuid": "57553bcb-64d4-4b22-9845-24147bd0f010", "value": "T1D9E4F18167949D10E2975FB84AB6F23412B86C61EF27C74A64F46C8B7C66B823B017C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745175, "uuid": "660b3a5b-be7f-4bce-a63a-e622ad82f57d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745175, "uuid": "d77963aa-2580-4835-81e6-7c875f5e82d8", "value": "12288:/TZx0YPX/NqPsQq2HlaogNoYUMbhkUVJ836wD2bm3GQspLwKP:/TsHPsh2HcoCoYX+KwSb+GQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745175, "uuid": "22d36fae-bb56-4779-b6bd-0a277cd2c73e", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745175, "uuid": "49973bdc-b7ff-49e2-b71e-830a614de328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745175, "uuid": "a05823e7-dbd0-4d14-93c2-5946dcf5fe28", "value": "HSE31095S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2681a7da-f861-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684733165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733165, "uuid": "bf991f87-48c1-4b7e-8120-7175f38bce22", "comment": "Malware payload (AgentTesla)", "value": "9f8c83832483d359d43dbf50aa2653a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733165, "uuid": "e4bdbdf2-b24a-4757-8134-90e511b25561", "comment": "Malware payload (AgentTesla)", "value": "2e31a7bfe2168b0ea182b84baa2ff20bb8d7b1cfbbad9575a5ec009bb3f418ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733165, "uuid": "023e0d75-a735-4f65-b99f-8cee51e30dc1", "comment": "Malware payload (AgentTesla)", "value": "5f2fdc5fb6694ba78d8b0e2ec1e1eead3d65d86d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733165, "uuid": "38e0872e-47da-4c72-914d-09b54cb37184", "comment": "Malware payload (AgentTesla)", "value": "75a9da75551c7a11485f0d9bf6d948e67a1ec6750e3857502b0a7a71410a6db1ed1a042932864bc9af1641ca5695f130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733165, "uuid": "6afbe5b1-c148-4874-8000-24e81ce89ff6", "value": "T17015F08016A45D21E6A6AFF99AA3F23443B92D51E713D70918E02CDB7D77F827B01783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733165, "uuid": "72eaa30c-2fbe-48cd-bbea-372e1f47d098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733165, "uuid": "81cca5e7-3ffe-4ec6-bd88-a5718b2f678f", "value": "24576:EWjQEuf33Y0bGcWsOCUzZ9iabRtBJ6TrN9NvrPiWQ4P0:lQ5PI0H6RtBYPDVQ4P0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684733165, "uuid": "08a75429-4d4a-4f56-81fe-36ca96a49ab0", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684733165, "uuid": "7e9f6a78-23db-4d49-9e4d-af7195406209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733165, "uuid": "5809807b-1b47-4eca-bae5-b9dcda5c9baa", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb985b3-f8b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684767888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767888, "uuid": "2b441d0c-5cdc-4d32-abca-a684f67270bf", "comment": "Malware payload (AgentTesla)", "value": "baff53cb7c0dba9be6859bd815559bf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767888, "uuid": "cab6861f-5a11-405c-803f-510a594d13f6", "comment": "Malware payload (AgentTesla)", "value": "2eb12d18200b79353510751ef2f4fa4ef70ec48beeaab08bc16d75bacdb90463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767888, "uuid": "8002b833-27f6-4ba0-97a7-79b43d84dfea", "comment": "Malware payload (AgentTesla)", "value": "8212a48c82b99da183c19021572c84fcaed3e7ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767888, "uuid": "f402db40-8f9f-4f23-a59b-722225635a61", "comment": "Malware payload (AgentTesla)", "value": "236fa0eb84b0f71a23aebee8666c51d89bd5660de381851322388157681ed94df2a57e47cbed7e41d14046fad2d2f123", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767888, "uuid": "db3ed25a-1e78-4936-9050-d02cdb000f16", "value": "T105F4AD953375DF2AD8BD83FF06F0508D0BB874067026E21A5F9735D27270BA66A48B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767888, "uuid": "a93edc2e-e377-4885-a87a-282f23431d70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767888, "uuid": "e82f78f7-76b6-465b-a461-8489a6558967", "value": "12288:vDX91itflz3Hu6UqC3Wpsmc+Fd0ikljf83BeHEzMQNGN5IDGF:vR1itftXJLumxFd0ikxUTMqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684767888, "uuid": "209ba838-48e8-4a59-821b-a7a81e0249e6", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684767888, "uuid": "219731c0-246b-4764-a745-161614982c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767888, "uuid": "44a1a3c7-9de4-4e1c-83b7-b606c0d8288c", "value": "baff53cb7c0dba9be6859bd815559bf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2945942-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752379, "uuid": "ab76ae4b-bef1-4a2e-beed-17af7c20aa34", "comment": "Malware payload (RedLineStealer)", "value": "78a94154e27394efafd1004b799cd32d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752379, "uuid": "e77d9384-5740-4b2b-adce-c1d9588c9f6f", "comment": "Malware payload (RedLineStealer)", "value": "2f46d16e19fdc17268964f194e728ad94c8505a4c27504a4d2b8eff5c8d38967", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752379, "uuid": "4ef2a870-cd46-4a61-a72b-aea632d6defc", "comment": "Malware payload (RedLineStealer)", "value": "6bd8660fc6e96384abcbef122709b009e165991f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752379, "uuid": "32f062d8-41f6-4611-8928-b8b90a5f5a93", "comment": "Malware payload (RedLineStealer)", "value": "8f3a701e36d94e1dfa9df975270d386f86e4979f743066b6d6fe03517edb3aef473aea291035334aaeb2146c24ebec4b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752379, "uuid": "6efb3674-3a1d-4a02-8e89-451db41a819c", "value": "T159252317B6D905B1D8B423B054F617930A3BBDA24838935B3395ED5E28B3A8474B0B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752379, "uuid": "cc1b04cc-b7a7-44e7-9745-d158ee19b354", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752379, "uuid": "0830cf04-b827-47d2-bae3-c348a0fb46e4", "value": "24576:ayDyxFQ+x3cJ4bGexUks2yvl1EpgnWNna8XbsStO7oj:hDynQLeC2yvl1ECYakbsSt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752379, "uuid": "7667ca7c-f68b-43e8-96b4-bd39463c2feb", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752379, "uuid": "526b0d68-6586-4164-9d6c-edaa603ea169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752379, "uuid": "1abb8ddb-469b-4a46-8b6d-2ebd88d76990", "value": "controls541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e55d3eb-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752050, "uuid": "3de0b9c8-52fe-4ab5-a104-d13e3d31dcb2", "comment": "Malware payload (RedLineStealer)", "value": "93578fdf67e69753498a2cff8c23f801", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752050, "uuid": "6441ba09-ae49-473b-8499-2d275e43ffbf", "comment": "Malware payload (RedLineStealer)", "value": "2f745b7e0fd4a560ae3519285a02388f8264fc2b68e3dbe217683515b65a754f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752050, "uuid": "fb2deba8-5f39-4170-a97f-60a4f1825574", "comment": "Malware payload (RedLineStealer)", "value": "dd922cbdbfdc3c8514b302ce79374e8df80ea54d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752050, "uuid": "36b5ff7d-543f-42db-ba5a-7039f8cb90e9", "comment": "Malware payload (RedLineStealer)", "value": "3b5b6d56b4b631317ca0f7b75ad130bf825ea3323f6dc5bcf2af8c0c965f5a03a6e4e4952ed8daec7e0b7ec0fe29cf49", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752050, "uuid": "048e5bb4-c166-490a-8ae9-6097af844cb8", "value": "T1D164F1313AD5C032F12245348EA5C6A28B2B7D712BA25ACB3B95063E5F772D1DE7431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752050, "uuid": "cd702950-0583-4285-89dc-b738e60f8d13", "value": "91e52b5b5b8df9c17be98b9e4559a03d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752050, "uuid": "98278c7d-bbc3-465a-b561-1e9b169ef5db", "value": "6144:OlLStUNF+5MeH4O4kjq3LLuwDMixHbi50AJ:OdSt8SavvuAxOyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752050, "uuid": "c5f8514a-a4e4-41a7-9b6e-c741ffdfbe42", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752050, "uuid": "ea1c4c0d-51e0-4784-b715-14b8836d94ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752050, "uuid": "a8d90df1-e4ce-470f-9507-365419b707c4", "value": "starter693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282b1851-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745194, "uuid": "a17c9223-6a42-46f8-9d8f-46515bbb2b03", "comment": "Malware payload (AgentTesla)", "value": "411b2abc3b82d2146cf338469c21a23d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745194, "uuid": "2f5e4922-ac98-4cb7-8aed-5b8564a60b6f", "comment": "Malware payload (AgentTesla)", "value": "2f8c73b98c4878c743b2e0d5ec8e67ee1b6a0cf931d1ac69fa48a9600d869510", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745194, "uuid": "d76a64c9-d188-4b33-b322-931689e2e35d", "comment": "Malware payload (AgentTesla)", "value": "274739a2e4990828a55cd05ffd2845bcbf4f1881", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745194, "uuid": "e6e95b61-a4f3-47eb-83a0-746b77d258d3", "comment": "Malware payload (AgentTesla)", "value": "bf7c5f65e7f8c1ec271100c117a04c83323b2639e38288cb8f8b8506cf86433f7a3e7790d87fdba5145eab691aa4b892", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745194, "uuid": "e6f8e2c2-d5f4-44d7-af42-a040632449d3", "value": "T199E4E0912E948C0CED565E75DAB2F23403756CA5EB23870D6CE03C4B7F77A8A6A01793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745194, "uuid": "5b59e8fc-696b-4250-8765-b007f7038a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745194, "uuid": "0a76dc0b-cf35-4996-9fab-10845903a7d5", "value": "12288:ETwx0YPX/NqPsm4IKhEXrSyOyRrjmc71wqXK9HK1fsateeWKzQW+Pn:ET3HPsBEmyOwrD71wqXK5KtQeWKkW+Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745194, "uuid": "a57ecf16-084e-4249-800b-79a960192e9e", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745194, "uuid": "7f08c7f1-78a5-46e7-a2aa-453e7c75d736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745194, "uuid": "3a740a3c-3b21-4a8c-9bf1-932e1e018135", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b940c0-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752242, "uuid": "9e268cfe-6437-4661-acef-a26d1c3262f1", "comment": "Malware payload (RedLineStealer)", "value": "fc55263e16143e434ec09a6afb7fcbd4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752242, "uuid": "4e1e2c9d-0a16-4ab3-89df-07242cea6c82", "comment": "Malware payload (RedLineStealer)", "value": "2f8d6ac9b1650cde3a4a5a6bb5ce5c056b942640a78ee5770d1b1343b8231bd6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752242, "uuid": "8b666562-ad14-40df-8ce1-e36172410282", "comment": "Malware payload (RedLineStealer)", "value": "3eccaa86e7853e8375dcd0740104dbadf5997748", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752242, "uuid": "67f8131a-9e97-4ccc-906b-48f3cf738812", "comment": "Malware payload (RedLineStealer)", "value": "40517bc1604d663d471c4e19b32b850e7f478327bf886e0bb96e2764c03ba59828d59dcf228cde48e9f30d62213f48a2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752242, "uuid": "f0d63eac-d571-4c12-818a-d08e7e233cd2", "value": "T1D2252322BBD84076E5F2277444F603C31E353AE19E6A531F374AB94A4DF2281B93536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752242, "uuid": "3d99abc4-d9b5-4a3a-90a1-d29b4301ffbf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752242, "uuid": "6abd5e3b-605a-4cab-99d6-e8802a449685", "value": "24576:TyCAzxyUt7swbf3b85blp+G4u2LQneBM:mCiD71k5b/+Gh2LQng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752242, "uuid": "b12294f5-ae53-49f9-be8f-e69df1a2183b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752242, "uuid": "02a05ccb-0a7a-4a17-80d6-1cb68031b834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752242, "uuid": "5a19236f-ee5a-43c5-8693-017de388d2a5", "value": "345359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1ac5b9-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752313, "uuid": "9c4ae430-f8ca-4fe2-b15b-1b14b8d9f1c0", "comment": "Malware payload (RedLineStealer)", "value": "3f12c89856063a4cc5fc845ec2250091", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752313, "uuid": "bac0ae7b-2e3b-4a52-8366-f44afd224c33", "comment": "Malware payload (RedLineStealer)", "value": "2fd1d68f86ca9e781ebca69ba6b3efa0a1b544671909dc823be0b0d6de6d47f5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752313, "uuid": "bf88058b-4bbd-4d39-81f2-348047803d60", "comment": "Malware payload (RedLineStealer)", "value": "645726e7513955a547b3c1e40059001e9f8a7314", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752313, "uuid": "df279c26-9b42-41bc-8c27-e63075fef6bf", "comment": "Malware payload (RedLineStealer)", "value": "7cd570c53b6a38874d052551c49d42214abec5847f34abcb05bb6bd4e7b7bba2ab591bc5c159190962ae2c1d8c6f2883", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752313, "uuid": "8e86f987-71e0-44a8-a833-947e9ed37757", "value": "T15C252307F1D85577EEB817B294F206C31F24BCB168B5823A170DD8199C722D4B87AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752313, "uuid": "57bc608e-89fb-4d0b-915f-39385b42b45a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752313, "uuid": "bd94efbe-85c1-43e4-8dce-22ab869e7a21", "value": "24576:Ly42ZHXyVfntWoItJ8LqRtsHi4hYLSaP:+XZCVPctJTRtsH7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752313, "uuid": "144af53f-0a42-401c-9837-fc50ef010529", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752313, "uuid": "31fe84a3-5712-49f8-8aa0-07b5d40b4bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752313, "uuid": "b47ceeec-9b78-4c76-a113-11af92812d51", "value": "UI685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7948f7b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752360, "uuid": "feeab4c3-c41d-4cdb-bd21-29ac7f100db1", "comment": "Malware payload (RedLineStealer)", "value": "e869d25628836e550598622e7bcc31ad", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752360, "uuid": "b5635992-6cf2-450e-b5db-2c422ce8f5fb", "comment": "Malware payload (RedLineStealer)", "value": "301fccd08cd1db68722a490ea45ca7b8d9be0355130bf9280ed2d7b5a3e73856", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752360, "uuid": "128b6ebc-ccfe-49d8-963d-e9a4c5db0722", "comment": "Malware payload (RedLineStealer)", "value": "1c24f4b92459592b18cd14aab4912ecb02afc55f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752360, "uuid": "2e644475-8ad0-4164-afd0-42eab693d552", "comment": "Malware payload (RedLineStealer)", "value": "ed73f78e781586f8439b2323818a5495fc26ad0f485d0d2c3ba8e43e553aba91197772db2637c66e048928500365a071", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752360, "uuid": "6d93b80a-a3a4-4dd3-b8a8-c419bd236f9c", "value": "T18A252317F6E450A2E8A127B114F122C30F367E725A78C6672B89AD5F1DF37909A72313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752360, "uuid": "27fa48c3-7cef-4b75-96b4-cb1d0d09744b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752360, "uuid": "2fc4452e-533c-499b-a90d-591204cd2c3e", "value": "24576:6y59CzvixJgixkqqiIQ3S+d4PdwEvRWV/GHOGh7F:B0viHg8qiTisfouGHOGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752360, "uuid": "a1d845ee-118f-4d78-ac19-45201d1409ab", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752360, "uuid": "7bc7a520-df76-4d39-9968-687fd8f2a3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752360, "uuid": "38cdaa69-124d-4bfc-814e-6c1eec9d411b", "value": "client241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24002947-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752059, "uuid": "abb85b3e-432c-43a8-af6e-7a20056a26a8", "comment": "Malware payload (RedLineStealer)", "value": "2d0f01f662328b02e967e6e5c7709647", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752059, "uuid": "2de7731b-06ea-4876-8f53-1ccfd676d816", "comment": "Malware payload (RedLineStealer)", "value": "3101f6b59315da1a8b0024755a66e13319634e51bc695ea60361c1be51cddfe3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752059, "uuid": "db321d22-4e2d-4bb5-b2e2-18dc82ac31dd", "comment": "Malware payload (RedLineStealer)", "value": "3dd83a599f3adfed236f0592baead6eeb632a364", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752059, "uuid": "042de1c1-51d6-4e11-b8bf-c6aca4ff6aa7", "comment": "Malware payload (RedLineStealer)", "value": "e9f22c2ec3dec4fa89dd4cc2eb72782c9bfd59d259a66a138462afaf248f200f8fbd4d03e1743fb8b1493ac0a79fc70a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752059, "uuid": "f4d1b9ec-fb5e-4321-ba43-e211ee18158d", "value": "T14B64E12136E1C076E25705344AB6CAF65A3BB8395B6159EB7BE4523E0F343C2DE7430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752059, "uuid": "67a40d83-7ef5-447c-bf7b-e48cd063371f", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752059, "uuid": "a721e844-cc61-4a85-bb68-ab32618da7d8", "value": "6144:qYExnoTGaq6h6KgRe7YaQX9OfJdncZE6DPbK45:qVxnoTGa+BUYaQ9QtU24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752059, "uuid": "a3431ba0-4cc0-4941-8c41-c75d80849bfe", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752059, "uuid": "3df6e618-841a-4efd-abd3-dfca856cdcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752059, "uuid": "107ac472-85a1-40d0-bd9f-f14363354dbb", "value": "translator547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01579ac0-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752430, "uuid": "d74efaaf-62d8-44cc-b7de-bab069e8eec3", "comment": "Malware payload (RedLineStealer)", "value": "2daca302c06ef1ca016ea7b57b86ddf2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752430, "uuid": "48d8303c-d917-40e9-8882-827c3654fa15", "comment": "Malware payload (RedLineStealer)", "value": "31083b48a57f6460a90315ebe185ec1c3b69088631125623b8434fe76f36f228", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752430, "uuid": "c47605dc-2b8f-476b-9565-d69bb98f0f49", "comment": "Malware payload (RedLineStealer)", "value": "b7eb6f1baaff3100243ec56a7867b88b39b95818", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752430, "uuid": "a4cfefdc-8c1e-4a9f-a007-0dc8c90be458", "comment": "Malware payload (RedLineStealer)", "value": "76fb2efc28ab81542dd8bf9677695c974853d5faeff24cead3d267c5384246a429b1ee989605131e92b54e12a6f96ae4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752430, "uuid": "c96df8b7-e9c3-4ff6-955b-88d4b3aff25e", "value": "T1D32523139AD98173DD332B7044FD06E30B35BC726C74832E36CAA68A9E326819575B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752430, "uuid": "94ae4eb8-fd9b-4965-8d83-67c14864c980", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752430, "uuid": "6e1a02ff-a1c7-4308-92bd-be60db6358b3", "value": "24576:zyBG49g3KTNNeq5so13oHWqdyGoHrPE83WeMYwUBzfKI:GBG4a3KT6qv3o20yFHrs83/MqfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752430, "uuid": "517e1da1-0c60-4c99-bacf-9ce32306953c", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752430, "uuid": "72f0b94c-f90a-4a44-886c-3251087a93e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752430, "uuid": "1abb8b70-ea53-47c2-857a-472058d4c602", "value": "finder774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6388cc14-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737563, "uuid": "6206e85c-5452-469c-bb75-4de945a962f0", "comment": "Malware payload (RedLineStealer)", "value": "567462b111ee58ddb24efe96ec8663f1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737563, "uuid": "585994bf-91fe-4ca8-9909-6df403b4f51f", "comment": "Malware payload (RedLineStealer)", "value": "313a8da33b24f6a7b84fe41055943bd1f908e64cd929ec6cb3ce7aefb2444614", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737563, "uuid": "182c42a0-12ee-4921-af9a-ebabac181f5c", "comment": "Malware payload (RedLineStealer)", "value": "c7a688db0acf4b22aef828802c313677eb0fd4b4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737563, "uuid": "9cfa5678-c2a6-479f-8446-78708085a2b3", "comment": "Malware payload (RedLineStealer)", "value": "669c95f4b7c2db858593e96f79d494525716c2e3f1a6c14b6330134759e7d2e3944ca6dc3b9fef2bd9be551337fbb642", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737563, "uuid": "f2b9db57-5adc-4772-b138-854a1ae61d9a", "value": "T184252313AFD44537EAB617342CF603831B35B862DCB4531F2389A55E0CB36E5A632B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737563, "uuid": "b84d7a8d-03d8-4fe1-a85f-52392a66e23f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737563, "uuid": "367aeaae-f93d-4525-8a47-7420bdf5d4ef", "value": "24576:mycUrHmbyHP5RqlnnIlJB0WAQB5rMKyyp/7QJh3C:1cUrHmWHPUdQbMKTQL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737563, "uuid": "d7d36a7a-5f4c-408d-89ed-5ba861ac84e4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737563, "uuid": "337f393b-0d50-4788-8004-14e9c3f13ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737563, "uuid": "4ee1c79b-79b1-4268-93aa-95beeac83a0f", "value": "pdf-reader-plus481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c90ab3c-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684734920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734920, "uuid": "d98f8aa1-0151-4365-9074-16a78c084dac", "comment": "Malware payload (STRRAT)", "value": "e99af34d39ecc884ec19065386dae4e5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734920, "uuid": "c6b7866c-65ea-40dd-9a90-eaec510207ba", "comment": "Malware payload (STRRAT)", "value": "3167cb1b959b6fd9dc08d61c8db28aa787b0c16dd0818fd1d77fb9951c5652e4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734920, "uuid": "d84d5aa0-d32b-48cc-8f75-d5f266cda5af", "comment": "Malware payload (STRRAT)", "value": "9f788fe6b218a0441301f75a835aaa3fbf01a21a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734920, "uuid": "c7bc4326-472d-4892-8f19-c1a5ddb3b29a", "comment": "Malware payload (STRRAT)", "value": "5488499e79f04a6590ca975980fd47971b1216fcbebfe90015c429ad6b09037f972a80cc1d721697012ccd7b68f1a893", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734920, "uuid": "5d351a2e-5cf4-4d23-8143-691d3249b3b0", "value": "T1B524016EB9DD94AAE91BE632058997364A0E2284D549F37B30FC14194F70C2F0F5A9CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734920, "uuid": "c593c746-5617-4375-a255-ece2a80e10af", "value": "3072:ZrnBhP3M/HPX9xxQD5gBb5F6MiIUI3WpzUpLH4lqA8t8H12vzBtPPs0Pml:Zrn/P8vPX9xxg5CRi43WpwZ4lqbvNPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734920, "uuid": "80192b06-749e-45b2-b761-d26b4151eff8", "value": 223916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734920, "uuid": "eac94296-c1b3-4db3-97dc-52ccf73d8b2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734920, "uuid": "4d02469e-d2d0-4142-8831-8211d97606c7", "value": "RFQ7586281.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0b0ecb-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684744882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744882, "uuid": "a64b01d5-130c-492c-ac34-5f342e53a3af", "comment": "Malware payload (AgentTesla)", "value": "4a4c33661d3d4daac1d97c372278f7cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744882, "uuid": "e98e6e65-7089-4250-af02-7f0fbe704279", "comment": "Malware payload (AgentTesla)", "value": "320c4584c3d392006ef443e5743123a45909fbae309c7561ced8fac11e11e5d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744882, "uuid": "ad147eb6-89f0-49ac-8ef7-b9b79c1026f1", "comment": "Malware payload (AgentTesla)", "value": "1b3495fe709edd2387483012e6def769a31775ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744882, "uuid": "d7521839-4964-47bd-8f2b-690f0fdbf4e5", "comment": "Malware payload (AgentTesla)", "value": "8d3767fa87cb6b8bb44caab823801d1ef679573416ccc655b62fc1df40c467945126242a7be09cd698702298873861e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744882, "uuid": "1547442b-58e6-45e5-be99-3824e97245cc", "value": "T1F6F48C5633B57621F47D73BD01196388CB38B84A2052E12A1F9A39D586F37EB770A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744882, "uuid": "1a54728b-2740-44c0-bb06-2ad9198f3f03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744882, "uuid": "09a276e9-c97b-4fa5-a003-36fa5573b17c", "value": "12288:wvV+s1bSQT6tjjdB4abVFulq+bl37U0Du4nW6zg5ZcQKyKuNO9EdY4wVt0K4ZGJT:wtafulzblI0tWig5ZPKK3difhM7m0EXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744882, "uuid": "21b9506a-6853-480e-8b96-79899d1f3437", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744882, "uuid": "c90f8aef-095f-49ec-bb7b-cae1ec61edca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744882, "uuid": "51812646-0ba0-4457-be3f-fe7282ca2cdb", "value": "dekont ( 30).pdf Garanti BBVA scan0010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98675e01-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752254, "uuid": "f6915ac0-6f8c-4040-9f32-b5332f7dc409", "comment": "Malware payload (RedLineStealer)", "value": "83857559a413e51853651ac21fc81271", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752254, "uuid": "06a52f66-c346-497f-b36c-5c642784edc0", "comment": "Malware payload (RedLineStealer)", "value": "324acdc5f2f73138a851e9906abccc4aa378503a38e68c0125241d89eabe0f71", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752254, "uuid": "b1233d5d-7a8d-448d-8328-c4190577b003", "comment": "Malware payload (RedLineStealer)", "value": "09fcd0160a5dfb43a3a47725ec8f53f57ed1f84c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752254, "uuid": "c7e568d0-f125-42e8-8aa9-9d04af116624", "comment": "Malware payload (RedLineStealer)", "value": "d27818b3cc703e1a6e6576049ec38a22f29249d7a738cca05b18977de891f38be7a000d05eee140e8fab2132b293819a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752254, "uuid": "2f8cb944-4e3c-4b5d-a036-e3db0f1fbe7e", "value": "T152252307F2D484A3DE352B7054F646C71F34BCA1AA34A7AB2345B9271CB278073757AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752254, "uuid": "88904d20-1d21-4689-8219-92e7e2008a0f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752254, "uuid": "bf85bd1a-a078-4b52-a2dc-10e12ff7e105", "value": "24576:1yKE39yEs3ZWqIfq3aba5b63jDV0gw2nEipJX7TCJ2f:QKE3YEswqYqaGmjVRLrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752254, "uuid": "1fac8f17-330a-4381-81a9-9fb554dcfc35", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752254, "uuid": "9352d6d1-b117-4d7e-9aa0-5b48535c8cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752254, "uuid": "a0f06bf4-aac4-4b71-b9cd-e7505bd0f15c", "value": "423458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7595351-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684747985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747985, "uuid": "00e11aa4-c685-4b6b-9d88-b8f71465f997", "comment": "Malware payload (Amadey)", "value": "ee4eea61ff47dfbfcb86dcac7ba09181", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747985, "uuid": "52c31149-dfa4-47d4-803f-6e8e1e3644ec", "comment": "Malware payload (Amadey)", "value": "32db6606ff8195090c32b3c74cc2e4bf4080bb39a3d279ba6cd731ab9831722b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747985, "uuid": "e5200111-cb29-4148-8a8d-b4e269eae96f", "comment": "Malware payload (Amadey)", "value": "cc1ce8f223bcbd35c7a84385f0eab89b22850c03", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747985, "uuid": "43a84767-c27c-4eef-bcde-2b31d0dea355", "comment": "Malware payload (Amadey)", "value": "96aab04812630bbc5fe6820240c85e9d83775420fda3eae589c3c82eab75fa4e70f364f740835112030509b357e3f93a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747985, "uuid": "e1858481-15e6-492d-9116-a999bbaf4cd0", "value": "T1F52523466AF89173E8F41BB06CFB41870B397DA19674C2A7235A6D1D1CB2AC1A43473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747985, "uuid": "018e922a-fa9c-46d6-a006-4f6cd3092f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747985, "uuid": "8c0c3030-bc8d-44ce-a540-26760538e867", "value": "24576:lyHKxAPRLLSv5YmCdFm5ppilS/MCwdwhbbKTTJuv12xY:AqCKYmQFmbklSUC5b2TTQvox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747985, "uuid": "36730e0d-0bdc-415c-980e-726fdc7cb7be", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747985, "uuid": "65a9c140-bfb1-4862-bee6-a9ed9511c544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747985, "uuid": "499b3bb3-a261-4ca3-b277-a802636a2375", "value": "parser490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01d8e47-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738631, "uuid": "d213418d-8c0f-4d68-b752-e958da907582", "comment": "Malware payload (Amadey)", "value": "3cd946c8eb39ba77d8a826d0ac7afcf5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738631, "uuid": "c37e2a9a-3432-463c-b71d-1819d1a9d18f", "comment": "Malware payload (Amadey)", "value": "331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738631, "uuid": "d74a4ed3-647a-4626-8c76-f9dc3900ef3c", "comment": "Malware payload (Amadey)", "value": "cd29e3ee7afb3e021c4d562991f9509afac3c2f7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738631, "uuid": "24e7dd7c-926c-4b0e-82dd-f3e28e73a4a7", "comment": "Malware payload (Amadey)", "value": "e41a16a60d37022bcf2c0b85456dc7e3136defac8c7daac206062206a17f2a926d5d1bce80bf5f3b0fb622fe5a777d9e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738631, "uuid": "f2a686f1-7a3d-4be9-a78f-d67fa4f2b453", "value": "T155252307A7D98173E9F94F3014FB07430B327DB05DA4931B6B8AA45E09F3695A5313AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738631, "uuid": "096fd5c1-b453-4b5b-a226-85078f60e790", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738631, "uuid": "e9dd1d6a-1e38-4935-b565-80edb1dcc41d", "value": "24576:gy2qkWYphoKoKebzCk9+bfuKv/yy5Tkv6oAvpio1:nlkh2L+vvK0Tu6zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738631, "uuid": "cc5f42c1-742b-4be5-add4-c11f3c786bb4", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738631, "uuid": "ea414093-daa9-4d3f-8bbd-9224ef8461fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738631, "uuid": "878dfddb-1c88-4ec9-9f43-ce71cf5b85fb", "value": "331502b02a8391a32574f87801f740a2d3698f142a50a5d55e6acb1501c84452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad833b9-f89a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (EagleRAT)", "timestamp": 1684757761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757761, "uuid": "45beb560-c7f0-4354-919a-17e8e7054067", "comment": "Malware payload (EagleRAT)", "value": "39059ccbf3911fef92bcb4fcf416a305", "object_relation": "md5", "Tag": [ { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757761, "uuid": "aea48262-07aa-47a2-a051-867f8f3da1dd", "comment": "Malware payload (EagleRAT)", "value": "337906b1a17437fceed93e9ded0e5f442ba0a0ba39b5bc9472c69ba4b9e96294", "object_relation": "sha256", "Tag": [ { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757761, "uuid": "4a0e59b8-5378-4aff-a0b5-b17740e81804", "comment": "Malware payload (EagleRAT)", "value": "e3444766d221cc57a8c8b43fc5983c506a8a89ca", "object_relation": "sha1", "Tag": [ { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757761, "uuid": "3df8dae7-67f0-4149-8b92-63f228ffcf44", "comment": "Malware payload (EagleRAT)", "value": "680a33be6eb4b4abc51872eef949f91ee9f5973fe309f214e0c6192c075c8caf6ffca6a483e45f33adcdc9e0eb6438a4", "object_relation": "sha3-384", "Tag": [ { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757761, "uuid": "6be08a7d-84ad-4476-8f0f-e302cc86619a", "value": "T19B145A143F85DD36F4D9D1B0B2F27104DDA2EB7B12A2CB499E89BA25603F2D2E47E114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757761, "uuid": "97a75eb1-24e5-44ef-90f9-cbfd739f13c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757761, "uuid": "a5b338ae-c48f-4a30-947c-b92cf1c500c3", "value": "1536:YNh3HaMmkefuYjsDAiENQVseNbIB2bQIIl3QOB+BONKXc5itQONkpbz+jRqMvS:A3GNjsD8YNOKQwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684757761, "uuid": "54ddc426-da52-4db6-9929-3ee1da347da2", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684757761, "uuid": "4aa52d04-4ee3-497d-a832-b1ad0120c4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757761, "uuid": "66030d61-a86c-49a7-8e44-517c0a848985", "value": "39059ccb_337906b1a17437fceed93e9ded0e5f442ba0a0ba39b5bc9472c69ba4b9e96294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cf696f-f836-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1684714808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714808, "uuid": "89732082-b18c-4c89-bf30-5fbf1fae46bd", "comment": "Malware payload (RecordBreaker)", "value": "06258d3f31456a25ca8e09c14c7e4b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714808, "uuid": "55cf68ae-8b33-474c-9265-66483ed9725f", "comment": "Malware payload (RecordBreaker)", "value": "33eb404307f39e4eee686aa5c3ede56837998f172148371fb241579fca043803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714808, "uuid": "4b6f6953-c4d8-4b5d-8f45-c271d17167de", "comment": "Malware payload (RecordBreaker)", "value": "6283444018de6d2c4fd09e4b43931191ac75d6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714808, "uuid": "a2e10885-3b15-4d30-ac18-58bf59024b54", "comment": "Malware payload (RecordBreaker)", "value": "9e097eebddf4e64b6d769a9428d32807b9459fd916fc97410fb072d9da8a04c5998b616b7330b545d0914a27415dfeeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714808, "uuid": "28dff58a-770a-4ff5-8c4d-0d1753b5199c", "value": "T1B9949C0392A17CA7F9264A7E8E1ECAFC265EF5518F4D6BDB52584A2B04B02F3C573701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714808, "uuid": "85dadcee-9471-496e-9a41-a4f70f6074b3", "value": "85d599a3cf99c75bc9158189f8cffef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714808, "uuid": "d93f9e0b-bbbd-44d5-a4b5-34a445e7b137", "value": "6144:8E69BOLoZY94whiXZcw6tPHQra6KtAC6icxT57eQ:g9IMZY94+ipcw6Vwra6K2Bia1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684714808, "uuid": "dbff678d-f176-4210-9842-f65c6da3bbc4", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684714808, "uuid": "f9530e1a-9bb5-4b2b-be8d-d15acc69b7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714808, "uuid": "da760ca3-ae63-4fff-8b70-4e65c1833536", "value": "06258d3f31456a25ca8e09c14c7e4b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a97faf0-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752258, "uuid": "2466701b-ebd0-41cc-91ea-aad13a823d92", "comment": "Malware payload (RedLineStealer)", "value": "5c0024b9be2b6385bd18c1a27b90a70b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752258, "uuid": "cbe6dc01-5dde-4412-8509-9be6b4a0e912", "comment": "Malware payload (RedLineStealer)", "value": "342ce456558531a366c14b73e695f088bd58a4142e2b482af0322d8fef100e45", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752258, "uuid": "3b602691-b912-491e-8918-5240a6f73ea6", "comment": "Malware payload (RedLineStealer)", "value": "77ee8396fd817142254caa92f20279f61c7dd41e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752258, "uuid": "93b5adf2-29e6-4749-b424-4b531c69b5ef", "comment": "Malware payload (RedLineStealer)", "value": "7abf6fc110e590b01d5bc16010419334a49aca0b9db531bb9b904c96618791290d6aef58fdc9f1dd1cefa1d7e0f95cb2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752258, "uuid": "d568461a-c866-462b-b0d4-d9bd31d96d9e", "value": "T102252305A1E94132CCBA1BF088F62BD32B36BDD0997C531A6512697E9CF17C4A4B473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752258, "uuid": "f068253d-4852-4e96-b5d8-2fa36026ab9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752258, "uuid": "0d1ebdf5-cbff-4e49-8f11-f14d96608245", "value": "24576:ZyTRycKKn4+PSAafsbD0iMQG5R0COzHwfRMTeGKt:MtYK0RsciW0zzHwJ8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752258, "uuid": "7b89910c-4377-4f48-835c-a5d04b1e3990", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752258, "uuid": "abe8fa36-c7a6-4258-bdb6-9dfbff3e6ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752258, "uuid": "d7a15761-fb9f-451c-b198-898a9efeb471", "value": "423781.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd7a282-f886-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684749148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749148, "uuid": "2ff37292-fef4-4867-bf83-c13c1441664f", "comment": "Malware payload (AgentTesla)", "value": "d2ff4b38c8a9be88bfe01a73daee261b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749148, "uuid": "6a6bb644-6d90-4542-b66a-ffa6870945f1", "comment": "Malware payload (AgentTesla)", "value": "345750d39c7d8b5faf43e95d7621ab0ea56fbd219a78befa08b3ed5099540dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749148, "uuid": "425b53e5-c348-4cb2-942e-9abd47179bec", "comment": "Malware payload (AgentTesla)", "value": "bd3d9b5448cf410385e6f59dee2c5f611b9a9300", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749148, "uuid": "d8acbb8a-7d42-42a1-a0f5-f51f71cb40f4", "comment": "Malware payload (AgentTesla)", "value": "2d6273cf655b363c3a768ce531c1d6c5825107fbead0a8b118c8e26f73602692e10311552018ee28a85b89591a267fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749148, "uuid": "2a1f3e82-8f69-4965-ad8a-2b58b6cd8260", "value": "T1D2E4F1C266848D15E6AB4EB91EB2E63403756CA5EF13974E24F42C8B7C56B813F01BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749148, "uuid": "fcf9ef27-445a-4b47-b3da-579d76248115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749148, "uuid": "51aceab5-75cc-4bf1-b441-5a53c6939052", "value": "12288:3Tax0YPX/NqPsJfqBxZfb4NFcoY8izzIiLMlc6+/IE:3TZHPs4Z0NFNNiPRLM+L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684749148, "uuid": "6711c49a-a3d1-4fe4-925e-6df05de7b5ad", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684749148, "uuid": "64f638fe-2d6c-404a-a2b9-1e6dd6e360f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749148, "uuid": "56d72a1e-180a-45df-ae64-ce0b9b2be2ab", "value": "d2ff4b38c8a9be88bfe01a73daee261b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22fa0f0-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752325, "uuid": "be7aeed4-7bbe-45a6-b536-f43965d2cd25", "comment": "Malware payload (RedLineStealer)", "value": "b50a8f25b42b34412e12c1622860e280", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752325, "uuid": "17b8862e-477a-4edf-97ec-2fdadf16dde3", "comment": "Malware payload (RedLineStealer)", "value": "34f68a65df1a163bc198c98d890e1443cee7ec8a67f927a777f5eb06e69f273d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752325, "uuid": "e596f471-5257-46bf-8b4d-718a0cf003e9", "comment": "Malware payload (RedLineStealer)", "value": "729f55093f8aea30039b561130d844948fa8ada6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752325, "uuid": "9b5088ea-8a4c-443e-92f0-110c16de1d1b", "comment": "Malware payload (RedLineStealer)", "value": "aa32b7f68fbfbe5ba80a8bd618b21bd5dcaab6ffe24eda5c475b3b2721a8a2caa8d3d3f2eb3c7d7853f68480268c0eaa", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752325, "uuid": "736d07da-489c-44d0-9840-9cc03186223b", "value": "T1E0252317E7E84437E57617302EF742930B31BDD69A289B37378A6D2F1872A9058603B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752325, "uuid": "00eefbb5-83b7-40f7-9f81-4cd5b99f086d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752325, "uuid": "3d6b7b55-4f9d-48c6-b9ff-d6e958c6711c", "value": "24576:jyTUYe6PIjloyFvN5UqmTxxVWHpCSUQi/lnRpZJh4WGyZMiX6k:2rbIjloyFvN5UqkxxV6p776dBJh4WGsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752325, "uuid": "195c5b6d-81ef-4b65-a02e-40a9a6616abd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752325, "uuid": "c1818888-a6ae-4045-9a9a-721d6f958068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752325, "uuid": "c4af0ed2-26ba-42de-bc8d-4764c3bd0067", "value": "adapter186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d900a5-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737350, "uuid": "6a484eb3-d11d-43b7-b1b7-80bcdab90d0c", "comment": "Malware payload (Amadey)", "value": "fd86bc7de5dc4b1a33ba89afbd7370a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737350, "uuid": "97c11e5d-2ad0-40d8-8326-afc6628c91bd", "comment": "Malware payload (Amadey)", "value": "353f18add87f29d89694b153e926acb9edefdbe92238520883258a2f86a5106e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737350, "uuid": "9a905824-9448-4e65-af81-cb945ce24311", "comment": "Malware payload (Amadey)", "value": "46fcae4f0363e2b341d76b4cbec2fc230c7245e7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737350, "uuid": "19113fe0-e919-4189-8ec8-c494af4d9b57", "comment": "Malware payload (Amadey)", "value": "4ff4da7e27da48ddd4d359fa7544605fa08568e06e789bea287951f7b0a5111fea0b7c96ea65bc028367ae6853cdfc32", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737350, "uuid": "6aec4b5a-e2d2-41aa-ae0a-cfac67360899", "value": "T1F4252203ABE14072EDB51B30A9F613C31F3A7D909E7583DB2345985E2D32684E6B6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737350, "uuid": "b07e39de-0fce-4419-a5af-89279af087cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737350, "uuid": "e5367ca4-47cb-4caf-92e1-7f3a8fb85fe0", "value": "24576:4yDNDm9ge9SDpUZ3czm6gQ8Ev0XZqFhQ1gJ:/dIca9ciEvQP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737350, "uuid": "ed70a3d6-175a-4a9d-97fd-0a964da4ab04", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737350, "uuid": "235bfc3b-3b11-46c4-b786-c4d608064b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737350, "uuid": "afcf7d7b-154b-4d65-987c-23a7f247c6e0", "value": "Temp388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3d70af-f881-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684747083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747083, "uuid": "e147a1af-72bc-43c6-8c26-04837dd9a11e", "comment": "Malware payload (Formbook)", "value": "56c549f58a5599f70ff46119d85e4294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747083, "uuid": "12d7b10e-64dd-45a3-ac91-85d125237b6c", "comment": "Malware payload (Formbook)", "value": "36bd2802a452a2bee1659648b0a4b1de0cde1ebac09d0d5ebe0e2c1189483432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747083, "uuid": "1ed098f6-9b37-47c2-912b-c20bccc70862", "comment": "Malware payload (Formbook)", "value": "60af63e3de940c609929f0101867dd3b2bb2c24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747083, "uuid": "303f137b-5119-4a0e-a13d-5375d54dc13b", "comment": "Malware payload (Formbook)", "value": "5b4e0dfe01f9384713988bbca9c48c25b3d5f566d388ff0066a15e5c27be7c5cc7eae04e750310b2ab27254a939bf227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747083, "uuid": "3bcc5747-0a65-4714-baa5-0957a1bb0636", "value": "T18915F14119A46E21F166AFB91AB3F13443796C95EB23D70918E02CDB7C37F827A12793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747083, "uuid": "c6b5129b-416f-4ae6-8ae7-c1fe38c4ea28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747083, "uuid": "682e5d6a-a390-4861-ae08-c2dcabda7477", "value": "24576:W8ZUsk4Zy5lZoZgY8IrRmV9lKyRyBD2qm82YwP0:JZUwklWZghaMTl98d27YwP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747083, "uuid": "7ba9a970-f79f-4071-bfdf-195de51ed37b", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747083, "uuid": "d342f319-508b-4f82-8914-e395f1aba141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747083, "uuid": "f6c1eac8-6fc8-4777-a1a4-b92310c11db0", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca545918-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752338, "uuid": "8c693701-e08b-4bf0-a7cb-7356a37202d7", "comment": "Malware payload (RedLineStealer)", "value": "0de4c80a486caa480c919cfc5bdd9b8f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752338, "uuid": "f5521eaf-fe12-4707-af5d-dade7c3a8141", "comment": "Malware payload (RedLineStealer)", "value": "37caa50dba770585cd14a4ee4fb3965c7e684206db1b7ec769d7e3f14cd719d0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752338, "uuid": "cba3ded8-1d4b-4198-9340-5df45ee36995", "comment": "Malware payload (RedLineStealer)", "value": "1389bdf94c232758bd450fd7eaad2f7dbc37b501", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752338, "uuid": "0ff96d23-f091-4dfa-8639-4acaa19a5115", "comment": "Malware payload (RedLineStealer)", "value": "cbd005ac759887ceb81921e5cf8a43919e4a4a26e3886b10450a4380107a36234464731fba869098ef50f58554ee3b1e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752338, "uuid": "7ce24098-e64e-4b77-9dd2-5fa9cc0d86cd", "value": "T174252302B6E888B2E5B62770ACF103A30B36BDA54878831F2B456D5E4D336C5D9717B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752338, "uuid": "3ef24081-7c2e-47dc-a0cd-cd1c66a6b728", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752338, "uuid": "ccca456c-97e3-4749-ad6b-18942c489ca8", "value": "24576:3ys1upuUZr2fri+7evOSroSbh0ZLTY5cr3:Cs1SuTzqoSSu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752338, "uuid": "fbf7a2b2-1324-4549-b33b-7fd85adc6d01", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752338, "uuid": "9c641248-1a47-4818-9e5d-a264860883db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752338, "uuid": "68757e45-23e2-4ca1-b3c9-223084c93b5d", "value": "backup573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7cd121-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752365, "uuid": "c10a1702-a7cd-4ae4-88e4-e201a241f659", "comment": "Malware payload (RedLineStealer)", "value": "2b3ba0f7fb1dd7943dc808460df088ad", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752365, "uuid": "cf8b8158-1dca-4f61-bfc3-c4956f71093b", "comment": "Malware payload (RedLineStealer)", "value": "37cd92314c36143b865c4c9e198028b82298c85554f816b7b40e9fbe6c2fa1fa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752365, "uuid": "95ab45dd-9d3e-4a34-a8db-ec24917921d6", "comment": "Malware payload (RedLineStealer)", "value": "6422b429088abf0711c832239611fabfe6b420ec", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752365, "uuid": "665eadeb-a21e-4f7c-b2d9-dca6e2432db7", "comment": "Malware payload (RedLineStealer)", "value": "c0e90c3ef2ef26b4a3a26d852425a1bba3c82dbc07fe8b5a68126e5222d78db07ae641bae10148ef169a2f57916ecd38", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752365, "uuid": "d09e15c2-50f0-41fe-a06a-8d779890b755", "value": "T1A3252353FBD98126D8E02F7065F652C317367CB49E7852AF2744296E0DB2AA4893133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752365, "uuid": "99ac5e9d-8c0a-49a0-b67b-6dba70f0b92d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752365, "uuid": "43d9890a-a599-409e-b3fc-34a25d05f8df", "value": "24576:KypFUc6p7yZNJhXErqIX6wF+8yWL0n7Abv7Ge7Vs4w2Bxl:R/FKmZDhXcp+8yWLv7GUwQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752365, "uuid": "e2d91a1a-583d-42cd-9f21-397c3f03aada", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752365, "uuid": "b367f645-bc2a-487a-84b7-b0cea85a0096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752365, "uuid": "ff4ab06d-6ecc-4cf0-915a-6f61a63a5d99", "value": "client647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77490dcb-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684744897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744897, "uuid": "cab82794-e88e-486f-9daa-312ecbe98097", "comment": "Malware payload (RedLineStealer)", "value": "ea35fc456f2e6a7682a35ae137950239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744897, "uuid": "46cf18a1-9056-4b9b-b3c6-02d58f16000f", "comment": "Malware payload (RedLineStealer)", "value": "3852b4cb45769223a426f2bddb4403e9a1bfc9b2973eedef43a27ca2eb5f80e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744897, "uuid": "bd11cafa-052f-40b9-a130-78a6e0e8d758", "comment": "Malware payload (RedLineStealer)", "value": "e4f7da8bcfcd5f5bb4400a87bacdd763cf28df8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744897, "uuid": "5d15f4cb-efd5-4953-a001-879c16237dda", "comment": "Malware payload (RedLineStealer)", "value": "adfc2d6f88b6638a102f1848beb61f90fbc1791e5792422a93d860135d75e18e8aee0ee43bfe8d10983ca1c48715961d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744897, "uuid": "968982af-c28b-49f0-9188-2c7f4e76d31e", "value": "T18A647C137AC28037E0F74BBD85488EB155F618A01B27E1E7ABED97DE0AD24D1E621707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744897, "uuid": "b0afe4df-0d8c-4e97-b94c-d32b769b96a2", "value": "10e9c84f5f1d079cf0dea90c24ccb626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744897, "uuid": "e2e61699-0e0a-4846-8f5f-0aa6c742280d", "value": "6144:LUyii7tfIHg6y/Xokwgbed9gFaWZkyWG+Ym7i:wotf4gP/4bV93WZkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744897, "uuid": "c7ce3317-b9f2-4e8c-85e8-1296ca0450ad", "value": 330520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744897, "uuid": "7a3b2390-e333-41ac-9275-05480b01447b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744897, "uuid": "58befcb0-86be-4463-82c2-bd2e831fc281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8def89a3-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737634, "uuid": "09fbb789-5b16-4c5b-a13c-553733cafba8", "comment": "Malware payload (Amadey)", "value": "5c792fcb60a4f290345a629b7ea9beda", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737634, "uuid": "231ffb36-9a50-4470-aedf-66a293d033dc", "comment": "Malware payload (Amadey)", "value": "3940e17907c1905d17501b371863526855b2d35f2612bd6dd67c78c1e49f3d96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737634, "uuid": "4592ed45-14a3-43b9-aeb5-d380eabebad1", "comment": "Malware payload (Amadey)", "value": "a406b82606aa8ea1ff42c8023d856fa374e27ef2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737634, "uuid": "55c9576c-cedd-45f4-9cea-5482b232c379", "comment": "Malware payload (Amadey)", "value": "b04a13b2ffbf8504f3766694f52f9d169fbbb59678aefdeb5472318c54984d5a73bb47068867e0127665466b0165ff43", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737634, "uuid": "b088640c-0b4a-4933-8c0a-496cc801675a", "value": "T161252307A7EC5062E8B127B0A8F602D31B367CA15A78D36F27446D5A0D32365E9B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737634, "uuid": "c4e5956c-0f95-4474-9e66-6a513a9a8c98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737634, "uuid": "07c97538-71de-436b-9c7f-580362ed5780", "value": "24576:QyjLlY7t2cyqgolUTuz0BrvaPkB6pnPCprelxAPTkrv:XtCXgRT+SvBcqtCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737634, "uuid": "e8696bda-07d7-4a3d-a86e-f10c53f2115f", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737634, "uuid": "29a80581-a16e-41a3-8ae0-c10345b23ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737634, "uuid": "d98f9017-9a75-46d7-8dc7-50bb52fcebd8", "value": "resolver984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273b6684-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752494, "uuid": "f7176788-dcf6-46c7-aef2-c527c52649fd", "comment": "Malware payload (RedLineStealer)", "value": "0cea844e4dd07dc6d10119a8803dde54", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752494, "uuid": "00249070-a466-4142-8fdf-818f59eb1033", "comment": "Malware payload (RedLineStealer)", "value": "39519e8a3eb03aeeaa62c1e987f08272b7316dda563ae268f417e1f1cb43e632", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752494, "uuid": "8c7616a0-9cf5-4f50-895c-7e0d4e239edc", "comment": "Malware payload (RedLineStealer)", "value": "c8b15fd441d41f10345cbb498deeedd528b295d8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752494, "uuid": "d007ba14-4bf6-4556-9527-79b112ceb0eb", "comment": "Malware payload (RedLineStealer)", "value": "b2b762533f330a118e470f725228cd43b40ef32899624a7a579b8df0470101d00df0612b28bad34c04d64f52c5fd3569", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752494, "uuid": "c0d41ff9-20ee-41bb-b1ab-e1db9f671cf1", "value": "T1CB25231267D4A073ECB53B7084F707A72B357E9099B48336238B656B0E72608597673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752494, "uuid": "d7d6f6a7-c498-4f28-9567-040458a4211d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752494, "uuid": "d4e87b83-3849-4524-8443-7eec84588af8", "value": "24576:/y9JFryYgfXUu/VgqYXv06OHzch3HRiuoQu96Rgs:K9JFryYgfXUAgqYXMfe3xiuoQuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752494, "uuid": "cd09afb2-c0cc-4307-93eb-cf2117ae1fe5", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752494, "uuid": "e1f17165-8fca-4e1c-b961-223f198e2f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752494, "uuid": "527d3a53-1b18-46ec-869d-2d1ef6185a40", "value": "multiplayer263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a80d5a9-f864-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684734568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734568, "uuid": "f74b20fa-754c-40c2-b403-6f8de10b4b87", "comment": "Malware payload (GuLoader)", "value": "e68d535cd07bc83b74f159c3d32550c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734568, "uuid": "ce1d6f6e-ed47-4ee8-8c1f-a63688fb8e7d", "comment": "Malware payload (GuLoader)", "value": "395680070dcbb2686d2cee57bbc034ec5ddbc4a73d595e9152478cbf3dde7abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734568, "uuid": "c1ba01b5-b1d4-4003-a1bb-6647dcd1d8ae", "comment": "Malware payload (GuLoader)", "value": "bf308f95dfd870576e6d50609ee902ad2233a81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734568, "uuid": "bf7ed407-9d02-42b1-89c1-ed7ac1d3c003", "comment": "Malware payload (GuLoader)", "value": "cf7f0d125dba23d305fd4e15b1cd91a085ae35dad885eb73e5fbfa40a1bfdadbce99d00e3ec3de66c9161404f969773a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734568, "uuid": "2ebe8e85-e37d-4875-a49c-c7761e9b1e5e", "value": "T1D584120929F0C123F0A69F3655B466FBBEB6EE1460A0028707547F967D363419E4E73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734568, "uuid": "081e0f5a-5b9d-4cd9-9e9a-b4eddd90c681", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734568, "uuid": "10f3deb4-5a22-491e-aa51-ebd1d8d80be6", "value": "6144:ap+gg4S4uYl9skCX32EiDPtxVTUlkypCElSLahELRpbxuOrkBpKgbbrs:2PSVzGE8txVT4pmO2LRpb/Q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734568, "uuid": "6eb29b02-31ee-4bf6-9ea0-ed5fa05a8b60", "value": 375088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734568, "uuid": "df9f8745-cc65-47bc-af4a-d8cc356f6a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734568, "uuid": "c23f632f-52bc-442b-b34d-27b910101e1c", "value": "SO97600676004_KOREA87004707.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d64382-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752282, "uuid": "ead60358-8705-4d74-8d8f-0af65500aad0", "comment": "Malware payload (RedLineStealer)", "value": "cdcf7442b46b1954df94160b384ec9ab", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752282, "uuid": "c566c15a-0c20-4318-be6b-39adec09d8a2", "comment": "Malware payload (RedLineStealer)", "value": "3958beec01a767443475a26a3b7b75979517b141e3047b6f375240ba75cc2659", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752282, "uuid": "67d7efbc-8f0d-4ac9-b993-da8ba1003114", "comment": "Malware payload (RedLineStealer)", "value": "30d8e34f42f90c2fdec56e702ddf9b6bb734e9a0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752282, "uuid": "026a8b82-28f0-433a-9cda-560cdfe2cc26", "comment": "Malware payload (RedLineStealer)", "value": "c53d4b1dc4f8ab55e0dd0cd64880b0ebcc146050daeabe5b8022865bb8ac2bb73af23ddc1e78e72a043f72d7bb3a32dd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752282, "uuid": "3a311f5d-831b-4a9a-8ae4-69d1b54b5683", "value": "T1D0252346EBD890A2DDB71FB488F503831A377D50AA78827F3685AA471D322E45875F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752282, "uuid": "1d541493-2c8b-48c4-80cf-4bcac160c2e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752282, "uuid": "c9cd28b5-4c2b-43ae-b432-aefbcbad3531", "value": "24576:ky4sp5ZPBjfm4YEqesSUkTnlDz2zjwvsGrqYxf3r5OeUnvC:z40TBbmSqesSUylbsGnt5Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752282, "uuid": "d325201c-3b86-4107-9c35-b643ebd5d99b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752282, "uuid": "8e255b44-c810-43b0-91fd-10e20037ceb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752282, "uuid": "66fc4d31-7abf-4e39-ae23-56c02f279294", "value": "86968876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a668bb6e-f83d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684717918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717918, "uuid": "78cae29f-dbcf-4f3d-8b90-f12c002c545e", "comment": "Malware payload", "value": "c8c82a0f0ee038fddb54cbf156f2e300", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717918, "uuid": "37a3d9aa-a6c2-4e16-bc3c-fc80ee4b0afd", "comment": "Malware payload", "value": "399987a10d716912a53e259227fd90bab5e239ac253ff6bd5171a71d9f719746", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717918, "uuid": "9b492b9b-a8c6-4aaf-a947-381fa8ca6563", "comment": "Malware payload", "value": "8c5d0ed46b025de5a464a9da0300183e444b5d35", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717918, "uuid": "f54ac185-8792-4c32-baaf-bfa5052e972e", "comment": "Malware payload", "value": "b488fec4a64db8df42c2131448eca667766cdb86018ad2aba499dbd7de14ec0fb5011c203496ce2c8ccd0b1a950d2534", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717918, "uuid": "bc9626cb-da93-48f3-895d-fb1e07bcaa39", "value": "T1217612AA2728771FC1028A309573FB3AE3744B496566D61AFEFA3AD13F739149C019C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717918, "uuid": "75c7cfe0-a308-4990-916a-893e9650d616", "value": "13b6fd52de0539c3ee52dddd27773b20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717918, "uuid": "db00a74a-8006-4296-b071-e0cfef69e680", "value": "196608:bFk1xjIShj19s9NtuwuU7wsaK381VGACLbRI:IhIShZ90puU7wsF3GEACn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684717918, "uuid": "90b163cd-4499-41a2-91e0-574e6a924564", "value": 7818240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684717918, "uuid": "86822238-1b2a-46ac-b9d8-f817c7cd16b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717918, "uuid": "acf7c44c-6685-469a-87ea-d6beef49298a", "value": "c8c82a0f0ee038fddb54cbf156f2e300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff57ee2-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752267, "uuid": "5d12fd7b-0197-4c1f-bdc2-0e859837207a", "comment": "Malware payload (RedLineStealer)", "value": "e7a5b9384e98d5824908250151350ab9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752267, "uuid": "647155a1-5881-4889-a63b-70781ed62621", "comment": "Malware payload (RedLineStealer)", "value": "399c54c2eee7682054160b286afb63afdf46995224531f4d2f13f68df90f865f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752267, "uuid": "d488c08d-2b8e-47ba-b95b-ac1a4d888662", "comment": "Malware payload (RedLineStealer)", "value": "d8fa0e261190fe467a0f995ea374336ce4202d7e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752267, "uuid": "437b1c2c-e916-4b05-a6c1-3d8494ebde62", "comment": "Malware payload (RedLineStealer)", "value": "43317a08f35679f3817554753eff14d40f70cc1b065b834f73eb7e95c0d898f28b57d16f3c2a5d9012da0ba43d6bf12a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752267, "uuid": "c435b427-21af-4c3a-b406-d08eec2f4080", "value": "T103252243AAE84423CD7233B0A4F707D31B36BE504968577E334558AA4C73AD8B5763BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752267, "uuid": "f9e1b4af-fe1f-4c6f-998d-668ae9419831", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752267, "uuid": "75cf5ca6-96c7-4501-81fc-4c4844801d59", "value": "24576:JyGzT/ZbdDh4h5kBqFR8jVNZKA2/LynKPxTj07uBhNupXCf:8UT/ZpD6h5qqFR8hI/yKPxc7u/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752267, "uuid": "1c0b3d93-d889-4978-a51d-95828e1921cd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752267, "uuid": "8ed54c7d-0643-4f73-aeea-39bfee6f6b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752267, "uuid": "c7e0b841-6042-4b52-8e2e-474eb5b88496", "value": "62263263167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0f94f6-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752400, "uuid": "39e35889-5099-4240-838a-e06ca06a74a1", "comment": "Malware payload (RedLineStealer)", "value": "e21ef2e82eb8428418cc2bb419f8219e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752400, "uuid": "6bacb725-cb4e-4b29-af9d-e8fcc604486a", "comment": "Malware payload (RedLineStealer)", "value": "3ac990d234b64812738c0a185d10289abfb34d5ac6e60b8d52cc65cf455610aa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752400, "uuid": "85e6bd26-14e0-46aa-9626-5322d70138db", "comment": "Malware payload (RedLineStealer)", "value": "c8d0baa12a48258c4e442c0f37449eeeab7140f9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752400, "uuid": "5e2e41cc-cd6b-479e-9c53-7cb270d6f0c9", "comment": "Malware payload (RedLineStealer)", "value": "43974b2f5b93773ab2f63716ef643113a029f10bbbd38fca772ef92d7b291aafe3a0c17f75f20ff3e48f589c8e9b192f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752400, "uuid": "fce31f9b-df08-474f-8b80-4622d7ecea96", "value": "T1232523635AE86035F9AA733018F706431633FC61EE78855B53D0BE164B62AC0AD743BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752400, "uuid": "d1bddd06-cc25-4241-847f-cbe60b191433", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752400, "uuid": "29264b60-3d43-460c-b7ac-f92b1b79d9f7", "value": "12288:rMrIy906lGJumJac8Z/9rTaAMmO3p1Hxm1Cj3NHo+RZC98qF3jKCBUwZoNAU:vyHGsv9rTruJxjto+rC98UBnZoyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752400, "uuid": "dddc1b10-acbe-4f87-a960-681b0d98d9c4", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752400, "uuid": "e14c20e9-021d-4328-b22a-a2899461a532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752400, "uuid": "dd86c059-73b6-4fd7-876e-74dc652a4aa0", "value": "download232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122126e9-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684779517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779517, "uuid": "a4947536-f5c1-4567-82db-cfeba104eb48", "comment": "Malware payload", "value": "29f014c8cbdafaef57c726f89e389bbf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779517, "uuid": "86febd2d-a4bd-4447-ab82-e73f7479e101", "comment": "Malware payload", "value": "3ad272c82f92330f63a82d8132036fdf910f0ecd7eae5c596138efcf085b8174", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779517, "uuid": "675beb38-8dce-47ea-8999-9e126368d8a7", "comment": "Malware payload", "value": "11993ea4580d1de1de4db76d19e421879554fcc2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779517, "uuid": "1b3aadb9-c282-443f-8a00-25868a5be6c0", "comment": "Malware payload", "value": "50948e64f7cffef9419bc9af02baca95880705fed7c61aea0daf8c82eeaed839662453792a91571adb1090cc726a0a69", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779517, "uuid": "64e29487-af31-4635-ab7b-deeb64adf7f0", "value": "T1AC33C55EE79B02698F5203B2271F0E99AABEB23DB3515071385C933433D9C7942766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779517, "uuid": "e9662c2a-f330-4c57-916e-66fd1305c130", "value": "1536:jf0Xvx3EMn7f0Xvx3EMa/igMDT7hOelIalZBKmK:jsXvKMn7sXvKMayDXhOelIatZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779517, "uuid": "a3567fc4-7cb8-4e31-84e5-fab226cc5efa", "value": 51625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779517, "uuid": "99548289-c7f0-4164-8ca2-a4d2b6e18c86", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779517, "uuid": "f194aac3-5460-42b0-898f-c0a8eee5a451", "value": "PO67754.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3b00ac-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737660, "uuid": "fe728f95-e440-4933-9b56-edf036e28c10", "comment": "Malware payload (RedLineStealer)", "value": "4ee7e7a8afbe7aa4cb941f590efe4959", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737660, "uuid": "7820187b-2b15-4c0d-9e5d-65e8b794bb7a", "comment": "Malware payload (RedLineStealer)", "value": "3af0fd84098a4487ccdc84592df239d77e9e5ff5aa60722259d8ad2e845d06f7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737660, "uuid": "b70f527c-e063-4b19-afc9-b27f3abc3769", "comment": "Malware payload (RedLineStealer)", "value": "f1aaf1046cb698051aad97fceaf1746a998f6772", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737660, "uuid": "108bf138-fc91-457f-a45d-cfb1ba5ba630", "comment": "Malware payload (RedLineStealer)", "value": "5c2cbe4ade23175f73b4e0dfef235ebbebb0f9cd38637664a66ba3ff8060056721784092808936ef8aaab4b29dbabeb6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737660, "uuid": "eae0f27d-037f-42e5-973d-15011ba57cd0", "value": "T1B2E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737660, "uuid": "e99a0e0c-0669-4594-b107-7c77f626f657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737660, "uuid": "7a253354-05ab-4e7c-8b51-a4d5b1fda9ae", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737660, "uuid": "d2e07a84-64a9-4147-a9ab-8a49999d1a0c", "value": 148822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737660, "uuid": "b7c6e056-0663-4a13-8362-baebe44dd097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737660, "uuid": "5c400334-94ca-473a-a272-9759bcfa2bd0", "value": "stealer368.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608a8545-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684745289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745289, "uuid": "2ecb1e2f-8fdf-4a1b-b907-6a70d50e8d97", "comment": "Malware payload (GuLoader)", "value": "0de4a885721122880b6c90a25a53ed9c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745289, "uuid": "a22804f6-bab8-4a47-a70c-3bc3745e2394", "comment": "Malware payload (GuLoader)", "value": "3b1b936cdd454524274cde13e24b5d75932834affcc9357bb9aaef55ff641fe0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745289, "uuid": "2c20219f-c940-47f9-9e65-3e7b515b0cdb", "comment": "Malware payload (GuLoader)", "value": "bf78081a4688f5e6e3ab10f143b6319d5d86c018", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745289, "uuid": "fa108012-08b8-4ae1-b96a-3726414439d3", "comment": "Malware payload (GuLoader)", "value": "2bf1f1b14e80bb409e19e25be314e7de902d7be4ce87f8d18f49c1db47bf7191fbfe4c0cd5e60f955c49a3d8d65b24ba", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745289, "uuid": "c7889526-1b6d-47d9-a95b-84d54f962f87", "value": "T1E1E21BA3D755170B8A4F2B47DC421B80A87853D50D31216DBDA913BE9A0686CF3FDF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745289, "uuid": "d830eba7-6002-42af-bb1c-ce3b6cfaec06", "value": "768:iSoLKDAsn3dG1HT9KcJfbsbpby+rzruw9DhXzgB/r:iGcP6nzqw9DRs/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745289, "uuid": "26607418-581a-401b-be23-0ee9fa463104", "value": 31544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745289, "uuid": "c335ddc0-62ed-46c3-ba5c-289281bb7999", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745289, "uuid": "bee06eac-0b13-4016-99a1-b3d31f9c4377", "value": "DHL-WD07381194737440-CANCELLATION-NOTIFICATION.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10773af3-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752456, "uuid": "05c4ad1d-f83d-4b24-a1c8-95a20b1ce5af", "comment": "Malware payload (RedLineStealer)", "value": "2782c8b6d8251e594e4b9f6494571dff", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752456, "uuid": "26557b91-ed7d-49c1-a9d3-81940d3eb1ad", "comment": "Malware payload (RedLineStealer)", "value": "3b39d9d760fce51e7af5a8ccd343d363424babaf206247d3246f5aaf6006bca2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752456, "uuid": "c1fd11c9-0bd4-4a85-8787-0ec1ca2dab1a", "comment": "Malware payload (RedLineStealer)", "value": "eb2fafec6b639a7d14f8c682741e25692ae14ace", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752456, "uuid": "fd2b695a-87d2-4d3a-ad14-a0281b66d069", "comment": "Malware payload (RedLineStealer)", "value": "2d159dc1b334b472cf2ed0791fe1a4517ef5b7992159e2c434008efa3bbe92e68e3cc1b6d2dc22f54429e10213e798dd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752456, "uuid": "8e428428-75d4-4a83-a160-d0a9c1fda915", "value": "T197252387EBE98579E4F5177048FB03931F363CA28EB6977703A2598D147169074323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752456, "uuid": "035109bb-179c-4086-be4b-45be45fafd8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752456, "uuid": "ab5456eb-701b-4452-b290-c11c09d16ab0", "value": "24576:xyxjZXB3btA9YJOjXdlOyxBc/nZb8z9BOg12Jj:kx9x3btASJYbxkh85Y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752456, "uuid": "5b1029a9-376e-4c5c-ae8b-af7ce1847ce5", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752456, "uuid": "ef77e84a-3170-4963-b966-9c0795316094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752456, "uuid": "c5619378-9df0-4f78-bac5-871c2c725fe6", "value": "input171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadb673d-f890-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684753628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753628, "uuid": "2c83048a-e6ba-468a-905a-aadcc4860fdc", "comment": "Malware payload (SnakeKeylogger)", "value": "0e188ac4fdba0579ed027c1c9bb954c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753628, "uuid": "47ce985d-3205-4f1c-874e-95fd81f21091", "comment": "Malware payload (SnakeKeylogger)", "value": "3c18c84aa93b3407f0202f0320af9621ff318c3cdd55eca9fbe0f4d7a14e5196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753628, "uuid": "f4a6a5b3-57cf-4b44-8cfd-a00c854e3adc", "comment": "Malware payload (SnakeKeylogger)", "value": "25a3bf57c6e560ac8e6444a1f37b787f489cb7c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753628, "uuid": "43ea65d8-8d5f-48e6-bf55-6a69d4104e67", "comment": "Malware payload (SnakeKeylogger)", "value": "3636e1a59b7b354646e96a54ad57c8d980017b4c7a910d9a04468e8fb2f8764071433f339cb8967ea879d818b37559e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753628, "uuid": "ac49e28f-55a2-464e-be02-c5987fa98ef9", "value": "T101E4E0C166948C15E79A5FB95AA6F63803752C64EF27830E15E42C4F7CB6B823B027C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753628, "uuid": "60efc53b-6750-4d59-9067-bdf76a7d41d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753628, "uuid": "a6d933bf-211e-428f-a735-ae78f679726b", "value": "12288:CTix0YPX/NqPsxBz/ZUB705chfEAKzsdV3yYXiNmBmdLExgOTsNQ:CTRHPs3zZUB7achfbcsdV3ybN0mdL0g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684753628, "uuid": "7effa8fc-11a9-407f-8216-bc22d4491f81", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684753628, "uuid": "0ad517b7-5948-4982-8655-04ffbed339e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753628, "uuid": "b363d119-3dd1-4dc9-ab5c-783387d719d3", "value": "ekstre.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe6772f-f8a3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684761870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761870, "uuid": "e24c4737-7a90-4d4e-aaf4-606be4ecc451", "comment": "Malware payload (AgentTesla)", "value": "bb8847dedcaab8b7d34163a2829b6930", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761870, "uuid": "b10d8f59-9817-4711-abde-fd715772f095", "comment": "Malware payload (AgentTesla)", "value": "3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761870, "uuid": "84a0e420-9c63-4282-8ad2-d31cae63e550", "comment": "Malware payload (AgentTesla)", "value": "fa15b01076e5d395638102b0b77624092cf20c4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761870, "uuid": "7dadf558-e00d-4c09-869c-9892a0b34aaa", "comment": "Malware payload (AgentTesla)", "value": "bc20ba6820c07b20704131d9fe33f067f3cb0d6db7dd26df79db73d99c0fe75c8dd6faf6cfd563ccfea5aebb4a710225", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761870, "uuid": "009fe69f-a9a0-4b57-b507-18dc9ee7c058", "value": "T161E48B5633B57621F47D73FD00196388CB38B44A2122E22A1F963AD546E37EB770A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761870, "uuid": "b0ae37f5-2681-4c1f-990d-81bfac619042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761870, "uuid": "0ec92728-faad-4fd6-8816-53e8439834f4", "value": "12288:IvV+s1bSQT6tjjdB4UmuubNQxq1W14QPCxV9wcoSXT5M/tF46:ItWnubmxqs1axVGchDit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684761870, "uuid": "fa946cf3-b391-4b76-85bd-8650cd57b424", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684761870, "uuid": "f5ddf74e-aa1f-4fbd-87d4-692084754a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761870, "uuid": "7bcfbf1e-d5b7-45c8-a589-dd8f793a2d05", "value": "PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a576360b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752276, "uuid": "d5e23771-143f-4f68-a23e-019d87405730", "comment": "Malware payload (RedLineStealer)", "value": "148487dcd7fc125bcbc216a7d60ff952", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752276, "uuid": "72420e6e-8bc9-4ca5-83aa-f4e5f4cb6a9d", "comment": "Malware payload (RedLineStealer)", "value": "3cadc437be7307a442c8a76fdf6d4fab05e3d7bca4c2becb868dc6988e9faa15", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752276, "uuid": "f4c99fb7-5210-4659-b516-467fb621b697", "comment": "Malware payload (RedLineStealer)", "value": "cc57226a091732550107cf6437cedbedebb39a33", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752276, "uuid": "093267b9-5918-44a8-8aed-2cfbb73015ee", "comment": "Malware payload (RedLineStealer)", "value": "9fa8e5321eff7da49c89be7cecdda96714d414fb49b020568ffba8246afba556dd1d1ee59f84afc7347c6983fdd79f04", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752276, "uuid": "6ffc8da6-03b8-4def-b4a8-c5941214e367", "value": "T144252223BBEE5472E9B6037455F60A831B35BC608C68D26B7A853E1F08726C4BD35367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752276, "uuid": "79ba3861-19f7-4238-baac-a68499589d03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752276, "uuid": "e27d4bd5-5725-42c4-8b3f-28a02ab7ae15", "value": "12288:lMr0y90FngdYE9DpjawyFnBlpFhhE9NdiUGwoCi5kLAL/RqpYFL0X60LYgBmY4p1:RyssYGGtnBl0EwoCijR30X60MXzbMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752276, "uuid": "dfe9d4bf-49f4-40ab-8bd1-b1632f793132", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752276, "uuid": "74370b2e-db93-4c49-a8c5-89a0f2261035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752276, "uuid": "617ae36e-ac89-4de8-b3c0-84cdf4a492f9", "value": "66234358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad41f74-f887-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1684749467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749467, "uuid": "b470f4b1-51bd-422e-a95e-73994452360a", "comment": "Malware payload (StrelaStealer)", "value": "8003033a6c4683393ef8e6580490baab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749467, "uuid": "f4b22989-9d27-49d2-971b-2e6030b70c2d", "comment": "Malware payload (StrelaStealer)", "value": "3cf88f6d743fd63b57e3abea5445faa9a55d65df32811ef5d4b8c2b3c3abc936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749467, "uuid": "c535404c-0e0e-4896-94c9-e85d98dfc38c", "comment": "Malware payload (StrelaStealer)", "value": "afc1006e8dc3d29b0a4973be32330457b0b5c3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749467, "uuid": "3fc4ce13-47e0-4c9d-a257-252c9efa4d13", "comment": "Malware payload (StrelaStealer)", "value": "e4ac7e88da95779ac110f2048dd644f614c019f3b73ddfeff0c05bfef2cc336dd28c4b8ae39d132086ef612285da08ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749467, "uuid": "5ce52ab4-a1f4-4187-afff-08ce5557fbef", "value": "T114E3382414F65B2DE53B423C7D66B3E699623C9C87A4CB6B880681E33612D1ECCFD935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749467, "uuid": "7ea40925-ecad-41c8-a78f-ebbdb15e9df4", "value": "675f7fb22861ff7eb3f7961dd1eeb588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749467, "uuid": "a87bcf7b-3ca5-41b5-a796-cdf783201db0", "value": "3072:lG2NareWlV5hQX+JqTWdSVmlkoCjw6wLbf:lDar/lV5hgEqTW45oCjvwLbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684749467, "uuid": "39484d34-1a76-40dc-a0c4-58ba7a69d9d0", "value": 148360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684749467, "uuid": "1b6dcadd-eba9-49ca-993a-1f51e39e6aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749467, "uuid": "18c39959-dfda-4f67-970c-ffff82b83133", "value": "FATTURA_ (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec54cc93-f8f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684797922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684797922, "uuid": "a5a21291-67b8-4b83-a487-063ced378a36", "comment": "Malware payload (NanoCore)", "value": "162ee29f9cf6793aba8e5a2dbef387b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684797922, "uuid": "a67120c5-6550-404d-bc62-4226fdeee2d7", "comment": "Malware payload (NanoCore)", "value": "3d9fb612ea735e50958449d73197f43fe730a015caf8b8ec99180a3deecf2826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684797922, "uuid": "83861c1d-7136-488a-bf7e-5f7117418b59", "comment": "Malware payload (NanoCore)", "value": "e8528f7feba63a6e122ef843fcef7ff07d9e5fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684797922, "uuid": "d75b4ca6-e7b9-4c2c-8b0f-3c2875140f80", "comment": "Malware payload (NanoCore)", "value": "ae3019f7d2b19d0d046f52f7e22737ee96d95f58a6e2040b59e4d15c17bdafb5d2bc3945ae65d6f283a38eea090deec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684797922, "uuid": "2cc18c36-e490-40c0-a9e2-b9fe2ada9b3d", "value": "T152251241FAC1C9B2C17218768D25AF60693E7C311F659FDFA390666CAE312C0D13A7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684797922, "uuid": "9e690a23-ebe5-4945-95da-2f51976e083d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684797922, "uuid": "2047a853-b0b9-41eb-bb17-9d167f6f50a3", "value": "24576:TTbBv5rUDAbVkNF/dnZ5Tm0mui7nNYYGa6m7WqLa2IiiZxWCF:NBDe3RieRMWiijt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684797922, "uuid": "b1ae73cd-6623-40e0-a544-88b211a664ed", "value": 1046098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684797922, "uuid": "442ece60-6f07-43a9-8876-dba021d7a007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684797922, "uuid": "98613aa2-52d5-43b8-b784-b050c397734d", "value": "162ee29f9cf6793aba8e5a2dbef387b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f971ca82-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737385, "uuid": "f7fb578a-4d20-452c-961e-aeedfae495ab", "comment": "Malware payload (RedLineStealer)", "value": "491d78d3cba1e6c8a4e7131a3aeabdb8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737385, "uuid": "94e73857-d567-4081-9e5e-bc770257cc92", "comment": "Malware payload (RedLineStealer)", "value": "3dd428c88cd7a71e76d5e518d6765df22bfc908421dd9e867a49033e50b43ba5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737385, "uuid": "197d99fc-6a9f-49e9-bee6-56c4041bdf4d", "comment": "Malware payload (RedLineStealer)", "value": "afcc4b0b77d30f7dc74b210e90b78ea42158586e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737385, "uuid": "cf3bf653-047e-45db-a1d2-7bdd76beac97", "comment": "Malware payload (RedLineStealer)", "value": "d9c4f4637f1dd70b428c6b54eead7a7b575bda057474a3f6642c632a13e11c0eb653dff9be24b3c6d323c103f962af4f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737385, "uuid": "c139ce8a-1dcf-471d-9ad2-e736aa767640", "value": "T14A252305B7D40072D8BB2BB2A4FB06830B32BD915638D31F77859D6A1C726C56876B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737385, "uuid": "f665f457-839f-4eb9-b7e2-03056d366767", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737385, "uuid": "1a910d04-0258-4b05-b545-cde0e94e0580", "value": "24576:9y/GsKGdVq10iqyRI5g1EQycLXwaXQ4M/97yeyev11vh4q:Y/+GrqGiqy+5yEgLAaXQ4M3DHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737385, "uuid": "af03db15-2eb3-4a4f-a254-cadf6bc1c5c9", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737385, "uuid": "c447445a-cb18-42e3-a7d0-93cf7dec80bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737385, "uuid": "826a7891-34b2-4c65-bd7b-c95e4a78e688", "value": "backup580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb89aab8-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745978, "uuid": "9b95bd80-c7a6-493e-bac8-ef98d98d9571", "comment": "Malware payload (RedLineStealer)", "value": "8815fedcc65e0e05ef5e3a45080e7931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745978, "uuid": "40dbadd2-28a7-497e-b50a-951814612063", "comment": "Malware payload (RedLineStealer)", "value": "3e3d5644d0286b351cd5ee002094102017a15e379fde08bac84aed1b984b4de0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745978, "uuid": "55af5526-7a63-410d-893c-bc54452e65b3", "comment": "Malware payload (RedLineStealer)", "value": "ba86205c5cbca660af5e5a8f62b823ffe91d584b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745978, "uuid": "451f491f-c158-4149-a4b9-01bc3a5439a9", "comment": "Malware payload (RedLineStealer)", "value": "b03a8b6f8898c43bf403c2cc0a4f335da891da9de0dac16fa2ef723a9877173445e0b7010a659f97516db325d39994fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745978, "uuid": "b612a4a2-c221-4c19-a418-a2ee1f97029e", "value": "T12625231666C88073DCBA67B1BCF24743133AFCA28D74D2273A51B99E5DB2654C232762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745978, "uuid": "2e3942bb-ddbf-4a88-bb77-61a8031abb26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745978, "uuid": "959a4edc-5afe-4af5-acb3-d59b9d9fdbc0", "value": "12288:iMrdy908Jg/eGqTlzrq8mWUbRqqUHqbG/3AZEOIFNnXfZZL6ehmZut9uzxzZvB:3yZg/eGqx3UNqi/sFhXxZLMy9eRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745978, "uuid": "a20fdaeb-f58b-45bd-bd7d-d0a94b72b5d7", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745978, "uuid": "cfbd9f56-681d-4ccb-894b-55f91c7c16a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745978, "uuid": "a879a6f1-7bc4-40cb-b63a-19a47ca8b657", "value": "8815fedcc65e0e05ef5e3a45080e7931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26f34a8-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1684738635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738635, "uuid": "d0e42605-a6be-4d5f-a51d-40533a0a5b4a", "comment": "Malware payload (Spambot.Kelihos)", "value": "22bb23c0d1264897406f0ae8e4128663", "object_relation": "md5", "Tag": [ { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738635, "uuid": "92d3dc7f-1b2c-41cd-8488-fb0afa4a0dde", "comment": "Malware payload (Spambot.Kelihos)", "value": "3e8aeb0b3c821511146fde513e509ffbde29cde19f29f3fd5192d0c9e7f57eb9", "object_relation": "sha256", "Tag": [ { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738635, "uuid": "54c22836-1781-4392-9e72-4b46666f46b5", "comment": "Malware payload (Spambot.Kelihos)", "value": "0aee5a0bd208f25437624f3e25674fed291020dd", "object_relation": "sha1", "Tag": [ { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738635, "uuid": "b652bf99-5b49-4831-ab82-ad811e742165", "comment": "Malware payload (Spambot.Kelihos)", "value": "470f982f549689dffc5d276661ee806464b51c18615eaa6a6d7159fb6b4fb6e16b4db5d7aa0fdc320354222bdffffb07", "object_relation": "sha3-384", "Tag": [ { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738635, "uuid": "a3384250-8665-4290-838a-98e8f7291b6b", "value": "T11C2522A3B3D840B1C9381734A4F306870B36BDA25D78826B7795AD5B5C721D48A37B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738635, "uuid": "397439bd-c024-4470-95d8-647d7a3a6b96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738635, "uuid": "ca85380d-b4a2-4d5d-b488-1b0735061c76", "value": "24576:hyeT20Pj+Td6J5N6N8Y1qgq8a/pOtrkS8GqaUac34RQ:UeNPj+EJ5N6Nt1qr8aYtrksjcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738635, "uuid": "75258c3d-5395-4264-a4f8-9d1ba1012fc7", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738635, "uuid": "2734ea70-e2a1-46a1-b274-713a985c656b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738635, "uuid": "22e8f9ec-0c6d-419a-8ec5-d9208c9371ac", "value": "3e8aeb0b3c821511146fde513e509ffbde29cde19f29f3fd5192d0c9e7f57eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5671e3-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762601, "uuid": "dea975fa-0b3f-4bfb-8260-09777c0932d7", "comment": "Malware payload (SnakeKeylogger)", "value": "d72c1ac32d2592d677d9001caeedce3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762601, "uuid": "9023326f-aae0-4786-aeb1-5b3aa72b7bf1", "comment": "Malware payload (SnakeKeylogger)", "value": "3eb22db295cea1562fb2f1a04c23a702cb254ce8b1ba1f54f1ebe8e6d1f3fe49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762601, "uuid": "5896a8db-e42d-4f6f-9d91-042c74e23deb", "comment": "Malware payload (SnakeKeylogger)", "value": "e998014b6c233b584427736fb22a1ff8f634c7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762601, "uuid": "7041adb6-4966-4f26-88aa-bd8a2cffeab6", "comment": "Malware payload (SnakeKeylogger)", "value": "468be93cc4405d4c7508943ae74a53f327bad75f56bae98cd0e9b1c5bfd5d9a197f6d371761e41387682f15f14db1e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762601, "uuid": "713e919e-8f9e-4b45-a1a8-b10d8bbd1733", "value": "T1E7E47B5233B57621F87D73BE0119638CCB38B44A2062E12A1F5639D556E37EB770A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762601, "uuid": "737ed9e5-6a6d-4635-8280-f28a550ae295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762601, "uuid": "c9ab6880-4719-4197-8d5f-bfaf60c8ae45", "value": "12288:GvV+s1bSQT6tjjdB4C1duRNSIicDqaUI1pUmckroHLVx91oXcRgBkmss0//YQ2wG:Gt0DuRMIhqaVpUmDk791oSgBkBsEQwgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762601, "uuid": "9e8ae1bc-625e-4b15-8b55-c6c1997b84e2", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762601, "uuid": "6580a1ff-6f6f-4d1c-85a6-7767e460449f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762601, "uuid": "9c21733c-7a67-4589-bbce-d22b71a3e687", "value": "coreTEX_report_bgm.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1dd38b-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763642, "uuid": "08a2893e-20c8-47a3-8594-8924fb7a56ab", "comment": "Malware payload (Mirai)", "value": "39abf3289ae7c6ef257e77e02ab6ecdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763642, "uuid": "cc2552c7-88c8-4114-b81c-13445dce1fbd", "comment": "Malware payload (Mirai)", "value": "3ef2252ddc47312b556b72fe80f3e209a3e0296d68a1242a6ccc8179d46fcc53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763642, "uuid": "d4ea3e38-dc8b-4f67-87f1-07639d240436", "comment": "Malware payload (Mirai)", "value": "91c1f5fd47359f41b252d4c6a024ee79121ddd82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763642, "uuid": "219e7448-9240-4ca4-a973-4b3dcb36ae25", "comment": "Malware payload (Mirai)", "value": "f31329fcfd34221d8428a0a5c0be5e494c96d5fcf1b29b6a1cced1c7a347642e61cd7a3ae1917652c4ce3270c07df27b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763642, "uuid": "eba94044-bc23-46e2-b69d-446bc6709eff", "value": "T1DE23F135234327389D91A4B5C9981EC67521AFB9C2FA3133C2B604246CE655E9F633BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763642, "uuid": "328badba-8e90-40ea-bf7b-e0b0d9d4466d", "value": "768:nWc54G6l66EXxEOBL9tUkIc9SK0b7CfqtiUcWis9q3UELOXpLDWsyoOQnLgtXVk5:nDv0qZBKW0blMUcvLUp3WN9kMNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763642, "uuid": "15aecd08-3a38-464b-8de3-8a7933ed2218", "value": 49904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763642, "uuid": "cb7f1849-4772-438a-99f7-ceb4140fe381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763642, "uuid": "82571c16-895a-4baa-9c15-9785055dafe6", "value": "39abf3289ae7c6ef257e77e02ab6ecdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc06eb2-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752287, "uuid": "3a32762b-1b12-413c-8810-5ee7a8016089", "comment": "Malware payload (RedLineStealer)", "value": "6b0ce18eb58b0b31f5d4bed016956004", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752287, "uuid": "de3d3e31-1535-4e1d-a6b5-546b6bd423d1", "comment": "Malware payload (RedLineStealer)", "value": "3faa7243b22180e01f94378aa00f6588de32791438919c9f2b6f236851f424cb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752287, "uuid": "230841e2-5406-4335-b0bc-6b2c64c7e3ae", "comment": "Malware payload (RedLineStealer)", "value": "4a96d81d6b1c5edc7ac97bfe328b8432c4cee43d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752287, "uuid": "86887659-0058-4846-8eeb-2c8805c7fbf5", "comment": "Malware payload (RedLineStealer)", "value": "cf4926b932350da553bc0a3b988072fd03d80484fcfd7a6306ef73da5cadad1608980decb53f3cf9046437dcfaa2f340", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752287, "uuid": "4977ae48-921a-4ab6-a21e-c24e3472b26a", "value": "T185252321A3DD543BCABA1BB08CF741C31B32BDB5957893B62B55980D59F1389A1B033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752287, "uuid": "3bba5f03-de1a-4a6a-9768-58af7a5ec66c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752287, "uuid": "0373f8d8-e7a1-4141-852a-84753efa0e29", "value": "24576:1y7WlP4EnJ7qpjxXo85eAY0qbMq57PgjSzchMaTqSXHZJX:Q7WPLnJ7ayJX7YjThMaT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752287, "uuid": "ab643f25-0ea1-4c4d-ad26-f56a67fa061e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752287, "uuid": "9479bd00-4275-4b66-b21b-f7b0f6002c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752287, "uuid": "270c5b1c-e2a9-40d6-8099-fdc7e5ed8b50", "value": "99242418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fac2713-f8a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763353, "uuid": "b065fe8b-1df8-40a5-a04c-8e8123e75ac4", "comment": "Malware payload (Mirai)", "value": "dd29ba5bc471a4c9901bdca602e70866", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763353, "uuid": "4109ad31-5ede-4962-9982-2149f80b0f34", "comment": "Malware payload (Mirai)", "value": "3fc5567df8cb6cc26567824d4cd4ce53069c62ed6ea2cd0da2033ac9d5c8cd56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763353, "uuid": "870b927c-fbcf-402e-b2a5-e52d9b9fd760", "comment": "Malware payload (Mirai)", "value": "e2b526b79d0455b65baa82241964815488bdebb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763353, "uuid": "475a6b8c-39e7-49ce-a87c-437ade8af001", "comment": "Malware payload (Mirai)", "value": "67d2815f83525b58233d31c3e6bb9d02a9b95b95655a126cb00959394d24ab2aa99b764680b0724103edc9aa04a38b79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763353, "uuid": "89018208-5880-40b9-868b-5ebc8aa95350", "value": "T163D2D16DAED8B905C64CD87F25CD26B21F99B1C0738B83A6E325498AF634086704D6F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763353, "uuid": "05426b0b-8999-4b7b-922b-78fab25900a8", "value": "768:CspZYWN5in0bCuRF1P1H7fgXeABIi8kQfusaAltJWg:bp3zY0bJz1Ppf2ouRA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763353, "uuid": "e46e62eb-e5b1-41ac-be2b-cd7d738cc8e1", "value": 29920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763353, "uuid": "3da5f9e3-cf09-4ff2-b387-08ab236fb945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763353, "uuid": "0a6ce770-d6f4-4c1a-87b7-0183136ef274", "value": "dd29ba5bc471a4c9901bdca602e70866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc23cfe-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737362, "uuid": "51924e08-5673-4cda-b30d-26e5ca98814b", "comment": "Malware payload (Amadey)", "value": "65eeebc3aec53db5484a2096fb187fbf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737362, "uuid": "5fcc9188-cd62-4adf-880e-01b514b6bd74", "comment": "Malware payload (Amadey)", "value": "3fe867c6bed64d1a56c10f658cde21b9597ec26f5f57cbcc2982eb05e2520819", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737362, "uuid": "aedb9aa7-53e0-47db-aec5-50008c39ad42", "comment": "Malware payload (Amadey)", "value": "2ed5be6f0f58d53d28e2576137a31f413d24cb2e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737362, "uuid": "51df304b-efe0-4e04-ac67-2be9277d5d88", "comment": "Malware payload (Amadey)", "value": "e43727cd188d8d391e9ef9a981dbd75dac58d2a6e4c858cb8104741ba78378a7a00ba842a23eb6d1e18e12b4b8584fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737362, "uuid": "503b9fcf-e1d9-4db7-a3fb-94717cf8880f", "value": "T173252313FAD89472D97023359AF10BC716327EA498B8C33B1B45A94E9C727A0E934777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737362, "uuid": "0fd5eecc-adaf-41f7-ae70-6947d8d8007b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737362, "uuid": "d976af1f-a61e-461a-8ac2-ab67f64aabc9", "value": "24576:+y5M1VnIn6mvGRq+5nIxbZd+5t+VMRkRnTxP9:NWlI3GRq40bb0kIkRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737362, "uuid": "b02106f6-4123-4fd2-aa5f-c4881489d1d4", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737362, "uuid": "14da190f-87cb-4b77-ac49-d4ed7639b7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737362, "uuid": "77c1a8f2-512f-4d4b-bfce-06501223d3b4", "value": "Unlock932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7528cf3a-f861-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684733297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733297, "uuid": "f1fb4bd4-3856-4cbd-9dbb-48a6f9a30e49", "comment": "Malware payload", "value": "02f8825497620b774630172491901f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733297, "uuid": "bb8f13cf-5cb0-41d9-bd14-16a1607ebe4c", "comment": "Malware payload", "value": "4072e104aa514654433c1140233ad52b1a155ef817c73a11897fa48b5f5ec86a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733297, "uuid": "27035450-f206-439c-9170-fb2558303e86", "comment": "Malware payload", "value": "605aa13c40cae88062be031ca33f19596ec5a839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733297, "uuid": "b21d4fc0-e844-4952-ada5-722a0f13a11e", "comment": "Malware payload", "value": "e1a18b32c2d8da29a777c0fcf9818d1aa901f7a7b35462dc23e5eab42ec865b0141834ae2195422fce3f58cf4a5f9e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733297, "uuid": "e61e2a3f-ab59-4a21-8339-d24263ef1743", "value": "T1339423940982DB96D06F123E78E82608C7F3A2B95C77C695D98E5DF950D2303BF2D272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733297, "uuid": "25f51d43-dd86-40cd-9f8c-579d64cbc2fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733297, "uuid": "d4498a65-2769-4e63-a3e4-2dc75397f83b", "value": "12288:/ZKcVAcxqp0WUc5JGHRh24TXEl2mL8IhQSAIHzzWP:RKcNlqImzzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684733297, "uuid": "0176d9e3-bdf8-447f-8833-3c6897ef90f0", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684733297, "uuid": "893a2f57-1770-4e2e-af00-ec39f6f863d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733297, "uuid": "32114ec4-6c4f-4733-bc23-66db5e5a5a52", "value": "pe1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b135dc02-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752296, "uuid": "f92293a8-b774-4f53-9271-2dda08181a5e", "comment": "Malware payload (RedLineStealer)", "value": "96882d1330ba0670564e96fe843f1bc3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752296, "uuid": "98ae0fde-0168-4ba7-bcb7-1547fcb0efd5", "comment": "Malware payload (RedLineStealer)", "value": "40b56200396ff3ccd8b42dbe6a6eff66dbc115c0cee35632e9df4bb819866aca", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752296, "uuid": "9c5b359e-8d27-446f-8e36-ccce782da692", "comment": "Malware payload (RedLineStealer)", "value": "225ffbfa09a3f5d66ad29b73d4e3265bb8c978e6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752296, "uuid": "390d6562-9542-4a1c-9156-9221817d51b2", "comment": "Malware payload (RedLineStealer)", "value": "d976fc6fd8f6539c28e786e011ac3041d216e6b1ddc34e115498637d1340f874e2bbdd0338ac13a561ef512eea7a57bb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752296, "uuid": "ecb2c2e8-6266-41de-ba59-6f597bb99fb9", "value": "T13D252301FBE85533E8781B7048F307630B357DE14CAC832727A69E2E6DA2D94697176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752296, "uuid": "5e82b7b6-bdfb-496c-a8be-c13c9836fb3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752296, "uuid": "6a9b6762-25a3-403e-a213-2b152c0dafc3", "value": "24576:by955lhCNKqDyppYBib2ew5GpZLZXizpEzHxQzUitSb:O9zCKqDxgzZ1XCpEzRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752296, "uuid": "abe0b0ae-57dc-45f2-8bd6-45ba8148ebc1", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752296, "uuid": "8122f492-94b4-458c-8327-23e380a6e4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752296, "uuid": "953d3751-ea07-4d0f-bb3e-608ea0ef87ed", "value": "DHL117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cad657c-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752503, "uuid": "40c7519b-2ce9-400f-9b9e-c6fbd38bfc0d", "comment": "Malware payload (RedLineStealer)", "value": "ead3b603610bbe968328b89442cd55ad", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752503, "uuid": "91201497-747a-4dbc-a8bb-9eacee644cc5", "comment": "Malware payload (RedLineStealer)", "value": "410f9040068936f3a03a67c08990ff27c35813eb969e85f1f7ed8b21efe299c5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752503, "uuid": "ec5da17d-5439-486d-b046-1fc0f9179a55", "comment": "Malware payload (RedLineStealer)", "value": "74c9c82b1ce4c0261da1cc2c38a1333a26188f27", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752503, "uuid": "714a4ff3-c5b9-4031-8875-ea725f4eb800", "comment": "Malware payload (RedLineStealer)", "value": "4d928db205238f2f3ad53f0300bd757709f8613c7b234f2afafe725affa7a302d6295b047b8ad160016aa5e51ec16323", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752503, "uuid": "a919302c-3a59-4ccc-bb9c-3c8c70e3e52b", "value": "T12C252302A6D844A3D9F417705DFA03870731BDA26C74D66B0B5CA69A0C326C1BDF97BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752503, "uuid": "99ec2db2-d4d3-40ec-8be1-4955cfd1a672", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752503, "uuid": "e387cac7-dd56-4e91-ba82-35f535737b3a", "value": "24576:ZyIQuS9+KnJ6MoFDCXF+xpsZGeL+lZna5h1iO09jhpkDTvyB:MXiCXsTG+u5XS9lCDTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752503, "uuid": "9810e644-5204-4e88-86eb-0dd53c2a4337", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752503, "uuid": "968ee7c0-440a-4234-ba7c-8cda4762e4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752503, "uuid": "1c4bc251-4683-44e7-a79a-d56243afd743", "value": "noname927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8e0d3c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752342, "uuid": "cd1c55d3-52e3-4f96-8195-db888dabf620", "comment": "Malware payload (RedLineStealer)", "value": "fd17de4cb740eef2923dc82576b769ef", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752342, "uuid": "95483587-8c10-48d2-9f9c-fd059fd41949", "comment": "Malware payload (RedLineStealer)", "value": "419f0b81577e10c46c4305e4c011109022e2f417340af0eea229674f203a6886", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752342, "uuid": "cc2ddd6e-287a-4ffc-924b-3a5bd3027969", "comment": "Malware payload (RedLineStealer)", "value": "0d796f75794a59fd655847b2747071e41877e407", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752342, "uuid": "ccddf146-9f6a-45a3-9628-5dbc77f6f434", "comment": "Malware payload (RedLineStealer)", "value": "57912e1a4d4a1c8c5385294d87348a7f0433e5d6001f2301b3daf7a77043a11395d1ebb83bcd8a201241c9bef31e5d2a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752342, "uuid": "7b4dd310-8c9d-4f67-add3-a08867583046", "value": "T1282523161BE455A3E9B40BB49CF50BD71B367D524E34C36A3780991B1C736CAA830BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752342, "uuid": "4cca659a-9f04-44e5-8336-974d4fc97c80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752342, "uuid": "170203ea-734b-44a3-a86f-88ba01ec78d2", "value": "24576:Sy4HlzU40vWZzx4Nys05usGsmwHd/Q0Lpd:5cloiJxBoAmQ/PLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752342, "uuid": "268420c7-70df-4f93-bfe5-05cdd498be41", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752342, "uuid": "fc54e2e1-319a-46a8-b248-e34d6423b187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752342, "uuid": "44241d17-9a44-4e22-b3e1-7e2578c2d33a", "value": "bils703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af72d78e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752293, "uuid": "8dac7e61-c4a6-4f46-b519-bb24d46ee126", "comment": "Malware payload (RedLineStealer)", "value": "8cc8786cb4c6e1fbc4f74d30f40e2e57", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752293, "uuid": "bd560a49-b391-4960-a8d9-5183a9291ea9", "comment": "Malware payload (RedLineStealer)", "value": "41bd4c6c86a0146d3a256e981f4ed6d63f11b25aa836c86c35a5f3c220da40a1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752293, "uuid": "863e3ed9-cde6-4dd4-81ac-ce1c9e7474c8", "comment": "Malware payload (RedLineStealer)", "value": "cdf57ee26489668c6df4321668c1f1952641b2e6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752293, "uuid": "729dd1a1-3db1-49a7-ba34-d9095620f6e5", "comment": "Malware payload (RedLineStealer)", "value": "754db1cd8e9361c7b6e822a3e5f5583ce9bb389d8c9e6777e4e9b696b1d290c00f10b3e7f7f255890bc50d292f638f22", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752293, "uuid": "e80beb73-03d0-4388-94a6-f4ecc3a7f0f1", "value": "T1ED252322E7E41032DCB1273159F706471B36BDA15EB8832B3B4AAD664D31BC14A71B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752293, "uuid": "69c05933-adb3-4f0b-939a-3b276615fabb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752293, "uuid": "1d3a9fa5-20b9-483c-a043-1bfbd45f652e", "value": "24576:yyiu5f+XASzCK4vccq8vZofBs8x67mZinhRxQQGXQuZa7Bo:ZiPv2KSqGupsU5inhRQguZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752293, "uuid": "8124e8a9-1ac1-4228-bfca-ef711f569dce", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752293, "uuid": "8eb0bf39-2918-49fe-9f56-fc8c9a27fcdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752293, "uuid": "0e274e18-d638-457b-ac85-9701d65ca597", "value": "CloudCheatsSetup318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0ab512-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777227, "uuid": "2fb15ae9-638b-4dea-bc38-27cabae00966", "comment": "Malware payload", "value": "2f315546c3f04852f1a7e013bf55bd20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777227, "uuid": "e2018b00-d377-44dd-a271-4db56ca60a6a", "comment": "Malware payload", "value": "42fdb2431a8b0a776d18447cd1e75bd0683a1848fe5986c7c92bcd1dcc13bedd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777227, "uuid": "9f8b94aa-c713-4b05-8664-fc237ea91d39", "comment": "Malware payload", "value": "fc079816e77c52aa32fc533a9b3f370bddbb1fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777227, "uuid": "d779abd1-5d33-468c-a933-35ef9dd439a8", "comment": "Malware payload", "value": "a75c0ed0d25960edfbf5ee869319b6ad75c40a6e22749885118ca23a7123bd2abf566d0cb955e22d6ae1d4e42f4cbbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777227, "uuid": "95f5b68c-d47e-4932-9d6c-31b59672b534", "value": "T15992A41622C408B0D3008F7258621149AFFABE3093B72A51AB5381C9347E5D0CD7671E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777227, "uuid": "b3ced399-72ef-4670-b6a7-c626cc6c40f9", "value": "48:gxK273uRZzjwyiH95AiFQyu6kvy3VthYk4WfYnZBpBC3:YfSVVfiNtk0DhYk4WAZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777227, "uuid": "a4ee5067-a146-480a-945e-5a0827026313", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777227, "uuid": "449bf1a8-e0be-4b4b-875c-a74ae01cd571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777227, "uuid": "f73fca61-c809-4435-86c1-103ff012e3f8", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.18261.2480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0d1d4e-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684747830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747830, "uuid": "447ce69a-216a-4aed-807b-f3d9bd8b6636", "comment": "Malware payload (Stop)", "value": "6a2eebca0cea801a37a418c8d866415c", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747830, "uuid": "aeacf093-d7a8-4ac8-8ccb-19196a89526b", "comment": "Malware payload (Stop)", "value": "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747830, "uuid": "278fb591-48ca-4021-90cc-6ad9fd30626a", "comment": "Malware payload (Stop)", "value": "6b876cb3be149b6823ec065cc42be4609aaab37a", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747830, "uuid": "5eca6df4-a65d-415f-99eb-9ec1abb87e0b", "comment": "Malware payload (Stop)", "value": "fe60335f979abdc84b8087d8620d086519160290d9375f0cf91a5b2503ee4cffc4ad25df53d74d20112bd2ec2eb4b3e9", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747830, "uuid": "8ffdf905-596f-4795-8be0-77945ffa3331", "value": "T162F412203BD1C032E257D5359AB1C6A71F3BBCB217B999CB27D0063E1E746D2AA78345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747830, "uuid": "ef80a55b-b664-48fd-b728-b3fe6159fd0d", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747830, "uuid": "63b61625-36a1-45fd-a55d-104a449422cd", "value": "12288:FRBU4JD1smQ5K4dHit+qheZJpQa2bFGaNQFB0dg5xhaIIx5Fxe+:KC1MK4dC4NZJpQaoJQFBSgrQTFxe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747830, "uuid": "f91c64a5-85ca-4238-853f-0cb62b69099a", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747830, "uuid": "e254378a-e36d-4731-ac81-2658ac143191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747830, "uuid": "3c855c0e-0894-42eb-b233-710a8ee50505", "value": "7463534709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8759fee-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752335, "uuid": "40dffdd0-e59e-4060-ad23-f0726ca22363", "comment": "Malware payload (Amadey)", "value": "0dc71d289fadf2146e7dc91026cafaae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752335, "uuid": "b0af866f-045d-4efa-9eed-cfc43cc5bb15", "comment": "Malware payload (Amadey)", "value": "436d0733dbb007163a171b5e20e9dad7505c00fabf7973efd4e6ae3fc912b772", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752335, "uuid": "42c49c28-fbe3-46f3-840e-dc4d7350d949", "comment": "Malware payload (Amadey)", "value": "f82d3408ca5cb3f2f901d6aec946322e4577df2f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752335, "uuid": "9f2a562b-a603-4d17-be9d-c041c0a2e657", "comment": "Malware payload (Amadey)", "value": "0c07f09104eca18b377b90b3bee079768c6d11d70aea85cf1e994232fb835f9f15be92c871f76148c40cd8c12450ec45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752335, "uuid": "97a7c8de-c982-4f05-9e89-1d4dc73e5987", "value": "T13B252317F6E881A2C9BA2FB124F503C70B367E91693453AB5306751E0C738D8A4B677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752335, "uuid": "f61914e5-c01c-49ca-aaab-0e3f2b64049c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752335, "uuid": "8e93dc9e-894d-48fb-bd72-c0be64a9072b", "value": "24576:R1yY+Pm/uyY0oS7SAH9++wXBJd5rgK5gvzNA6tFo:RQY+PUuyYM7SX+md9+Pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752335, "uuid": "5c357052-b79d-4b16-a136-9247789439b5", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752335, "uuid": "0c2083ac-fd25-49b0-90b1-6ed631903a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752335, "uuid": "631ee0ba-a22d-44d7-838e-a78bf2aba973", "value": "audio554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90b1b3a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752417, "uuid": "7f633594-49e1-41cc-937c-f21e2a560f38", "comment": "Malware payload (RedLineStealer)", "value": "ce69662000eca813ff07d53dc065706c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752417, "uuid": "b2dead43-16c1-4e07-83c1-34982a686267", "comment": "Malware payload (RedLineStealer)", "value": "43f0bae96ca7e25e4810ef59e650d57267bb91b486b817cb64012f636f13b49b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752417, "uuid": "17b16aaa-327a-4c65-b065-ae8171426c52", "comment": "Malware payload (RedLineStealer)", "value": "60e6a815aa184f91d808af536108deaf6571f6cb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752417, "uuid": "80c75e34-6d35-4d00-a660-c067b0a0b821", "comment": "Malware payload (RedLineStealer)", "value": "50f4f91eb0bcac552726e22ee6a69d1e854f90637f74575e3e87ff3f6d7c097183fcc197e90854fedbaba3e5e8c0bd36", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752417, "uuid": "26615e8b-0864-4dd8-8a77-822669a6d5ae", "value": "T101252303F7DC9521D9B4173058FB569727357C729D35961B2B82AA6B0CB3B848831B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752417, "uuid": "f098ce72-50b9-4b27-970a-80d8f0eb1de0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752417, "uuid": "d4671697-5cb7-4299-ae68-adf06fe1e7cb", "value": "24576:yyMMMxGn7q2ZLqf4Az+B9C2j8LZalxQmmeFEfILJ:Z3Mx47RpqP24MlxQm/FEfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752417, "uuid": "1db132d6-4a7d-4fa6-80bf-4aa245c8f34c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752417, "uuid": "817ede54-a497-44d8-9f03-fc4a5521e853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752417, "uuid": "99a21b83-f5c6-4ff6-b040-ad0b739c346b", "value": "engine734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182c5544-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763636, "uuid": "c0a47cab-1e6b-42fb-a0e6-8dae4b27da4a", "comment": "Malware payload (Mirai)", "value": "d168d36e79285e3d6d7738688a1b8e90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763636, "uuid": "f2621d17-895a-4fe7-a697-2dd3c510dda1", "comment": "Malware payload (Mirai)", "value": "44a5af4f4f3a263291716569db00f3e7e92bb8759d9fc7e967a4ead3495065b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763636, "uuid": "21a98a4e-98e0-4e19-a485-b151c2e04960", "comment": "Malware payload (Mirai)", "value": "75f2db9b456d1821fc4c114162a1c4b64732ec7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763636, "uuid": "1c009ba5-16dc-4b8b-b380-a636a0546c08", "comment": "Malware payload (Mirai)", "value": "b3caad1222cd1d1ab09b704c2e3df9c09941abdbc539e37b8fcc0d09dbc1c6a6b5d1c677c2fdd367e8ba8172c11f826e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763636, "uuid": "e5f86b56-c18a-45c4-91a8-0ea0899fe350", "value": "T1C4732BC7F410EABEF41CD73B4C6309157271F2A04E830E366BA7BB5AE92A158155AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763636, "uuid": "c0fa1937-42b0-432b-b2cf-b130e5fc0791", "value": "1536:0qxdditMu8IqifVQekacWVcW0JcWcB5/qdxvgL2LyKLKGwPhFf9Yj:0YdcTqaVQekacWVcW0JcWcBRqdxnWyRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763636, "uuid": "e1f44c56-ce82-43f1-a36c-575a0838b19a", "value": 75468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763636, "uuid": "132bafa3-33da-46eb-bdc1-1299e345d338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763636, "uuid": "5c08fa01-ec46-4332-a046-9aa0614ca3e5", "value": "d168d36e79285e3d6d7738688a1b8e90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1e2040-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737339, "uuid": "fa5935f3-58f8-4360-a1cc-6282dc07be18", "comment": "Malware payload (RedLineStealer)", "value": "b61c4f81dec61d8291982bd73da25d81", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737339, "uuid": "5b0d6f81-ff1d-42d5-976e-ce359e01ab4e", "comment": "Malware payload (RedLineStealer)", "value": "4535a46990a0c37b88ebd0109ea0590b9758fa80908d402acbe7702521b59ba5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737339, "uuid": "21180454-7e11-4b58-8a92-db08ed47aabb", "comment": "Malware payload (RedLineStealer)", "value": "de06a55ffb83563e5cb981121ced9e3a7235b5ed", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737339, "uuid": "8f0f7d93-a7e1-425c-9492-cb262c34fb86", "comment": "Malware payload (RedLineStealer)", "value": "eda69841de3d9e414c74ac79cf63a6896185ca6b27ed1bfe2627929fad3175bf2b68127d8e9d1bbc4b3c9835c9e5446f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737339, "uuid": "f8704fcb-5997-4741-9396-3347761906a5", "value": "T127252313A7D4C877ECB923B1A9FB07C716367D918D389329324585190C339D4AA72BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737339, "uuid": "516c74c7-5bd2-46d7-99af-2fc3d8cf50c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737339, "uuid": "9ed2aee7-cfce-4dfa-8817-621c93ea3094", "value": "24576:pyEZmnSv/q30NDVuuKtZIqpRhtakmqJC:cMmnSv/qYVuuSZrpR7Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737339, "uuid": "bf637c67-4f60-4854-a5eb-448991014be2", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737339, "uuid": "1a7ef6db-c0ad-43e5-928a-182a415f2acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737339, "uuid": "61447144-8169-41b4-82e4-67b9c41beaf1", "value": "Temp279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af81998-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747856, "uuid": "374b2f1b-9c31-4a77-b7fc-8c94edfbdaca", "comment": "Malware payload (RedLineStealer)", "value": "28d0b11485e6a901629c9c6325f2d668", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747856, "uuid": "0e5c4818-d28b-4c84-ac70-af35581c5544", "comment": "Malware payload (RedLineStealer)", "value": "4568009fda1b50dffd67ce28116f321a1f09eed0bce21f504b72f4a95b774b21", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747856, "uuid": "3e0a255a-4331-4444-881c-91c05d8604fb", "comment": "Malware payload (RedLineStealer)", "value": "f7419eb80af8972648d28b74a2f1b5f6be64dd94", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747856, "uuid": "b1e1562b-b4f0-469d-aa3a-e0d516b33db1", "comment": "Malware payload (RedLineStealer)", "value": "f6d09eee18579534fca53f3df94b5bfe8f028ca09824a8957f3eff2a109e9516a9bc3430f2164a974fc266ca6319ebfb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747856, "uuid": "bb85075d-cad3-402a-94b4-a64cafe27ddf", "value": "T118252346BAF484F3E6B823B114FA12E30B35BEA39DB4915C6745691E8CB26D09433727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747856, "uuid": "fe0cc124-5607-47ce-9083-cda19ac37833", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747856, "uuid": "993a6782-7443-4fc1-8fbc-f5ba01b776c2", "value": "24576:CyCmwD6pSzasvCi+WWtNOlFzECH4aOoBjW0XL:pPwD5zM5GlZvpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747856, "uuid": "20bfa4d3-df38-498f-a555-b5afc03fcd00", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747856, "uuid": "862306ba-f295-4abc-a52a-04cbe1d859ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747856, "uuid": "c22640a2-aeee-4380-b594-070dc113dfe1", "value": "Startup757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7952a35-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737301, "uuid": "bad396b0-bd8b-456d-bdd4-8dbeca389100", "comment": "Malware payload (RedLineStealer)", "value": "3d3d13f1b2c6a21e6a46e771219a7000", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737301, "uuid": "a5118bba-2f3f-45b3-b518-39927ee7ca23", "comment": "Malware payload (RedLineStealer)", "value": "456f100fa1e38ed580c92e324c9dde6fd11a159dcd3efe4de8d54868de4ce83c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737301, "uuid": "27d33aca-4038-4588-ae09-e4158541ef11", "comment": "Malware payload (RedLineStealer)", "value": "0562a772c2588075ebde3a209851c0475d620d69", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737301, "uuid": "e3ce079b-5c76-413b-b3e0-5fb2579789a5", "comment": "Malware payload (RedLineStealer)", "value": "fa2c403423c173e6f60af5c87f2dabb0255b7b1966cf3d320fde4671d5f6b98c7a724c33fea32bba1a81c76b075fb2a6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737301, "uuid": "2cf062b3-fde1-4557-abd7-06126b5c5587", "value": "T19C64E11132D18075E15385344AB7CAF28A3BBCB29BB059EB3B945ABE0F313D1DA75316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737301, "uuid": "0f46005e-8414-493b-83c1-3101489408c2", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737301, "uuid": "2075a699-6050-4969-823a-5e0302c2d6ca", "value": "6144:yJPZROllAfDq3TqozelOdWMNgXN3167hljbVHOBHEB45IN5f:yZZRO4fSuooOdWMNCNlk1HaHdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737301, "uuid": "a1650434-0779-4ec6-a2b3-0e43e7538c27", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737301, "uuid": "f10a955d-eccb-4f59-9f90-8f7261d1775e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737301, "uuid": "a5d924fe-0d64-4336-bcfa-5caa54589b77", "value": "Doge860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e908bb89-f8b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pikabot)", "timestamp": 1684767422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767422, "uuid": "835090b5-7874-4d4a-b776-77194096333d", "comment": "Malware payload (Pikabot)", "value": "ddef0c551d3e5c1ec331bc4239db316a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767422, "uuid": "9541aa20-4ff2-4780-8ae2-aad009e4da37", "comment": "Malware payload (Pikabot)", "value": "45930399ef1b9bbefe69c443706e6573fa508ee34a11f2b9a865de8f2e3569b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767422, "uuid": "7a01eb7b-a170-4127-8a1f-fd0ce49f00f6", "comment": "Malware payload (Pikabot)", "value": "062d4e2b9a6dd47ac9dcf3a81ca18cadade89a73", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767422, "uuid": "4e1f5361-ee3b-4e89-a801-c6819c487d05", "comment": "Malware payload (Pikabot)", "value": "843b9e7732eb55bcb7b05a723290561832508cd12f5e08ee4ccad44a06c8ddc23ad3d6a4ac67f87d4c81630c16e1119d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767422, "uuid": "5e5becab-d214-4314-9688-5006bec3c3f7", "value": "T121C4F064AF21C874F5EE02FC21392F45A82F50929B211DD7A7555E0E9A256C3EFBC303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767422, "uuid": "16f0bab4-515e-4bc8-b290-8df9f22014c1", "value": "e57923ac05f8cacef874991aaef87b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767422, "uuid": "8a2a87b8-0512-4e8e-ad1a-e90bdc0fdeb0", "value": "12288:f67mo2xmrRgC9+JiEWpOp9VTOvqUDVKeQQGtTzwz:C7RrRJ9+b6MTTOvqUDbQQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684767422, "uuid": "2d613549-c4ad-442b-b560-b7fe163a688b", "value": 557848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684767422, "uuid": "4a204be9-9b8c-4758-b8cd-ef74f90f920d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767422, "uuid": "a59cc137-7646-4a5d-b8dd-fc3a6173c192", "value": "Psalmy.membral.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e764a8-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738639, "uuid": "b1318816-a895-4c7e-be70-5e2d90ba230b", "comment": "Malware payload (RedLineStealer)", "value": "110ca4112675d51ee888b80e08c144c0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738639, "uuid": "5f540f55-6509-4829-98df-6e59854358ba", "comment": "Malware payload (RedLineStealer)", "value": "465c825d4ca8565939bbb6801d4b6e09e72359e1fc118a549447e2e30fde2e49", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738639, "uuid": "11cefc10-755a-4178-b437-766143851494", "comment": "Malware payload (RedLineStealer)", "value": "edeb636159f4c2728aee8085d8d4abc06cb750f4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738639, "uuid": "37dc01a2-5e35-404f-a23a-3595d4c47c95", "comment": "Malware payload (RedLineStealer)", "value": "e93f41629d0494c656a67fee4a151931a3a9c5c437cc0e2ab8b2b7270335f91df21a9f53ebd5636cb2864a3634276811", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738639, "uuid": "3fa1c0f3-1df0-478e-b6bd-84d0fd71c02b", "value": "T1E4252327E7D85872EDB41BB12CFB0B930A30BD65C9758B4B1245FA9E4C32284B53536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738639, "uuid": "e6d92d66-06a3-403f-8d66-11f4655459b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738639, "uuid": "16f2378a-06b7-4bb2-bfc2-de99e0e34b7b", "value": "24576:1yJbNxRCcBwUqKAlIB3LPgRTbEexE9Tye7PBFE:QJ4UqKZ3LaTbreTLPBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738639, "uuid": "9e26a8d6-bd12-4661-9537-5a5efdd9c5e6", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738639, "uuid": "2b0ba383-e867-449f-9cdd-69a6729741a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738639, "uuid": "26ac5c42-2b1f-410a-8be0-ccfd37053437", "value": "465c825d4ca8565939bbb6801d4b6e09e72359e1fc118a549447e2e30fde2e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758862ba-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737593, "uuid": "947d31c8-aced-47ec-acca-8685a8e30976", "comment": "Malware payload (Amadey)", "value": "ff56e0a4736897e92bd468d862fd9249", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737593, "uuid": "a2549d47-f7be-49ae-acf2-fa92cb61311b", "comment": "Malware payload (Amadey)", "value": "46d08fd61a333a68c40eedbef5960f2142a8ef703f90452de043cbf956d47129", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737593, "uuid": "b48854e6-0744-4797-a3e6-f7a68c06632e", "comment": "Malware payload (Amadey)", "value": "76d396f1adc632df8265cbfa984fbb84eb7a1ada", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737593, "uuid": "9a931a48-fa86-48a6-81af-eea511be4559", "comment": "Malware payload (Amadey)", "value": "77ede403f49d52e617febed14a5710a2d3c7ef767d2b1e1ad084b66dab049bf8d1a6e8eaf642cd9e07d3cfe8944d0f9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737593, "uuid": "3fcd6bbf-3132-49c8-9c15-c5d998e61fce", "value": "T1E3252317B6C999A6E8F6877018F607C30F367D62493887772386ADAE1D726D06830737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737593, "uuid": "616f3d22-f4dc-40ce-8fa3-3b8a01af5fca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737593, "uuid": "4be19206-cb48-42d1-993d-82055bc78df8", "value": "24576:1yf/fkAKW3xOzZUKuMhsIk/tTY24kr+JsjFI5W:Qf/f/Kexmc9IclYBkqJqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737593, "uuid": "80579b32-0ea8-49cb-8740-20273616e62b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737593, "uuid": "7b7b9a22-c074-4bcb-92bb-f940eeb2e231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737593, "uuid": "d9cc2c63-d401-4be4-9296-272221fbc1ab", "value": "proxy959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c327bdeb-f860-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684732999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732999, "uuid": "f944880d-7846-4ed3-851b-b9736dbe3773", "comment": "Malware payload (Formbook)", "value": "ce1fc692361778d2fd373d2695e58102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732999, "uuid": "7e7f8d27-5d14-4c94-9eb1-09315e790d53", "comment": "Malware payload (Formbook)", "value": "47c74b216015a03abc6bf2a786c4c760fe23f5ce920c9a0ed6e68aa340568e84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732999, "uuid": "abad7052-b614-407e-b057-e9997a9ff5d2", "comment": "Malware payload (Formbook)", "value": "cc71d3b97d5d808909b0d62890f28d712834f3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684732999, "uuid": "dcca9a88-1ae6-4615-8e0a-d0007d3c70c0", "comment": "Malware payload (Formbook)", "value": "334f2313ba8f10a5ad290bffce0787a21737515f4317d1b2efc7ee46ee4cd4776d2b4564fe40141973e1e55b325d01d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732999, "uuid": "d80def11-ba30-4b7e-8c5a-d592acfbaaba", "value": "T16BE4F1C166D88C10E66A5EB44EB3E63443793C61EB37D30965F06C9F7CA6A866B017C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732999, "uuid": "5fba92cd-f002-414c-acbc-4becbb8ddadb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732999, "uuid": "f316d983-1fc2-4d69-a92c-c3e617fdbfd1", "value": "12288:CTgx0YPX/NqPsn0l8xV2rnN3lggR6N+7PDpMpSpJYYShCCoIIV2cf6WOItS3:CTHHPsn0OD4ZltRI+KpSpJXEC7IuRSWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684732999, "uuid": "3f647fb0-9735-4203-9c92-f69dcf80fb9a", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684732999, "uuid": "382f5288-c565-4411-b37a-7d33499782a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684732999, "uuid": "5aaf4abf-8ec1-44c2-925a-75488ce21e9a", "value": "SV003927737627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9267c11-f8a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684763584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763584, "uuid": "6aa9d515-0e10-4f06-8d90-781ee9b0980d", "comment": "Malware payload", "value": "8792bce534a56fa6f541ff31ccffaa16", "object_relation": "md5", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763584, "uuid": "93337dbd-8911-4914-b98e-65e8b2b71c56", "comment": "Malware payload", "value": "47cd1113ed19b73c01e4a7d951409b8efb78ffd286f24ffd0fa30a2901cb85c2", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763584, "uuid": "70d86c35-6d3b-4f9b-8a6b-38236a1de7d0", "comment": "Malware payload", "value": "4c2afdfbcf4c3e4d16fa7554487dfe6e57b50367", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763584, "uuid": "606e98e4-dc5a-4570-be0f-24a83d1833b3", "comment": "Malware payload", "value": "aaceba6f81358184072c4b0905d9b706c0c76e6a4609452dbb0a4455237d50c218c713a9fcb4eb9e039ca5d677796e9c", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763584, "uuid": "a6f35acf-66fe-4c07-90cb-d562c37520e3", "value": "T17145F0A835A86C23D6795EF55222F13C17B49C12E617D3C99DE02CDB7CE2F492A02763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763584, "uuid": "6c170c6c-ecbe-4c04-b71a-28b07495cad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763584, "uuid": "32e3233d-6f57-495b-82f1-f21c37da3c3e", "value": "24576:VP0u/6vb+VGi5+aimO+TfVAgez49P7O+pr8nQMqsAu7mWx5:VP0uWS/8ZeVAgA49P7O2wQMFA2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763584, "uuid": "7d1f835d-c7c8-4c14-b618-c5dab4e47d3d", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763584, "uuid": "b5f3ced4-592c-4b43-81df-eb28dc0f8065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763584, "uuid": "838987e3-cf64-4292-9556-a5a0c4d1900a", "value": "handbook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b37680-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751923, "uuid": "168389e9-da0a-43db-aa55-a7bed0ad7b30", "comment": "Malware payload (Amadey)", "value": "adcc4ea9ae805075ae8ca0f70c14434f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751923, "uuid": "ace1099f-6df4-48c0-9152-ddb5536d6ab8", "comment": "Malware payload (Amadey)", "value": "481c1f8c5f0a224b705ab73d2e77f30c9d5f89731689d9cd7327638e97d56a6d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751923, "uuid": "6f0af024-c8e7-4cfb-8397-c052c82c77d0", "comment": "Malware payload (Amadey)", "value": "e9786ceead859ded03e814fcf29ce4b52dd893cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751923, "uuid": "54dc5c88-8878-4a4f-91e3-f393cce78dfc", "comment": "Malware payload (Amadey)", "value": "28387983788d7eb019fa70e6617fa33fea1467e8e99f4a0b70f801545d760128369ef15a5d2aa7f0a495113262012659", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751923, "uuid": "8bafe7b3-e9d2-48e3-ad60-cf6f79701b05", "value": "T18924CE2236D1C032F56745348EB2C6A19A27B8725BA19DCB3BD1863E5F353D2DE38316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751923, "uuid": "cf91771a-d04c-4eb9-9778-12718355d015", "value": "91e52b5b5b8df9c17be98b9e4559a03d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751923, "uuid": "db102040-4adb-49cb-8311-9a85398eb678", "value": "3072:q/M7QUgj9WhXqt4OY6qQZmk/VWNd3WrTQ5a7Tyc6KZVxVks5ZOMthCi:ZsNWqfEQ4hNd3WPQ5aylKZ5PmMtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751923, "uuid": "14b8b102-2490-4ae0-8199-0fa171b345dd", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751923, "uuid": "8b8b9ca7-7934-431b-ae97-a731d2555f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751923, "uuid": "47b1623b-8c1e-4ce2-81e4-18a8b9de4421", "value": "game225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a5c96d-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684745373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745373, "uuid": "6e7e4d5d-4e02-4e85-8cf8-d7919a129d6e", "comment": "Malware payload (WSHRAT)", "value": "e7fcc6eafeb8d232acb424cf11a72144", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745373, "uuid": "0eec4a66-846e-4b14-8209-b333859589bf", "comment": "Malware payload (WSHRAT)", "value": "4854f4cdfc2cc56b7e62e3cb3503e4d2873207bd1dd99805f3c39a666a1473b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745373, "uuid": "68da4887-1637-46ad-9a75-03be897b97d4", "comment": "Malware payload (WSHRAT)", "value": "4c16409adece66c53e8b1caf87f6bd6f30e611e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745373, "uuid": "dbc16851-734c-41ab-b32b-482979f67499", "comment": "Malware payload (WSHRAT)", "value": "beb9c196925f1b9375274396e7f4c2fba553db5bc784b0ffec023bfe4240285852f5612dc2e3d6d8a9b60abe1d96f918", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745373, "uuid": "d71da903-06fd-4965-a583-0687d3d5cd4c", "value": "T108252A6528A1351FBBB5D630C306C622EC2C7D1329D715C569909A8BFEF0D307EAA61F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745373, "uuid": "8d1cab0b-4ba8-46c7-b022-36882cbbbeb6", "value": "3072:QQLlH0xKE8W8za9r6HLb6kyVIksLgu9M/z/SjANqyCCn50jPjSF:QQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745373, "uuid": "9b35db61-d836-46d6-ad18-88be17919171", "value": 1033903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745373, "uuid": "f9669ecf-41ad-4c1e-a0c2-bdbd6816afaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745373, "uuid": "143246f7-6401-4b77-8e07-40730bc2f175", "value": "Payment Notification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6326eff-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738641, "uuid": "5ed4101f-961c-4b11-8ed5-8cd05401e38f", "comment": "Malware payload (Amadey)", "value": "501706ec55ad396b2641f50e39473147", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738641, "uuid": "3d7a3dbf-fe89-4ee8-9f15-d4590a1a2e21", "comment": "Malware payload (Amadey)", "value": "48bf9f1f8a5848c7439075e133a8525d6faa9a9c8bfae8768ba4ae6a20b80456", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738641, "uuid": "e629e023-fd63-4270-93eb-3bd3941732e9", "comment": "Malware payload (Amadey)", "value": "fdac01a6bd4efe6289d2b43e3e125b01e2504bb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738641, "uuid": "db897e5a-1dcb-4966-9e14-1cd764ff1343", "comment": "Malware payload (Amadey)", "value": "e9297c891e6eb43c22ae59d65b6fcf365deb6f2315b707f17188c7a2b118a3ea2fc87330eca228212cc015e9d6ae30bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738641, "uuid": "f0817e9f-413a-4d1b-8a48-96d01ead2865", "value": "T148252347A6C44423D4F43B70A4F64B830F2ABDE19C79420E27896D691DB37CA6171BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738641, "uuid": "725bc154-e737-4376-b827-861385fcb666", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738641, "uuid": "7a6cb8c5-20c1-4930-9584-380c2f6173be", "value": "24576:VyVW/5YHYq7p5DDhwgSR1oR2soiktJVXXXFiiqRT27btN6:w40YqPlSa0JvJHQRTsbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738641, "uuid": "a03184ac-890d-4055-8952-4fa6f057afd8", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738641, "uuid": "952878aa-be83-43ed-9f19-d25705211516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738641, "uuid": "b5daa357-dcd2-42c9-a7f4-fc114269186e", "value": "48bf9f1f8a5848c7439075e133a8525d6faa9a9c8bfae8768ba4ae6a20b80456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e90fc26-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752480, "uuid": "45393dd4-d740-4c8b-bb4d-e32b733c690f", "comment": "Malware payload (RedLineStealer)", "value": "500e54f627d7e7c1a67cf8b473ca7a7a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752480, "uuid": "962f04ce-f945-4348-9caf-61a41c06f000", "comment": "Malware payload (RedLineStealer)", "value": "48fef0e58aad08d25d26e8a4f923ccdb59424b19c6b72cd0751c021203c9a195", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752480, "uuid": "f14ee16b-5b38-4764-b9b8-e53dc89f847c", "comment": "Malware payload (RedLineStealer)", "value": "dc54e3abb1ae748d8c6d7f95a3a876ec9013c6f8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752480, "uuid": "531b51e7-e979-47a7-a180-9ad153f5883a", "comment": "Malware payload (RedLineStealer)", "value": "0663765e578dc2d0f338454be7467dec806dff1c995ab8bc3c3032014242fb83b05fde13e026c840a73c95a777376bbf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752480, "uuid": "c2d91343-b0ab-4206-8c7a-04022a86587d", "value": "T1CC252302A6DCA0B3D9752B745CF606D30B32BD7149B88B662B802F5B1573ED4813BB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752480, "uuid": "48736d17-1b02-498c-a59c-11b286676c6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752480, "uuid": "e459a31d-c015-4bad-880f-6c0c87f5f3db", "value": "12288:WMrTy90y5VIxdhPiE+T0Nog9isKfjRqf11VFZrneASM+KBhvbSIMiQ7YT42c6r0+:1yDyT+TFgQPqtreABwImYfbrKII+aW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752480, "uuid": "ce9faae4-44ba-4395-a9e3-ddd98f94cb62", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752480, "uuid": "175b43d4-3900-4f89-b0cf-7ffb90c8b431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752480, "uuid": "11282cc6-04c9-421d-a782-c6af1a3e0849", "value": "listener627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecbb0cd-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684745393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745393, "uuid": "4197d7df-ad7f-4903-8a2a-5c77189dad83", "comment": "Malware payload (STRRAT)", "value": "f30ddda520857ee69b3cf919d408133f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745393, "uuid": "e43f5437-88b0-4786-83af-1032bd692283", "comment": "Malware payload (STRRAT)", "value": "49465ce42297a71ab2ed2a55b6794ee0be01c919b1faf2b6c68bb2a61824f744", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745393, "uuid": "4eaf27ff-7c93-4887-9c28-f363a15df787", "comment": "Malware payload (STRRAT)", "value": "1c001778a1697aab3170e64cd0e92bd589849d91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745393, "uuid": "1225977e-6146-4c12-be4d-13fb47a49146", "comment": "Malware payload (STRRAT)", "value": "94338f3ec82912cb6e3769e738a5df484e50aa78ec42da9170bbc4fc4c5a426e69e3a3e5528a9c3e22e78fdaf0469a2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745393, "uuid": "fbe1c813-caff-448c-bdf3-7ec29a1f62e1", "value": "T102749C5AD9C7877BDDE0013C41AB1A3A5EE60605EC897CB65173EF9EDFE2A64100E2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745393, "uuid": "d7ecd297-80be-4950-8d23-57dba2936059", "value": "6144:8Gn3BXGfO1slwrmCSJPqvFiNRDlLQLKxgr8QgKdPnKX96S/MHUL:8Q9GfOgw3vFitsKgrZPnKoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745393, "uuid": "0b3a1a1f-f688-4916-a5b2-3e147ee25565", "value": 342774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745393, "uuid": "3054b3f4-cb73-451b-bdca-86a13423e2e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745393, "uuid": "4c5e4374-3801-49fe-94c6-0940a485d3e6", "value": "Descriptif d\u0082taill\u0082 REF DPPB00029.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f734c9c-f8c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684775781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775781, "uuid": "20ba2812-246f-453e-9f29-f79436cb766d", "comment": "Malware payload (RedLineStealer)", "value": "485a362d3afe2602819d665199771066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775781, "uuid": "509b9fa0-c3c1-4ab5-a392-dd7dba6c83f1", "comment": "Malware payload (RedLineStealer)", "value": "49490e430e04f7e05790970b48b1272e90b5587b6cc9c78017c36e97b9e61cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775781, "uuid": "b844eaab-9a3d-4568-86ec-7d5de7ffcfa2", "comment": "Malware payload (RedLineStealer)", "value": "84d9c451f7575e53b854b99ac24bf88744405e75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684775781, "uuid": "ead51a43-e643-4c13-a4fc-6032328b4d86", "comment": "Malware payload (RedLineStealer)", "value": "a673f6521797fac26399b9f6a25f923180ed9a653a0dfd30c8aab3a9038a28eb70185d97ac41a6e674fe88a06d585e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775781, "uuid": "983e3e21-c29a-436a-8398-ee47da42c014", "value": "T156252312BBD140B3D975177048FA0BC71829BC629A38836B2794E91F0C736D4A9B777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775781, "uuid": "a77db88d-94e7-454b-9eb5-90612f425f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775781, "uuid": "17cd479e-ee07-410a-a980-7bb765ae21e6", "value": "24576:SyHjtpAwWgF6kk46br5ZH3vRJNxv6YP+IQrgzxKdqwHIIMRXuJuTYfVw9ylG6g4:5HjL1F6O6bjZJHztfzxKkrVRXugTpck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684775781, "uuid": "1a8314b8-c3e8-43db-b0b1-ec5b0235e9ce", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684775781, "uuid": "9c66874a-1e65-4eb8-8520-59fa813de9ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684775781, "uuid": "31fe2b65-08d1-4a05-b894-9bf3532d162c", "value": "49490e430e04f7e05790970b48b1272e90b5587b6cc9c78017c36e97b9e61cdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e097f4-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745185, "uuid": "5269c1c9-5b36-478c-b3e5-81d33594b2f8", "comment": "Malware payload (Formbook)", "value": "3fd20182a833020d50543d952d69db33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745185, "uuid": "7c5842c5-76eb-48dc-8b08-a23f53874ce0", "comment": "Malware payload (Formbook)", "value": "496812217f923899da536782942ea5c95a679d55552ab81c8ec2c15c9ba58502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745185, "uuid": "b96410a8-a20b-4dc0-8766-061f87d4dfd3", "comment": "Malware payload (Formbook)", "value": "0f441ba23572e9884873c4e3151342b354cba048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745185, "uuid": "09d148f9-1ad4-48b8-81cd-80f6350a1eb0", "comment": "Malware payload (Formbook)", "value": "8bc93dcc52d5a89abe18db3a79ac800f30277dbbf742ba7f9b27930480c1f149482efd77d2f28b2955aa55ee63a76f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745185, "uuid": "c86adf92-1dd5-4f79-96e1-467ea51aaa3a", "value": "T15CF4F1D11A988D15E6AA9FB959B3F63053757C91DF23870928E42C8B7C66B827F007C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745185, "uuid": "8549f34b-baed-4313-97e0-49c31516a7f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745185, "uuid": "0e1026b1-9292-428d-9945-a7bbd78025f0", "value": "12288:FTVx0YPX/NqPsD0GE8vJKenfu5Y6N6JDw2PN07UeXl1qKIRM:FTgHPsAGEyoam5Y6V2l07UiIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745185, "uuid": "ce5069d7-4422-4071-9b62-386fdef0f644", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745185, "uuid": "ea0ad0b9-7a9f-4c9f-bd06-6c68e814919f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745185, "uuid": "9cac32af-4dea-4c5e-a40c-2e75daaca8b6", "value": "PURCHASE ORDER-PDF-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cb9069-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752297, "uuid": "6c57874e-ae07-4e7b-b530-3db96ff45c0f", "comment": "Malware payload (RedLineStealer)", "value": "e1fd8b8555e46959f6c9fbc289a9bca3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752297, "uuid": "1ded966d-c419-4ca9-bb31-8879b3669575", "comment": "Malware payload (RedLineStealer)", "value": "49784ee66096b3b11b15f27e6654db2a8b5714331d556dad380db0bc6d3200ce", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752297, "uuid": "5dcf5862-4035-42ba-84e0-fbdd74ff3e74", "comment": "Malware payload (RedLineStealer)", "value": "6812491bc8c188afbcf512e8c6c4bc68f0274001", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752297, "uuid": "e9bd79d2-9a4c-4241-8d8d-5e9d83c10555", "comment": "Malware payload (RedLineStealer)", "value": "cb6bda08a98d1eef18db50815b6083a1494e875c46a122f47f37473cd4743c8eff5e5f1a895c7e7751b2ccf959e83059", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752297, "uuid": "7543ddc9-4e93-4dac-b68a-f6f155cc0372", "value": "T1BB252343ABE80163CEB6177414F607A70B3AFC519835A7BF3389581F2D729E49532B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752297, "uuid": "bfe5a197-16ab-4fce-b267-45ef86a6f1fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752297, "uuid": "53dc7a92-5212-4321-95a3-fcd67d91d214", "value": "24576:RyXRwsR9TA9Vq4MHryq4GRChaJWLjY2HhHUazXQXG3Y3OGVw3RwwEbo:EX6s3sq4+P4GRCwJ+XhHj2OGVw3KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752297, "uuid": "65dcde66-91ef-4956-a115-a9527504da82", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752297, "uuid": "8115b133-1754-4fbb-8790-882388ef71fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752297, "uuid": "a4ad4997-7ef6-4fa7-a009-5591081960c4", "value": "DHL464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ccee1c-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738642, "uuid": "50d5ea20-d9df-45b1-9710-9d988b56787c", "comment": "Malware payload (RedLineStealer)", "value": "6898686657256a0d213e8d9bcba5450e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738642, "uuid": "970ced6b-9a8b-4bb5-845a-96bc24aabc1b", "comment": "Malware payload (RedLineStealer)", "value": "4993c73a8fff1662e40cfdf11ce7c75b2f9b3bf34fe90fd5bcaef131ca00203b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738642, "uuid": "36dd6802-03b8-4bf7-a820-eecad24a14a4", "comment": "Malware payload (RedLineStealer)", "value": "ec821fff0bd53fd4341d4edf8b44089b103bd8ba", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738642, "uuid": "26251253-30bf-4004-a47f-1f26b9de450e", "comment": "Malware payload (RedLineStealer)", "value": "878c13418783055fd86f12a128149265a376319dfb92fbc258800a76dbf00113d283385f36de68333d803004e5802091", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738642, "uuid": "572dc07e-f05c-4c43-9957-8fdcf382365d", "value": "T16F252317B7D06533E8F55B3099F216930E76BC516E60878B638AAC4E0C73684B9343BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738642, "uuid": "8b52c32f-cf83-430d-8630-794ec1122b2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738642, "uuid": "7e737c15-9741-494d-8f8b-7e0e09252ad7", "value": "24576:Yypq6QuaINMbKFaE+8L85g/LGPZMJynTUGls7e:f3Q7INM2Fad8Lz/KZlnTZlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738642, "uuid": "d03f88ba-b718-495c-9e05-e37132d7843d", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738642, "uuid": "14ab34df-b0b5-4224-898c-b5a4bb8d1838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738642, "uuid": "e2575bd7-7c3f-48b3-9158-6a6ed0a0b509", "value": "4993c73a8fff1662e40cfdf11ce7c75b2f9b3bf34fe90fd5bcaef131ca00203b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dec263-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752364, "uuid": "e09f7fe7-2616-45fa-9baf-3a3ec0d3d7dc", "comment": "Malware payload (RedLineStealer)", "value": "bd3bdc185c5482e7cc9b753b370373b7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752364, "uuid": "d08479ab-a235-44c1-829f-d43bd59dc846", "comment": "Malware payload (RedLineStealer)", "value": "499fe748b1dd6e0c012fa4bea11fd5e36fbab89721fc80d6c1524de6d280ca4b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752364, "uuid": "4b9330c2-bfc0-4379-816d-6eb069f68418", "comment": "Malware payload (RedLineStealer)", "value": "d2a5d97eb2e0734da7b0123b95ceaa9e59c1fa04", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752364, "uuid": "2a3942c0-82d5-419e-a818-e6a859297f9a", "comment": "Malware payload (RedLineStealer)", "value": "cdf5abad62d7f1e23b7776a7422c79f78152128b7268bcf5e9ba31f2a83677898c49321bee355351af454cb8e82548c0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752364, "uuid": "f65c334c-1146-4102-bde8-c52e4ff058f6", "value": "T14C252312B7E85031CCF4273424F693D31E36BC924974D69A13899CAE2C73699AD3276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752364, "uuid": "1d35a0cf-c19c-4e1b-bb80-1faf5708ad71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752364, "uuid": "98c505e3-a914-4ec3-8bf5-a7e10f608f2f", "value": "24576:uyf4jnHe97nNHZ+Z6X555P2cveN488Fsyf2gY+j+oW:92+97nlZ+UPEcO27H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752364, "uuid": "ac74e84b-2182-44bd-91ae-632b8a572258", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752364, "uuid": "5e3c4f2f-810c-4515-a6e9-07e9ec8e3fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752364, "uuid": "6c16977f-5ae8-4e53-81c8-16eef41670d4", "value": "client596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff36946-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684762682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762682, "uuid": "0b0d0536-b9c6-4dc2-b7ea-e732773d721b", "comment": "Malware payload (GuLoader)", "value": "a6a043039b992470c518beb37316b6fb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762682, "uuid": "d8dca7b7-8d15-4278-91d9-b0bc1359d80c", "comment": "Malware payload (GuLoader)", "value": "49b109625db665c82ae907c02b184a90b4388caa1f1ddd2800b944a3bcf9805b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762682, "uuid": "8c0b3b75-a0d1-439d-be46-5c6d9d9ea42f", "comment": "Malware payload (GuLoader)", "value": "aa9b92b4b2df3c5afbce1516061e458d22f25ead", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762682, "uuid": "3095e1e4-9e93-48d5-be67-61379b3f2328", "comment": "Malware payload (GuLoader)", "value": "d26d024256fec8b9f429e76da3a013521e0a53ea4c252e7348f56c83fc57c550f6d79816c6cbc67ed7977ac98f3153c1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762682, "uuid": "f966402d-fa65-41b1-909e-4d4eb01617f4", "value": "T13BE21A71E69D361948CB3BEADC400C60C4BA4D150933156BBE8913AE7787B4C977FA2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762682, "uuid": "6f2fc14d-dbdd-4ccb-bad9-e397f234d473", "value": "768:i8HJvKI41yARlsxM3elBQVgIapmgJeLB/r:i7PPVspmgJ2/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762682, "uuid": "3754895a-5b2c-4455-a1ee-50516598366f", "value": 31627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762682, "uuid": "b55c986f-dc3a-4514-a206-708401a2aa69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762682, "uuid": "46d5797a-61c8-4146-ae03-9986a5bd2f08", "value": "Arrival_Notice_Maersk-shipping_83778889__.jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61ecf6e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752412, "uuid": "1f173e64-2ec3-4a82-a8b0-4e96a65dcbeb", "comment": "Malware payload (Amadey)", "value": "df5ab78ef9cfff791eb439ca2745e1a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752412, "uuid": "533a7cfb-c122-41ca-a797-8f2bafe2eabb", "comment": "Malware payload (Amadey)", "value": "49d4fecd4579eefa33c1006ce72a1d88c62df5494a9264a64609162251647df4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752412, "uuid": "af2feaf1-e48b-499c-8287-da6313d0bfe2", "comment": "Malware payload (Amadey)", "value": "cb3509798b33899e9c14ae3618d81596489de0b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752412, "uuid": "62d35ec4-b9a4-4067-bb18-56b0f9377252", "comment": "Malware payload (Amadey)", "value": "d5541c8a2bf95b8e20e732feef690227e15229f43f2fdc1ef10a9203b55fb00911a730968c7849e78aa6cff64b4c00bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752412, "uuid": "d060b82a-a7f1-4605-9d13-dcd645033066", "value": "T115252313ADDC9962DC703BB058F103C34B797D025E39AB6B1B86D99F0C61B84A63539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752412, "uuid": "56b9ed1b-6fd7-45c3-b0ff-ef40b8c101a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752412, "uuid": "6393b542-fd2b-4d65-87ec-510590e145a5", "value": "24576:vyfpdYsjSiG9tINyFVb9so2WBwSeFoguHUS4p:6fksjSiEy0sCWSeOVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752412, "uuid": "07f1fef2-a786-45ba-9ccf-92b8216638f9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752412, "uuid": "e61b82e8-cb34-4d70-a669-751394315645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752412, "uuid": "48216407-49f1-4d0a-9ca4-91274a14f826", "value": "encrypt874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac544b8-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752500, "uuid": "f4143ec4-0e92-4396-b131-a7e6fbefe591", "comment": "Malware payload (RedLineStealer)", "value": "ddf29fb1fd5017bd4373715d6248e684", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752500, "uuid": "1f2c1cd8-8b0b-4fec-8746-86906fd968cf", "comment": "Malware payload (RedLineStealer)", "value": "49dba2655fdcdf1b47c8e54c698470a1faf06b9932918db878e344f755f8f45a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752500, "uuid": "e198dae6-cb60-479f-a9af-c7f374e626fe", "comment": "Malware payload (RedLineStealer)", "value": "93a77219849ec0267fdbdefe1d4a79a6b3ba3852", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752500, "uuid": "a0d216ee-ae13-46be-b61a-af7deec083cb", "comment": "Malware payload (RedLineStealer)", "value": "8ad9a22ebfadef9344be73848b4907c23aa23fe680f65588eee7db5e7d8fe1213d2d9ed5af0d691f754151f891e3bc4d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752500, "uuid": "040fe1bf-40c4-49cb-8c76-eda75b99ff94", "value": "T111252353D3DE80B6C8F557B428EE17D30D367DA45E68871323899CAB0CA3580E57A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752500, "uuid": "a7dfff73-bcb1-415b-b9e9-2e3002b81ef7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752500, "uuid": "99c56613-c4fc-4676-9e3d-533597f5537c", "value": "24576:9ytjmLd0/MYpAr/d6K4vostYrv4nAT7QywMQYT/gQY:Yt63bmJYr4n+75QYTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752500, "uuid": "6ae0796e-bdf3-4409-bbe8-b12cb2aa0545", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752500, "uuid": "ebaa9916-dd1d-41bb-96a5-2757401fb255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752500, "uuid": "74a6185f-ff6c-4a19-a1cf-7a7577862e8b", "value": "networking797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d557c13f-f89f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684760088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760088, "uuid": "205c9120-cfe0-462a-b030-0900a2d734fa", "comment": "Malware payload (GuLoader)", "value": "0cd77fa4bf9bd37559c7f4486fbb8fcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760088, "uuid": "8ba86778-fe78-42c8-bb97-c3b0d17b593f", "comment": "Malware payload (GuLoader)", "value": "4a7494bf219e9421f2aaf50f46b391b813b1df67aa4a929dfed977a4ae8875bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760088, "uuid": "f6451fc4-1283-496a-8e28-29419e6a8b4d", "comment": "Malware payload (GuLoader)", "value": "c3505df403fb201a0e88754e6569218602591b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760088, "uuid": "f5ef36c1-75cf-4d29-9ffe-4ad1d5cb8c5b", "comment": "Malware payload (GuLoader)", "value": "5884958a34ddb8263fbaab3955b5b3b3f825f0eab0e9fb742af4f1e2e64f317409aaf36495cf7665ac568ac25f55f6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760088, "uuid": "2bad4174-9842-4f1f-b911-155025870adf", "value": "T136F30222BBFA849FF62206712A3B9751E636A61271179ECB1B557F350D31603CE0B6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760088, "uuid": "215f0a19-12a8-4626-a7b8-1e3993adaa9c", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760088, "uuid": "0b4cb5d3-0ea3-4791-bc4f-fe249d210357", "value": "3072:1DQkrZoosbIfXJ/ppJCMMcXfsNsYWDU9QyxUrMITgPJXmJ1fZdZkh+P/pkZEWPbe:1DpoeJFPk+YMIogI0PJWfZdqkPqZhPRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684760088, "uuid": "972925f4-0773-4c59-bef5-49e168cfa3cb", "value": 162590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684760088, "uuid": "8f8ab5bd-8f20-4b21-b9a2-f5c2774917a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760088, "uuid": "44b585c0-c39f-4592-9405-94c1cdbe2a99", "value": "rZiraatBankasiSwiftMesaji_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b2ae56-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684779541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779541, "uuid": "30541776-ec36-4fbd-89a8-8d4d086396a1", "comment": "Malware payload", "value": "e34646076ca26e37dd59993905bf56b5", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779541, "uuid": "6bebf0c1-8555-4f46-8888-309754b55795", "comment": "Malware payload", "value": "4a88d557ba84120dcae5ba0108eb92ad1b7bb7261306282065705d993012d168", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779541, "uuid": "c4b230dc-dcae-4f08-9d00-3be71f5c204f", "comment": "Malware payload", "value": "c90179977a14c41b8209a00c135c042b51ad1933", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779541, "uuid": "44712b8e-e380-4a99-b508-074a8169a86c", "comment": "Malware payload", "value": "c0cf0706fdd16fb8dcd80d58caffb362ed2eb8acc02c6d72121099e6a8e8c8bdf3b683e16f552c94831d4860f2ae66d6", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779541, "uuid": "2d31e887-5c08-48d8-a08b-fa4e8a7cd462", "value": "T16C428E09D8A6B872E332557E849D0572A36F71A8CE43340A7C49F66367917D7038A2BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779541, "uuid": "1c520a4c-38c4-4a97-acbd-95ff5d9a356c", "value": "192:AexlmyJAx9ekcAI+q9YKjI5cHJCf/VxYMv2O71aFUlbVvevUqzh9Sv3bQ8aYBTf:AKlRJTGI+qP05x/vYFUlM9zhQLaYhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779541, "uuid": "b0bbe6db-8cac-4974-ad71-095c20b24dd1", "value": 12940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779541, "uuid": "7105d061-fe3e-4bc8-b08a-20a2c344c607", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779541, "uuid": "b10e13ae-10cc-4668-bf27-78aa4c4c4371", "value": "Bestellijst.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a5b730-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684747960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747960, "uuid": "dec3846a-3c79-4552-b107-01f2382039ec", "comment": "Malware payload (Amadey)", "value": "07ba1dfae309dc90a90bdf816353046c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747960, "uuid": "34e49983-6715-4fd6-9c7d-78f9c8a6c7d2", "comment": "Malware payload (Amadey)", "value": "4a9ba4aa7a8ffa7bc984379b584a37a9a8b20cbc0d732b04ad7021c36b3f2bed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747960, "uuid": "ef7d1117-be7a-49c2-858a-0f8fa0bcfe63", "comment": "Malware payload (Amadey)", "value": "bbe592fd067074f71e7c612de67d34215730f1dd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747960, "uuid": "ca5e827f-adaa-477f-b8cf-b94fbfc34b8f", "comment": "Malware payload (Amadey)", "value": "12f2e8ff266875d316eb4a9754d96939ca3a802397f4f55cf59c3e0eaacfd44e2b925d31cd464a6182ab1125e61197e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747960, "uuid": "87bde5ed-27df-4572-bcf5-b80cae612ac7", "value": "T144252366EAE490D2E8F41B3088F707C30B367D919AB4E22A37566A8F0C715D8707B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747960, "uuid": "4255ac06-1622-4182-8d9c-546ec5b26376", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747960, "uuid": "993c46b2-9fe9-44ab-8568-2191d62f399e", "value": "24576:iyKzcelS5xlx9rEZmNFa1gTYb3EgC1bCMF0:JKLGP3E2XYggCRCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747960, "uuid": "ee4818c2-1fb7-4b47-8ad6-45c98c65b8f9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747960, "uuid": "de6ce36c-03b5-4987-a423-8baed62ef756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747960, "uuid": "51adf0a0-0b67-4a72-9521-ab89bfd7d47c", "value": "multiplayer641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fa137a-f887-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1684749460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749460, "uuid": "d050979c-d4a4-4058-b69d-65b3ee2b7125", "comment": "Malware payload (StrelaStealer)", "value": "d959e540954f0fe516cb9e61928f5f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749460, "uuid": "544782ec-84bd-42c9-b19f-d17955a67dc3", "comment": "Malware payload (StrelaStealer)", "value": "4aa7c5381ae2619a97dfb1b473c7a08f36552f4f2767227253708d1151642c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749460, "uuid": "ac32df11-e512-4a7d-90be-864924148ec6", "comment": "Malware payload (StrelaStealer)", "value": "64f07cd21f808c1cead1c7a4a1415591982d3f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749460, "uuid": "490e73d9-c034-4c0e-a3b3-7495994435bd", "comment": "Malware payload (StrelaStealer)", "value": "451467f2ca00f56b00eed72cb1feb61b45f2301a919ef783a7394910640ccd68655bf846ea0c98a73a98cf881f15a784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749460, "uuid": "e7445271-963a-4140-a577-75595f933775", "value": "T156E3483CB5605D77E553CA7671809321A221AB680E24D806EC1F49731BB3F5BFFB912A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749460, "uuid": "235a0b51-eb5c-4273-ae30-3cacb72f5cae", "value": "675f7fb22861ff7eb3f7961dd1eeb588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749460, "uuid": "ca47b8f9-bc9c-46b8-ac8c-f3cdc321dfeb", "value": "3072:Zo1NmwwxBU1Qa9jHG5yHtfr4nIiOYZGWcKYbS:ZImGqa9jrNjb1KYbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684749460, "uuid": "a66ab843-20d4-4449-a37a-236e359f1434", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684749460, "uuid": "532ed944-5a48-45e3-bafe-0c5abcdc599b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749460, "uuid": "cb16f319-ac5b-48b6-a8a2-98a8703121e0", "value": "FATTURA_ (1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4b92fc-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752392, "uuid": "3076165a-c755-4944-876b-a68431854a00", "comment": "Malware payload (RedLineStealer)", "value": "5c144e82b30fe477e725744585804dfc", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752392, "uuid": "033108af-4471-426e-8d62-9b045a69f4be", "comment": "Malware payload (RedLineStealer)", "value": "4b2609c28ab96acc7e9118f4b31bdbdda17cda77750bcc7c6dc3aaf3a8541025", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752392, "uuid": "e73f1142-8237-48da-87e8-b227762ca1c6", "comment": "Malware payload (RedLineStealer)", "value": "1f102dfb2817b4fd3d5a13ba70be1a1b58e38e19", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752392, "uuid": "dbaf47f2-b1ef-45bc-9eb5-91f275d1bb4a", "comment": "Malware payload (RedLineStealer)", "value": "4cd20e988d97a2bac854f1583968805adc1b5fc98e8ada34fcfe35a04df9af0a90db816e00dfc70c9ed7013164f7516e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752392, "uuid": "c0be1501-9b4b-4f20-b6fc-e0c7c7ce992d", "value": "T121252317A9E55432DDB1377044F303E305397EF2D83886AF138999296C73A81AD72BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752392, "uuid": "52434529-1993-4091-897e-6fa487fa35b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752392, "uuid": "c546aaa3-b0db-448a-89ad-be07c39af34c", "value": "24576:/yqmlkjXcQl+/NLz5q2psm+U/zYB3uk5B+r9L8Vl:KqxMb/V5q7a/zYB3ukPcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752392, "uuid": "4bc74dea-b568-426a-8816-62a9d29f1e05", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752392, "uuid": "e0c1ec92-050f-4bea-8b41-f4c7293c4a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752392, "uuid": "f4c05262-7006-4a72-a435-802802597377", "value": "discord_token959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3a4118-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737520, "uuid": "c652f954-d233-4944-a6b6-3f58255690d4", "comment": "Malware payload (Amadey)", "value": "b5cee29025dc108269e00e660e9041b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737520, "uuid": "3792af45-dc5f-4fad-9f37-56d8a2088000", "comment": "Malware payload (Amadey)", "value": "4b4319fbe8f0ed073e5f6f9adf06681497df255449585ca365ae42606985aac0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737520, "uuid": "230a6470-e0fd-4483-8d8b-c17d79540e2c", "comment": "Malware payload (Amadey)", "value": "a9f30dfc96b6939056c656f5fdc001d094dff2f0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737520, "uuid": "7bb85f27-8412-4bf1-9308-4c6b13b52427", "comment": "Malware payload (Amadey)", "value": "721be68a37f6b45cc0356c075c8de7edabe25a82963e3c9535c74f2c2c22fdf46752a44f88bcd8c8e0832c3a9b25ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737520, "uuid": "0d8ebf23-577c-47f4-ae86-6099cf9c14de", "value": "T14D252307A7DE00B3E9762B70A8F2058B1B327C71AB79961E2B41E85B5C735943235B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737520, "uuid": "9e7c856f-9bd4-4c19-a8ab-b865ae36847b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737520, "uuid": "4ff4f4cb-0a71-48b6-937d-f2d1ddbe3423", "value": "24576:JyBgJIOCfMusHWC8F1qLV2PeErz6D84xHTutNbLTZJ0DmYy:8B2IOqMpHWl1qIekzMu/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737520, "uuid": "608ee402-e498-40c0-a201-754b533a0494", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737520, "uuid": "10c224d1-31cd-42c6-ab82-11457675d2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737520, "uuid": "1dcdd2ea-8cfd-4605-adca-72659d317bef", "value": "notifier307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ce6f34-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684745277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745277, "uuid": "f776b9a4-b448-4b80-907a-a41d8b0c670d", "comment": "Malware payload (Loki)", "value": "38ec19cc8f6cc0a7a5a074d67be3fb31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745277, "uuid": "b95db27d-4d55-4ae5-a1c4-ad1eea1880d7", "comment": "Malware payload (Loki)", "value": "4b6cc1c1b1400777d4a0365763803915348fd8f12ece21bf694e2a3582e1f1eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745277, "uuid": "b6307959-8fa0-441d-8868-0b04f9ccfc5a", "comment": "Malware payload (Loki)", "value": "d092714f42f1be135830c135d5e5798cc9e57a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745277, "uuid": "3927b69f-a311-478c-b794-968827fb7fec", "comment": "Malware payload (Loki)", "value": "ce5c95bb2e7e1d0594f3bcd302bb8c300c4e56d9b3e6719d85abd5e6020744d050519e5c1b041b8493a4e60f535906cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745277, "uuid": "82703091-8acc-4084-9094-60e8da2e7204", "value": "T1E6D4F1C026949D15E6AB5EF95AB7F13803B96C61DF27870D24F02C8B7C66AD17A007C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745277, "uuid": "2a1f9252-ce39-49a9-8970-f6ce83916b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745277, "uuid": "8e3ea403-3829-4478-aab4-7e1c8c715518", "value": "12288:dt4x0YPX/NqPsoFAfwI755guLnNxihgM9mWB+K+j7o:dtvHPs0BI7IuLyhgM9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745277, "uuid": "05f57984-85d1-4292-9760-8467eaee6c0d", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745277, "uuid": "81c593e2-b372-4939-82cf-845fbd166b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745277, "uuid": "1ebe4b28-f474-4c5e-b43d-82302932e820", "value": "TNT Express_87993766478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efda372-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684779565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779565, "uuid": "378f3c56-c785-437c-add4-478938416662", "comment": "Malware payload (Formbook)", "value": "f4a17b8e7d924cb0981a717aa945117e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779565, "uuid": "db63ffeb-4a06-4c26-9d5d-f6e94e61bcfd", "comment": "Malware payload (Formbook)", "value": "4baabf9e31ff1f2fec8fa4f3165d5456836c307591bf8840ec5a8074759fe742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779565, "uuid": "5f619c11-ded8-4a5d-b2ca-a4246f5b88ea", "comment": "Malware payload (Formbook)", "value": "10cc4273cfbe1f0876696fb0e046370b4f4f26fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779565, "uuid": "1b05f81b-4875-4efe-a3b7-dfd111dcf17c", "comment": "Malware payload (Formbook)", "value": "2d862db3d0147787bbdfc05211adb631aedac7ad3a610a6038e6d56e4bf3828d8d496013027586e31ea71ab48612d5a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779565, "uuid": "a388f335-1251-4956-842c-1f477f9cb47d", "value": "T108E4F1D166948D10E6975FF959B3F13403B96CA1EB23C70928E46D9BBC62B813B10BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779565, "uuid": "dda5c7d4-1e69-4eab-b8b3-685bbc24c629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779565, "uuid": "7e607d51-9cc6-460b-a284-1a8a12ebed36", "value": "12288:1tJx0YPX/NqPs6UQHPLzbQexNf8t8TPljvyqQ4HYQyC0UvYU0yyRw:1t8HPs6UwLzbRf8teljaJ4XB0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779565, "uuid": "d64cf41d-4e24-46f7-b1ab-fdd8b5f13976", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779565, "uuid": "89e0a88a-066d-4ee2-99d6-bc86ebc53d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779565, "uuid": "d3542a14-a5b4-453b-b5a5-e8baac002fad", "value": "Items Description RFQ_STE sa_Argentina..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc09f39-f89d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1684759219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684759219, "uuid": "a3c1c786-4b15-4b9a-94d8-49ab0cb38d52", "comment": "Malware payload (Stealc)", "value": "af5b77e50d52155f52db90db3943ecb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684759219, "uuid": "0a5758a3-6767-4066-836d-4f2475331fbe", "comment": "Malware payload (Stealc)", "value": "4bf527594f4b3c1e6a4fbc9527285c310693b1a79eb7b0a391fe4189b6a0bca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684759219, "uuid": "4fcbe202-4265-4995-86de-3c6a8e40c1d0", "comment": "Malware payload (Stealc)", "value": "262dbdf9ec8268934c8f11977800309a19f5d37c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684759219, "uuid": "b46f1c21-0e4d-475a-b3c8-73e00a65d992", "comment": "Malware payload (Stealc)", "value": "d290493992e197995ee1bf5f12d16af24dd0a35c8e6e7e55a28f8fa425ad8e3adaa19aeed568b7258dd9fa17b4e0172a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684759219, "uuid": "e582384f-ec9f-4b86-80c1-5a2f354880df", "value": "T1D29623C57C8F81FBC5C528A1872B1ECB17F6566549C5C964BEC0340AEA32E73707B8A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684759219, "uuid": "4519b6aa-a211-47d4-b948-8d48b31502f5", "value": "c95fe71bb1921e8b227e790c40896544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684759219, "uuid": "3d1bc182-56b1-4d2e-859d-532fac886325", "value": "196608:w0HGPT5NMp19zesGfl7+aIRqwjnuvvqpoOXV+mMSt:hHGr5ip19zesGEjhjiiV+JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684759219, "uuid": "0be707bc-b53f-445e-8067-bad8705f9e45", "value": 8815432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684759219, "uuid": "2ca19423-d866-4890-925d-dea30f4723f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684759219, "uuid": "2c83d879-0636-498e-a5ee-9666ce44bf6c", "value": "af5b77e50d52155f52db90db3943ecb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bcbbb2-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738644, "uuid": "7d51e52e-47a5-4c28-a5c5-78d809f4f9ef", "comment": "Malware payload (RedLineStealer)", "value": "ae384126270a2afc3d1a8fd0dff68200", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738644, "uuid": "8135c276-d92b-4bee-9d41-2502d323963d", "comment": "Malware payload (RedLineStealer)", "value": "4c202d6f980b89e663372a0e45e61fa4dc878a385d95fc31aef3e9cfdacc3f3c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738644, "uuid": "fdfbc524-1aff-4d4c-bfa8-2a3fbf20f479", "comment": "Malware payload (RedLineStealer)", "value": "d86eb20f118a8791c3681b4216921944d7ef773d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738644, "uuid": "332f610f-6e96-49ca-9612-afae9a6b974d", "comment": "Malware payload (RedLineStealer)", "value": "3bef1cdb210ca677bf13f41be04e356da5dce20f19930f34118130cc4dcb72388a657b7b2a6de61e7e2111fdbbbea1d5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738644, "uuid": "b9bb14a6-8646-442f-8203-61c87f5ab1d4", "value": "T1162523837BD95072D8B1233448FB12D31F39FEA6AAA4426A3381C60A1D727D4B57537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738644, "uuid": "345c6b57-fc04-41cd-a9a4-b666a0f8757f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738644, "uuid": "c05c0267-ecc7-497a-b86f-5437c0442230", "value": "24576:Ey1UFcICP5pGnGcVIYoT5xs1xNDk7FAyaeM6G4T0qvG0Yxnt:T10cP7wGcVIlT5eDk5BaeM54T0qvG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738644, "uuid": "f961a57b-760b-4ea3-ada9-5350d029dd97", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738644, "uuid": "46e3e85d-54e9-4625-9577-905c9899d501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738644, "uuid": "97d5b555-fe26-430b-9be6-868f46dc9ee6", "value": "4c202d6f980b89e663372a0e45e61fa4dc878a385d95fc31aef3e9cfdacc3f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c778ec4-f893-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684754597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754597, "uuid": "028fd9af-aa9b-47c5-ba73-e981238ea055", "comment": "Malware payload (Mirai)", "value": "71d40ddf22aa91ff1b6492f869c854b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754597, "uuid": "b2e6e9fd-5010-459e-b042-835945c2f71b", "comment": "Malware payload (Mirai)", "value": "4c8e1cf5a4123751c8387b631f4d1891ef879807a0310d6cdac6c06727507c7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754597, "uuid": "6ed6b9ec-f698-41f7-b4d6-cf3d3e2c876f", "comment": "Malware payload (Mirai)", "value": "1860561c460ab432c91a6b2e87510508842dfd54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754597, "uuid": "765f41fa-2a7d-4172-974f-fcd6294499c7", "comment": "Malware payload (Mirai)", "value": "01ef80a65956699d32d42106bfc4cb6d311b117c5882f9a4cf7b43c2a7da89855974065b0ae586f42f5c213e3ce72267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754597, "uuid": "0e9472f4-3a31-4fae-9129-282ef8f41ee0", "value": "T1DFE34C46FA418A13C0D117B6FA9F41493322EBA4D3DB330699187FF83F86A9E0D57616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754597, "uuid": "c6c5b2e0-8602-4aa8-877b-72328a314144", "value": "3072:hncL+2FPNC4cCxJLbgFZcwH1NYLwKYOiTeODPM/9nrNbCep:hnepFp4FZcwH1N+wQgeOjM/9nBCep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684754597, "uuid": "fc2d0cc8-0caf-4297-915d-baf10323da7e", "value": 154300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684754597, "uuid": "86ef78ce-ffed-465d-ad30-602813762c3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754597, "uuid": "6ba466d7-7b02-4f4e-9cb3-0c0bf59045c9", "value": "71d40ddf22aa91ff1b6492f869c854b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8b2cfe-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684762865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762865, "uuid": "136bc752-54d1-44c6-bfeb-f472d4dc7f77", "comment": "Malware payload (AgentTesla)", "value": "e8484db9e64e947b261a107e9243e328", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762865, "uuid": "8a8cc2fa-c53d-47fd-84cd-ba642760aea1", "comment": "Malware payload (AgentTesla)", "value": "4cc2a7bf2672b3327d36308f08734646a395e6fd8b42b94dbfee04f8a3c4aa16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762865, "uuid": "6f65e791-814d-4c80-81c1-1edb3c30e1e2", "comment": "Malware payload (AgentTesla)", "value": "49b87fc3b6fe95da24e1c4a5d7924be13376c1fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762865, "uuid": "684e976f-cb57-46bc-8777-8c74c27b1793", "comment": "Malware payload (AgentTesla)", "value": "1e4a3ce6d2314ecaeada6e006a94c268a721510af2b95ef17b0c960d6c13ca33b1c82fa31059a64196af859bc82bf6fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762865, "uuid": "e3ad7591-ed30-4656-b459-9fc5f3ba6dc9", "value": "T11D629541AB35A532EB6C3B366CB30E9D527FA241E863E70E9BCE11493CC16AD04527B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762865, "uuid": "851c68db-0338-4c31-ba69-c128828655a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762865, "uuid": "16cb1732-896a-4663-bf23-0797832887d4", "value": "192:Wi4w6xKffffRG60IV7KZdp5LCT/7vEz59iv4y2X1y5kx:WivffffRrLgZdp5LCT/bENQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762865, "uuid": "d7a5a49c-3b24-47b7-825f-229b25e198f8", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762865, "uuid": "94e0498e-f0b9-4b26-a570-ef2e81135900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762865, "uuid": "a0153706-de6b-452b-8e3d-3c7c7139440d", "value": "PO-202308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7209c0-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747971, "uuid": "d285564d-6de0-454c-b4f4-c86bacf1840d", "comment": "Malware payload (RedLineStealer)", "value": "5e565e21cf72cb779768689b7ee3619a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747971, "uuid": "19e45fb3-8549-4420-83ab-6ac43dd39393", "comment": "Malware payload (RedLineStealer)", "value": "4ce0c3c3d44942da150caa7e5730545d95531e4f1152a427cd6a50e874a36195", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747971, "uuid": "e25adf80-497a-45ba-bbb9-ead3eea00e5e", "comment": "Malware payload (RedLineStealer)", "value": "ebe12d9bda9d2a8700b9f644033fe2f2a1d96d58", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747971, "uuid": "15a8f79d-744b-4f62-af8f-09a3ea52f665", "comment": "Malware payload (RedLineStealer)", "value": "6279363bb47257824c268b2d2fc796820990867905ab5d5c1e6245586b3ca7d40989ca7b53156eea6f654486bebcc3dc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747971, "uuid": "ff8ec75e-2d2d-4614-8ee6-289cb3573495", "value": "T1C6252313AAE550A3C9B5277058F707D31537BCF18E70837A6B4ADC0A18B26C9D0B5B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747971, "uuid": "f505c850-3196-4517-8406-b042bbd49d85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747971, "uuid": "866a2d2b-ad6f-4c35-b105-772ce0234ad5", "value": "24576:0yE59+MTmd64XML1vULeE28mHc+fg1/UTjt:DEbFT7AeD38m8+Y2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747971, "uuid": "43b08c81-317d-494e-8fa6-9ca637bd210e", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747971, "uuid": "791ac9de-96d6-4a7a-98d1-8d63e920b446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747971, "uuid": "f49e964e-0b34-49d9-9776-e9cf25b07be6", "value": "multiplayer904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d4c8e6-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752280, "uuid": "2fc0975a-4538-4603-9356-cb903ac34aeb", "comment": "Malware payload (RedLineStealer)", "value": "bb7490898f26d439611e93a9d943365b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752280, "uuid": "2593582a-4c4f-4a6d-a3a1-74459f2d8394", "comment": "Malware payload (RedLineStealer)", "value": "4daba0cdd0c2aa067a055a4d391621b3929dba0273e9cce312ae3cda3487031a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752280, "uuid": "bfa9a075-a0ce-4d24-a85f-0f98ed1ad848", "comment": "Malware payload (RedLineStealer)", "value": "6a19c7f0e712f5cfe2828b81582bb6fda0ed6b4e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752280, "uuid": "2daeed4d-1bd2-4dc7-aff8-ad4a238350a2", "comment": "Malware payload (RedLineStealer)", "value": "1824e5c120a4a4f88c2d985c78e408119a4e07ffbc41d40154be45fd825aff160e2c12f2b83ea1ad3a3ce5703288188b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752280, "uuid": "84a733aa-82d6-42ed-a683-96578cd28939", "value": "T1F6252353EBE84432EAE53B3419FE52972636BEA09D70931F27D6695F1DB20939030327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752280, "uuid": "4046f324-4492-40d9-a752-8d963dd5ad1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752280, "uuid": "c5e6ebdb-e666-43d3-b4dc-ac2b5bff1c0d", "value": "24576:NypUNTalr0/uoOcbqdvrn0J3s/z7ZuWJIi:owYrFllr0J347Zu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752280, "uuid": "29639f65-5cff-4738-8a63-8641a4bf4b0b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752280, "uuid": "38c0f905-9e65-44f0-aed0-431c9ffc081f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752280, "uuid": "535261ef-4579-4947-a9b5-27a92ffa050e", "value": "7463534466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a9d926-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752461, "uuid": "e5fb63c5-1419-4621-9579-c02985298aee", "comment": "Malware payload (Amadey)", "value": "851dc7dc74d0a507589ba4210362fc4c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752461, "uuid": "e26fdda8-8b6d-48a7-be97-f0fad779f345", "comment": "Malware payload (Amadey)", "value": "4ded283de4c4c1a3de683949f663c4827fe4aebc8fc956538e885a5aadf96626", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752461, "uuid": "22a6a3a6-a9ae-4d39-891c-f3ea2d024a8d", "comment": "Malware payload (Amadey)", "value": "e76e167067841e0e1b22d0ddc5307ddc5308ef3e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752461, "uuid": "b80b1960-de10-44f4-93d3-dff092a8ab12", "comment": "Malware payload (Amadey)", "value": "a18147d028809c28180e497d8739e1540c68bdebc6e04ba776791c1cfa30c5003be416e856097573223ec99891af694d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752461, "uuid": "6c8e590e-e855-4479-a6db-d644b22cccba", "value": "T15C252383BFC540B6EDB91BB401F342C70B39BC51197C866B179688AE4CF26A89931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752461, "uuid": "344e502e-536b-443c-9a3d-ec3c058ebb0f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752461, "uuid": "48f1b9d8-6ce0-42ff-8c14-9f07cb0e77c0", "value": "24576:kyKgcJ9D5Z1iIRY9sWHZtis1sxt+VfkYZkTCKpqh:ztc75Z1iwYbZtiBQVZmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752461, "uuid": "ecb153fe-8f85-4dc2-b9b7-71d1e8824e05", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752461, "uuid": "74e4e0ea-6be6-451c-b566-806695c0aeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752461, "uuid": "6556c7cc-2acc-4331-84b0-035894d2b440", "value": "installer467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca792ba-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752208, "uuid": "04511e86-2068-4c0c-a636-55e003f70ac9", "comment": "Malware payload (RedLineStealer)", "value": "e309b5a22626c6dd1f128396a5226593", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752208, "uuid": "02fc429c-b7ec-478c-9be5-443276c846bf", "comment": "Malware payload (RedLineStealer)", "value": "50ec93536645067bd875f82ccaa5f3cf82e1b67379200f5eb9391996baa862a9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752208, "uuid": "59a93922-b8de-4487-825c-eed0c3fe1a96", "comment": "Malware payload (RedLineStealer)", "value": "6d5c12b8ab319978a6e850ba702396f1c07125cb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752208, "uuid": "1a080493-762c-4694-82ed-89e1ab266d00", "comment": "Malware payload (RedLineStealer)", "value": "165dbea6b172535e4a390653bca932985ed946df877d764e46c19c6846938eb595dc1a32ec5cf0936e05d52e09b47bde", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752208, "uuid": "ceaa7ebc-b672-4722-8615-1ee892adec1f", "value": "T1AF252303BED89275DCE15B7088F751870A32BD715A78831B32477C4B2DB1A96A97233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752208, "uuid": "49a723b7-410b-481b-bef7-65043c7dd9eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752208, "uuid": "dc1179f8-d559-419d-a78d-33f0e288e513", "value": "24576:CypdQhBVD4GPgaD8himdTEpCnvmRhEyFndYIFGpMt:ppaB1RpCnshEyfFSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752208, "uuid": "021021d4-1732-455c-b352-074d9571f164", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752208, "uuid": "fbe6a8c1-191f-4a54-b3d7-292c50cea013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752208, "uuid": "fb3a67a7-b86e-4b6f-84fe-7c6762bdf42e", "value": "234433512578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b8db79-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684745266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745266, "uuid": "5d08c329-834f-4e5a-83ce-a790b5c81d73", "comment": "Malware payload (AveMariaRAT)", "value": "965bb03446e1938741459537988607e1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745266, "uuid": "14a5ca20-a67a-4eba-ae29-924c1d0dd717", "comment": "Malware payload (AveMariaRAT)", "value": "511770fdae6585f7a8bd8cd9f77b5f214744d0ff2ed418237a2fd18434deda7e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745266, "uuid": "7b238272-ed65-4019-9cce-15c4e9db6cca", "comment": "Malware payload (AveMariaRAT)", "value": "6d7b9a9e70ed14336c0373c09fbe37423731e116", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745266, "uuid": "493a01da-2d7d-433e-9993-2114e5c1108a", "comment": "Malware payload (AveMariaRAT)", "value": "54675cc1c368945703b3fa0e97cbda2b2e7597ee09b249a91155c98e62944753625550359cfe361c05c919d215cec304", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745266, "uuid": "235b7dd9-24b9-40e6-8312-45ee81d013c2", "value": "T1FA159F37B391D873D5A73536CC5A93B4A4A97E112D69AC4AEBE42C0C8F347413C2A2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745266, "uuid": "f75677e0-4297-4f0a-95cd-7c8d4ba4b9ab", "value": "38133f6236637d4df7998af089e91f7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745266, "uuid": "7d0be646-6f29-48dd-9347-65c2310c9b9a", "value": "12288:sN91ty1dhMo3EPTUAtGco4Cz096jU9qS/GkXDW2QbqcK6RhdBMueRVP/BN+5dH4:sN9vjo3EPI4o8EkXDC+c5uueLBAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745266, "uuid": "bc6f5102-dc08-4430-a56d-745b794db1fe", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745266, "uuid": "57ae0757-0257-4cdd-b578-3c2947c3989d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745266, "uuid": "fcf20618-07d0-4442-97aa-05aeea2a8b4c", "value": "Payee Advise HSBC874837489283 USD PAYMENT REMITA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0fde92-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752447, "uuid": "84fe4a01-ddbe-4716-bbb3-5cef7c4ec291", "comment": "Malware payload (RedLineStealer)", "value": "c71f8e80a609aab27801227ce46ff8c7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752447, "uuid": "295ac575-48ec-4515-b516-2b6ab5b8fe31", "comment": "Malware payload (RedLineStealer)", "value": "518449c58e0cd66cd67a02ba63323844f19f0da2ecfb4dd8799a97dc18dedd7b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752447, "uuid": "d25c9996-695b-4787-a6e4-50b0e8eec9fe", "comment": "Malware payload (RedLineStealer)", "value": "e6a106f062d29f7c92bc317808adbc7e91c3fdfb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752447, "uuid": "811ed761-680d-4143-bd27-02b2dc5a4ef4", "comment": "Malware payload (RedLineStealer)", "value": "189d4d515d7f0f215b8f48c6ead1fd6d2460f5d1e55c486c644b03efe8a97875030e82e6e7a278e0e80080b954f2fa61", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752447, "uuid": "95d59bf6-79f9-4544-af92-13bfef538ce8", "value": "T1E6252301A6F880A3D6A027B009F797971B323E929D74D37B67485C981CF25D1D93AB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752447, "uuid": "ee890068-4410-40ef-b35a-1ec9a8d647f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752447, "uuid": "b9af06e2-89fd-4bbc-a5a7-6209f2b962bc", "value": "24576:2yMxWrxOXm3mxjDHelv9iHH/8VhEmcOCym1k4Dhp42NqElH0exHi:F6WoXsW7kiHUOmcODm6EpLNqen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752447, "uuid": "ca814e1f-e726-4b22-8bee-0f9f4b3ef1c2", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752447, "uuid": "4ce0a8b8-e66a-4846-aff8-606759ec7013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752447, "uuid": "83e0f650-4b0a-487a-b08d-8ca35e1f161b", "value": "handler205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83cc173-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752362, "uuid": "d4d217d3-1c71-4314-957f-d1f5186fa64c", "comment": "Malware payload (RedLineStealer)", "value": "63484dcb3802c344f73702ae4da3a493", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752362, "uuid": "20d23a4b-54de-4583-8f4c-0c7cf397e855", "comment": "Malware payload (RedLineStealer)", "value": "519306c6392604767a3d21ef1a6ca85c683ff93d50b1d92336a6ba26100e8917", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752362, "uuid": "7ca6dfe1-aa54-4954-a1a3-cb4efcbc17d0", "comment": "Malware payload (RedLineStealer)", "value": "7164def3b073cc9586cfea1572cda22049886e6a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752362, "uuid": "058ef425-2bb7-4244-842a-2aa10350e0bc", "comment": "Malware payload (RedLineStealer)", "value": "6f7fe65982eb79c4f3490e5a07b6aeee37c2271e7166c7753a913083d1def3c44c1eef157916f81595b18bd42de22d75", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752362, "uuid": "6a59b481-de66-4428-835f-2bf6b15e8258", "value": "T1DF252343E6D98573D8F02B3019FB03871A367DA5EE79937F638A494A0C31A925D7036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752362, "uuid": "59400763-657b-415e-b492-4d18f8f69478", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752362, "uuid": "20583152-9d2e-40d8-a70f-6f7018f26a56", "value": "24576:GywN+qS0d6VlBz3g+/+MQNT9kZGrgaxpa8hXQHrEvA:Vwgx00l9/2T9vja8hXKEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752362, "uuid": "9fe28136-fd25-473d-80c8-ea54ffdba4b3", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752362, "uuid": "e90f4415-8199-4329-a02c-54288a9a633f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752362, "uuid": "632114cd-6e54-48f7-b4e4-07f7cf89935a", "value": "client374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b97d29-f864-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684734614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734614, "uuid": "f3316e9e-96b9-41b7-a7ee-694e3ed5b59a", "comment": "Malware payload (Loki)", "value": "a0a6631ad7930a9beca4ccb7ca63eb59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734614, "uuid": "c39e1d77-823f-4192-86a4-8a518eef2e99", "comment": "Malware payload (Loki)", "value": "52a13a4d61a25202abe50d85c42d4b3aac7e364af1100233c28cf06e4598882e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734614, "uuid": "663b7237-8714-41e1-9321-f4b63a577eab", "comment": "Malware payload (Loki)", "value": "5c8e8895f872ede22383cda6205c214cccea88fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734614, "uuid": "bf261cc6-e975-4d03-8db5-1d6fcd9debe9", "comment": "Malware payload (Loki)", "value": "854b6132b6f714666b343fae617ba5fe0e1f2381355957727957d73ba880526745b933499cd1cf819af3ada0688630e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734614, "uuid": "3036e54c-d78b-401b-997b-c35b6f107e1f", "value": "T19AD4E0C127D48D15F6AB4EB859A2E23442B96C55EF27C70E54F46C8B7C62B827B01BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734614, "uuid": "469860d0-9faa-401a-b313-c2cbee6787ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734614, "uuid": "a163a98f-7cd9-4f82-8537-c3fc93770a7d", "value": "12288:+T2x0YPX/NqPsHu6cNq8CoELD1Stux2yVigt3aPyX0:+TdHPsHu6Uq8CzLZmuXVIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734614, "uuid": "ed8a3ec4-412a-452a-b377-8f81e44efdfe", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734614, "uuid": "7904a956-ee07-42cd-9b88-9409a8b52ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734614, "uuid": "1de649bd-6594-43ea-be93-aff6dbcb1a78", "value": "9IWXnDXYqEwdoPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80da57ac-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684744913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744913, "uuid": "752659f0-0fca-46e4-ad94-5134299cdac2", "comment": "Malware payload (AgentTesla)", "value": "57fa123b174d8a962e1380323ff5941b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744913, "uuid": "4e79e40e-e58e-4d88-a2e1-9ba9f6f8d023", "comment": "Malware payload (AgentTesla)", "value": "5308690bb7b76b480c9fa8b8e1cca1449e477e5fb3d26ff5316819bf09710a33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744913, "uuid": "08c39ecf-92b8-4070-97e2-f081ac47982e", "comment": "Malware payload (AgentTesla)", "value": "541cdc7c2c792ab5de8a4d16e688e413c36c09b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744913, "uuid": "e337b82d-bca8-4328-b94c-b5bf0376da2c", "comment": "Malware payload (AgentTesla)", "value": "a7093264e349cec971e3fa4c3f66453ec7a92e60b8a9ed2e6a3ef3f6fb82ab2a87d7a9e94beb655e7088812617e16d25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744913, "uuid": "f955ee48-483d-4361-9c75-32142941aa5c", "value": "T1EF45F012D649AC8FC68107B16B4B7898621E7D32BAC85987370CB75F1FF3A65A913C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744913, "uuid": "da1aefc9-d45d-453c-91e5-7e2b2a41df54", "value": "24576:gLKO/mr/6QmQmz+MXUH+MXUIlYk5YuxoNXXXXXXXXXXDXUXXXXXXXSXXXXXXXXfg:gLK4Eq+MX0+MXVlYOoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744913, "uuid": "02e621f8-235b-4a15-aa26-12cf945384ae", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744913, "uuid": "9092a228-5855-45cb-9320-8b5f711ba62d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744913, "uuid": "1f10a4ab-0670-4593-a7e4-44e92d28b814", "value": "Updated SOA 210523.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a223c0-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684738645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738645, "uuid": "e00d4797-f142-47a4-b667-1754acabfbd7", "comment": "Malware payload (Stop)", "value": "12941ce2be73df35a3447d185ff8cab8", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738645, "uuid": "252f1926-408f-4bd6-a98a-4c512fa17f9b", "comment": "Malware payload (Stop)", "value": "53d982f8ac58cc4444b0c5b5ae383fc4ab040dca63e08f80b12ce2d93ae335ef", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738645, "uuid": "2cbdbb16-9d84-468d-a775-0d59d1adaded", "comment": "Malware payload (Stop)", "value": "5ce18f999490cb337d58f0b66bab98e8a67d6805", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738645, "uuid": "2f15bbd2-093e-4f1a-8bfd-ab232df10800", "comment": "Malware payload (Stop)", "value": "f8144e8697e281e16e897e06d52b0ba931cf7b4fd27d0544e2776b4a7b97d292e9fcea46713b50221bb431d6abe568c1", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738645, "uuid": "47bc68c2-1518-43e9-ba11-d2b7dbf65d60", "value": "T1B7F4123232D2C03AF19215705E62CBB58A17BCB25B758EDB7FA487390E646C1CA35727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738645, "uuid": "ee865697-daa0-43aa-b1ed-16e0e5139bc3", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738645, "uuid": "00191c8f-fe52-47ae-914c-6ad6fccd14b9", "value": "12288:C8TleVamIiA5W/AUELfHY9Qyo2ShiUcKbA7ilo30v2iOftK5:l+DIisUSHY+n2Shps765ehY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738645, "uuid": "1185d54e-59c2-4cb3-894c-d0cee271fb90", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738645, "uuid": "55b60708-c6f3-4918-86be-98de5d90339c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738645, "uuid": "69b967cc-4b51-4f41-9660-40243ac01663", "value": "53d982f8ac58cc4444b0c5b5ae383fc4ab040dca63e08f80b12ce2d93ae335ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ac62a1-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752351, "uuid": "4f391a89-65ab-402f-be86-4e7dc2f64270", "comment": "Malware payload (RedLineStealer)", "value": "5baa89b13006580aae27ba6fc50cadd5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752351, "uuid": "1d6fd05b-432d-45ff-8262-f54ba56b866f", "comment": "Malware payload (RedLineStealer)", "value": "54bc8c89d4540ba7d12d55a8e39272191160740547cc814478840ff3428c91c8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752351, "uuid": "a6244eb8-cf33-4c9a-90ae-3044c709f7af", "comment": "Malware payload (RedLineStealer)", "value": "bfdeb3518396ff5ed0d6c15348fec1f483289fd1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752351, "uuid": "16fdf5e6-d84a-4909-855d-11854f13230d", "comment": "Malware payload (RedLineStealer)", "value": "e8933532948090b35b6d8727d3d3584f1e9678d49f1458217e3dfacfe17dcabad3d7f2a1a1e165161a2cec8e9bff58f0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752351, "uuid": "2d763e85-3041-41a5-8c1a-66a44b5728c6", "value": "T121252343FAD54132D8752B7059F613830B377CE28E3A466F2A4A682648736D4B5B373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752351, "uuid": "812d6b98-d7e1-4e66-a182-7e4509d955db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752351, "uuid": "a1dbcbb9-bc2f-4995-a33a-0e95553c6e33", "value": "24576:pyH/2RXg4AsMuahZtMsF8lio0/J9QQdTvqoD:cf2tg4AlhZtXF8litcGvqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752351, "uuid": "eb6988ac-de8a-493f-a589-c902c289abbd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752351, "uuid": "ac3cb935-6731-4b7f-b9f1-da41e9fb6f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752351, "uuid": "2fa5426a-3e31-424f-b21c-ed8f63f42e3f", "value": "builder969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c166e18a-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684745451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745451, "uuid": "8cc71936-6946-4720-98c4-0916013b6d3b", "comment": "Malware payload (RemcosRAT)", "value": "0003d1ba464a73e5e2edac68bca85c8a", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745451, "uuid": "913d0ce0-c9af-4111-acd6-406790e7bc03", "comment": "Malware payload (RemcosRAT)", "value": "54c8ebc67873d058e17d1b0b405d298f3b7cedd6b9a245b753e34224fd82e805", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745451, "uuid": "19c4c31f-730c-406f-bdc2-ad93679095de", "comment": "Malware payload (RemcosRAT)", "value": "e4a0963099dbeaca85236becc6e0f06d07fca79e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745451, "uuid": "b59a0d63-babf-497e-98ac-7c413f55e6db", "comment": "Malware payload (RemcosRAT)", "value": "2467dedca6758017959de7922be0418ecab9ce2f9d3baada60144b158a27e338519f8d99eb18e0573cbafed538e4992d", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745451, "uuid": "006b82c5-c4f5-4e7c-9291-6dd0ed4d6d2d", "value": "T19684A051D1AD88C5F3A1BB02DB68A3AA2757FE94663C4B494FE0C9783BDDC028651373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745451, "uuid": "f66d2adb-8dec-4514-8255-187e063e380b", "value": "1536:9Hmd+CKN/SoY+oYFt6C2SG+m3y3OnZ8H0RRDkYbgd/awGhymVfvExag+mA5KpJqu:9Hmxw/kYF/DxdmUjjjD8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745451, "uuid": "c5a483f1-22ee-4429-a012-07834ec37ed5", "value": 403764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745451, "uuid": "eeef64bb-38f1-441f-98cf-d29ed87951b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745451, "uuid": "fff02301-e8ce-4dfd-ae9f-823171c21535", "value": "Invoice_Shipping Documents_20230519.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8c492c-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755910, "uuid": "72008ebe-6c68-4e07-bcfd-8927fbbc0725", "comment": "Malware payload", "value": "bc0d0f6d6f4ed09303a2b368eda925ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755910, "uuid": "963aa1de-96ff-4dd3-9ade-95675081c664", "comment": "Malware payload", "value": "55929105fb21b9aafb5ec5f1e80696e9a69cd4830ad9e1ffce9cae0df60500b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755910, "uuid": "55b8df26-e640-4b0e-a340-e01dd9f05196", "comment": "Malware payload", "value": "143ffd2f12f90fd9f762cbafd9bb40ea9ec5df9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755910, "uuid": "c28474ad-6184-4347-a7c1-cbeb4faf4bd6", "comment": "Malware payload", "value": "f072b3b57ae8aef97406072119baab9afde1d0e2a61a965ee91782e46eaa31ac342b95bc18f7b2f2147aaea3e1875d47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755910, "uuid": "6ec6728b-c5c3-492c-b8bb-08a9f4e83bbd", "value": "T16F434B61EAA0C072C112D9F88E1EE362FB3A76542A2F75C273DE1FCCDE26751592D442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755910, "uuid": "24d82d0e-95bd-41cb-88e2-e8734795dd56", "value": "384:L1cNNjBrCzBccReX6WeZ917CM8hShwyCjwGqPbPwRN+9uZ098rGgjUydcZ/CsqS0:+czBccnZPgswz7QbPj9uOyy3/qsqSxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755910, "uuid": "deb78314-8274-4664-906c-bb9b3964eae5", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755910, "uuid": "84ccb1a7-1406-48fb-8c58-1ff93998b056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755910, "uuid": "565af752-6031-40bb-9b27-deba9f9827d0", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.2436.1391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ee9f1e-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684779602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779602, "uuid": "fe71dd94-7deb-401a-b9f2-37eac220393c", "comment": "Malware payload (WSHRAT)", "value": "36c7ea69a51fdcb7eb3b66eafbbcf516", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779602, "uuid": "367c5b47-7ba7-4aea-b382-7c41a8071698", "comment": "Malware payload (WSHRAT)", "value": "5684eaf9be940a6d7c5a559182c8d54b46151de46c72b60bf1c1112e2aeb9e4b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779602, "uuid": "87dbfbf4-1090-488e-8ed8-a66f2477334e", "comment": "Malware payload (WSHRAT)", "value": "8a81452869a67d8abfe5f2165b3475286274139e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779602, "uuid": "4eb93974-955b-47a7-977f-bc041f738cce", "comment": "Malware payload (WSHRAT)", "value": "4af549128ec9d7952e52c244f192be56c096ece0429bcef03fda7eb86097ff3b4fd479a5f9c5b7c6159f65d653231b2c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779602, "uuid": "01ebb11d-c956-4eed-a8d3-61a966d17460", "value": "T1F614DF546FC0985E03C79BB73527F685C292286B39818CC7D244BC677925B23EEE2933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779602, "uuid": "5cfda1b1-b810-4d49-893e-8b87b71c98f2", "value": "3072:nrVZAmAl1luVkQS7bURCwbIpklgVDSxGfmuZrvEzs8ZPr+eGK/68Q0bamqg:rVZAmAl1luVkQS8RCuAklgF2GuuZTXe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779602, "uuid": "4679e36f-e5ea-4778-99f6-5bbeb06900fc", "value": 192498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779602, "uuid": "076faea8-785b-46af-9f6b-87dafb14f6a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779602, "uuid": "36bc0546-60b8-4181-8478-e8823311489e", "value": "00912938pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f61053-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684745326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745326, "uuid": "72b1844a-7726-4626-b65b-4406b2c5f86e", "comment": "Malware payload", "value": "1740ed5f159055a371e8bd846c9b6336", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745326, "uuid": "252c793f-ae0b-4128-88bb-628949acbbff", "comment": "Malware payload", "value": "56c693eff2ffc05956d6fa80a640a2628b831e1021d0ee408b46518d0b63e0c2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745326, "uuid": "c3e46e67-5ac6-47b5-a76e-287f275143c1", "comment": "Malware payload", "value": "af04b0d39704ca0ed9469ff893e3be753689d66f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745326, "uuid": "786bccd0-3ab8-4717-987e-52a65ea7ac01", "comment": "Malware payload", "value": "39462503d78b7304ddd41c995fa25d57c894328c3348f5453dd6b4dabf27823bdadc688ef4e8b19221d326fa399f0cf7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745326, "uuid": "7effd1c3-0b43-4d60-b8e3-ed18084b3283", "value": "T1E61161F693261E7ED4BA03B5DC366D1C58BACC720F4E909DE52BB084C8385951F81718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745326, "uuid": "6f5f5018-6b8c-4579-8c5a-d2322097907b", "value": "24:8loGDFMxQDfZoBTfK5a8l40uia0JSaRa9xNb:8loGFMQDsTfK5a45avaR4Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745326, "uuid": "4b027f4d-f3a6-4677-8ee8-c7f0c50e2a30", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745326, "uuid": "eae1c3da-ccaf-48c1-9721-a3e1fbbb0dfa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745326, "uuid": "5e6f285f-a1d1-4a26-9524-6f0d6aac61ce", "value": "008834808295199.818548.34085.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b65c6c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752357, "uuid": "2a4a851d-d2e0-473c-a288-14b72abddf2e", "comment": "Malware payload (RedLineStealer)", "value": "dcf99bfad29174577f613c7f127edab6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752357, "uuid": "8c0398e4-6b73-49dc-a87b-18144494eb85", "comment": "Malware payload (RedLineStealer)", "value": "570e630879774f79c616aa7e328b309a7217d61573b53d20a35dc8cf062f593b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752357, "uuid": "a19df24f-d0d7-4195-b6f7-6aac7139c28f", "comment": "Malware payload (RedLineStealer)", "value": "58504158932908cd30209b469a9b7850be41d4ce", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752357, "uuid": "c34fef7a-29af-4289-8c99-e908b5ccb62d", "comment": "Malware payload (RedLineStealer)", "value": "82713407d3fa554fa9341dd22634aac62041d9404f6079944e04cb1874c835b374ee1a4a20bcd8250c5d0f8f2361ca3d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752357, "uuid": "10a98779-4845-4f13-a15a-01e0f75f90f9", "value": "T19F252356F3E86473D4EA13B409F512C3093ABCA49E78522B67C89A5F2CF3588E53531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752357, "uuid": "4ea99451-c60c-4676-a02c-e497569e0be6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752357, "uuid": "695ee35e-e4fa-4055-b19e-2af2b5c0cb53", "value": "24576:RyI1iTJ2Us7HkA/y5QiRlosCtK8wpvWtHlLgiwcRh9qS:EI1iXIHghascK54XLNbRnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752357, "uuid": "9e007cfc-ffae-47e4-b78d-be7d20722a8b", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752357, "uuid": "2e0e0eb8-6957-4a62-aae2-3302b98bc5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752357, "uuid": "ce636d25-1b6d-4128-ae89-3f4637710347", "value": "changer174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de4c67f-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752505, "uuid": "e117f291-6369-4db2-b8e4-1d24b8f70b97", "comment": "Malware payload (RedLineStealer)", "value": "dd0f6b012dce32fee4ecb684bc913ab5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752505, "uuid": "cbfd17dd-6acf-4f81-b516-7f20ec6a5e38", "comment": "Malware payload (RedLineStealer)", "value": "573d641634954f699e8deac456191c2b034c6d2654d30c54150539c3c96ce0a0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752505, "uuid": "02a6d2de-e606-441d-ba80-945192ce57fb", "comment": "Malware payload (RedLineStealer)", "value": "2a5d12f9678daf92405ab25d3fc762396deb3e2b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752505, "uuid": "2a7edd3c-4131-4460-ace9-422d5caca27d", "comment": "Malware payload (RedLineStealer)", "value": "764ed31c3ba9250142c2674f52d1522626b535d26d0e899ba6eb2c995e363da57e9755dadc290f85ff9686836808420f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752505, "uuid": "0a210e18-36f6-4fef-adc4-0af8930ce1dc", "value": "T1E0252307BFF88136D83477B099FA46E30F377CA2993D42273351A96B4C62A958971327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752505, "uuid": "2bd7c301-a9bc-4e47-aeb7-a107543e7cea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752505, "uuid": "d9a8c486-4e3d-4dd2-b90d-7fba481a435d", "value": "24576:ayCeWNyrZeZrq16KR+NMkKgVxG8T6+mXRJiPrPpfCyMMTKkHjtF9:hCeosYrqz4NP9VE89gw02TKkH5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752505, "uuid": "4b7cfb92-9405-4b8e-a452-3d67d6d506ce", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752505, "uuid": "aeda4716-4567-4228-bc35-bc4da909c744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752505, "uuid": "e46b43f7-9054-4a12-a764-7291f7f1fdfa", "value": "notifier591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a304b82-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752499, "uuid": "c49f2e67-8507-4adf-9df8-b8fb3f81a9d9", "comment": "Malware payload (RedLineStealer)", "value": "32ad8aa992f597eb0fc161af1f4a86a1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752499, "uuid": "1f4c6245-15cc-4cdf-b408-5935d9d59ba9", "comment": "Malware payload (RedLineStealer)", "value": "573f81411b86dfffea736481ce049ebd7693c3c4e6d188dbb7b406f84579fb9b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752499, "uuid": "d6711b91-531d-4050-b59b-b08a1fbb42fe", "comment": "Malware payload (RedLineStealer)", "value": "0499191e9d82c5f7de3b9561cd396b8367352d6c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752499, "uuid": "ca14a178-8509-408a-9c08-df0954b7d1d1", "comment": "Malware payload (RedLineStealer)", "value": "3cbcf84f042b337e074b2165a634603278b509c8de1ecd97bc54716bebdab1a0df5fe629c0220c25dbf00ae48b1d1174", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752499, "uuid": "92ecfe66-8690-40ae-aa32-a94897f75a41", "value": "T18C25225A63EA65B2DCB42B311CF742C30F75FCA18D35538E7385AD1A1973AA0B9B1312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752499, "uuid": "d2b9cf37-28b7-4c8d-95e0-7fe6a30af48a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752499, "uuid": "bd0e7ebe-635e-4405-a343-455e2783603b", "value": "12288:XMrpy90Q6w40kC/dMzcrDteVKbRqlRocaBNUKOqz7gNuxWHk50yOm+AuTfTBy8yX:uy1OwdMzcvteVAqkJwAMHscAvLXCJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752499, "uuid": "d48be317-a9f6-4639-8a4d-f993889ff14f", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752499, "uuid": "42224bd9-3f38-4719-929f-e2a12bf6d855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752499, "uuid": "9f128345-8ae5-4009-bfca-2add42b26cca", "value": "networking691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb9d72f-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752206, "uuid": "6840b561-5df2-4538-8aac-69429bf7bb86", "comment": "Malware payload (Amadey)", "value": "d1ee262747043106a6ec45f37ba6f20f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752206, "uuid": "24fad8dd-8e56-48d8-b716-a378f432dab1", "comment": "Malware payload (Amadey)", "value": "57b64f0b5e2c8f8aa1144fac018a9d82d2f4ac1344329392551cc093b8b675f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752206, "uuid": "cb89cea5-a937-4f94-85d1-df657e58e192", "comment": "Malware payload (Amadey)", "value": "ce2ea564564b757a1c94d3d7e2710191c6274100", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752206, "uuid": "ec0d45f3-2aa8-41e3-a46e-5fafc1573af1", "comment": "Malware payload (Amadey)", "value": "a655c1f82d76895e2631450402e4dd1c1f5ac95ac76496c1a4373d084526184dcf5e824fe985b5a3fc864f21a7000c68", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752206, "uuid": "57c5b390-9184-4a59-a0b0-c6b5b422f0bb", "value": "T17D252302A3D460B3E93467786DF2028B27777DBA4668919F3745A41A1C333C6B5B273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752206, "uuid": "0254511a-4bc3-4844-a96d-1261b72bc46e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752206, "uuid": "d4922951-e415-4fd7-9dff-cb1dd0c4228e", "value": "24576:Fy1ydAHCoXjXHYzdXQ/MEjG1T+p6MT83426i:g1ydbsHYhWMEjG1TyIof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752206, "uuid": "bb8c7f72-0b0e-441e-b35d-01dc06e0dd5e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752206, "uuid": "f72c7473-9d03-4b5a-83fe-4c9c29099edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752206, "uuid": "f35b7e39-0e9d-457a-966b-21c463334abe", "value": "234433512273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed6bc5f-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747863, "uuid": "7e023fc9-a6b5-4b1c-9f7b-2920045152e9", "comment": "Malware payload (RedLineStealer)", "value": "d7fb42e27cd506d82ceda415b7828eff", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747863, "uuid": "d3c18b3f-f899-45a5-bb17-10dbe5464832", "comment": "Malware payload (RedLineStealer)", "value": "57eff1f2857679474a4b4da33535dbe9cc9872553d1ab1268a42d1030a865fad", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747863, "uuid": "bfb19635-ca64-4e03-92b0-54be06f70f64", "comment": "Malware payload (RedLineStealer)", "value": "eba7e10f2d3e2f683f4a5cfeb9cbf8b009fea04a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747863, "uuid": "a42664ff-a229-483f-b31c-607849212606", "comment": "Malware payload (RedLineStealer)", "value": "50b73256580fb0ff6693e2bb682dfe41043fbd4b6b258dfeed55442dc37fd0ed1c52dc4749742da4167bb061d89636a6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747863, "uuid": "148afe32-c0d1-435b-9e22-d4b3787c53ab", "value": "T1F1E3D624379F8930E6BB4D3D6CB09CC076BCAC126552D74A4ECDF1593A73B809B216B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747863, "uuid": "e6a966c8-cf9a-44e8-b31b-ce4712511829", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747863, "uuid": "22d027ac-d96e-433d-9477-1df6d6c650a4", "value": "1536:o2BGlTP+mZP61sEYDmRSNIgcscLDuRwH77+u8oxQKHbuxGBNM740wuei/Qv+R+Fn:6V+m5cvQmRSN90+82iTi74h9ZF8e8hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747863, "uuid": "841583c6-06a3-4bb0-9e5b-a91c7978b2bd", "value": 148927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747863, "uuid": "0e045f70-b284-4a6f-8c3e-5d48a15f0808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747863, "uuid": "c59d830f-28ff-4d51-9d78-a62813143adc", "value": "bils692.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ac193c-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752491, "uuid": "4d87ca34-14e2-4122-8553-d4a3bad8ef89", "comment": "Malware payload (RedLineStealer)", "value": "9cf9e169cbdde17fc7dfcc0596711f09", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752491, "uuid": "67896a35-df9e-4925-ade9-ce2399d0daa2", "comment": "Malware payload (RedLineStealer)", "value": "581ca095c526d9129000fc65b436d202f3e8f7f8b79beba8d3cdc48bd0d5c602", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752491, "uuid": "b5aebbcc-6eef-4a84-a075-6043dd10440d", "comment": "Malware payload (RedLineStealer)", "value": "0f1b68255553d523ad840a6e7c5f31e3a8051d4d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752491, "uuid": "1b2137ee-dfe4-4a65-b3a5-e406dbff31cb", "comment": "Malware payload (RedLineStealer)", "value": "bfed249bce03071af877069d7ed8cd28d57a00aa0f9fdc43b9350dccf5c424495f238b93fa642c79ba7b496e83c257bb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752491, "uuid": "2914f003-5b53-4587-8470-bd9d49a805a3", "value": "T164252353D6E480F2D8746B305CFA03530B36FE904AB9A76B2389591D0CB37E4A476767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752491, "uuid": "1def7ca7-e767-4ccf-805d-bedf976cf769", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752491, "uuid": "ce29f34a-c9e0-46f2-9a4f-cbaf2b45cb38", "value": "24576:eymOjKpPLUJUNCSq6NsuqWN+xz7TIxSifL5yRNbowkx:tmOjKFUxSq6N7NYzMSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752491, "uuid": "cade1b7f-7561-4cc7-a69b-6601c6194e74", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752491, "uuid": "4b480df9-0248-47e9-b11d-7d67a86b3797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752491, "uuid": "6c16c89e-12ef-4649-89df-893da87d6e61", "value": "mapper904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e45168-f834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684713861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713861, "uuid": "728fdcb5-65aa-48df-8086-3591919cccb6", "comment": "Malware payload (njrat)", "value": "0db630f90a9516a937ed58fda9a6d7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713861, "uuid": "9446c71a-0834-47b1-aeb5-61631c3dacf4", "comment": "Malware payload (njrat)", "value": "588e95a3bace19c25bdfba25fdd7bf833d681f0932f15ac7013cd9c9a405737a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713861, "uuid": "c1dda679-42fb-4bc5-9442-ea8ba80669cc", "comment": "Malware payload (njrat)", "value": "a8449eef4b11a2192fcf679c6c8e058a07d60ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713861, "uuid": "5aa71544-bb26-47ed-9eaa-29b84a8acd48", "comment": "Malware payload (njrat)", "value": "04fb876180443f1d60ae61e88fb72a3b3aac5e95a698e25c8a46dd2cc4ef80ccf43c2d9c8d8a3b89230679a4555e9532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713861, "uuid": "daa3e084-be52-4434-b7a2-22112da2f2f8", "value": "T1F7E208467BE58219C6BC6AFC9CB313110772E3438532EB6F5CDC48DA4BA76D04641EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713861, "uuid": "7b1759c8-a3df-4198-be2a-f56ec5c2c846", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713861, "uuid": "172e0617-d7ec-4df5-b78a-34e8e0d81edc", "value": "384:A0bUe5XB4e0X3OxWANuiEO0YajWTItTUFQqzF3Obbw:lT9Bu+oguiEYaJbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684713861, "uuid": "74b15e53-e4ad-4a5e-b3ff-23d4eee07d57", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684713861, "uuid": "6239615d-84be-4850-b925-d91fb6b218e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713861, "uuid": "b054f2b2-f550-44d9-8fd3-2080f3a529ec", "value": "xFvfnVhCID1h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac9db51-f83e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1684718409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684718409, "uuid": "81b8acfc-2eaf-4adc-9b79-a01e76525bc0", "comment": "Malware payload (RecordBreaker)", "value": "a494e9ff391db7deac7ad21cadf45cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684718409, "uuid": "b9848bf0-54e6-40b2-b7a8-58fd1d4dfa40", "comment": "Malware payload (RecordBreaker)", "value": "58ff02258749716f030394daa1577b359684159ee33263cc7ac73945f108925a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684718409, "uuid": "625fac43-f9c5-44ac-b49c-b91cbf49187d", "comment": "Malware payload (RecordBreaker)", "value": "881ce85775cb4283ba9acc0f58f9fcfd477b28be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684718409, "uuid": "1eb13164-4de0-4a38-a0b6-c6139ccfbc8c", "comment": "Malware payload (RecordBreaker)", "value": "31d1ec8b3c0effac13610894d69d55cc5036208b3253f2a5d4e2cc55db7ea6daaac312b0894914ec09c328ee413a7803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684718409, "uuid": "9de16923-0315-47d4-a944-7c95eea3fd20", "value": "T1D8672397A6D5A1D4C7C306B463C551CA27C0E4FE95FE85683ECB4C036860EAB498DEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684718409, "uuid": "e094f9c1-3ba9-4435-8c77-af8a6595a45c", "value": "ffd0fa11d62a03aa3299c02a14b1bf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684718409, "uuid": "d0482347-5246-4371-8afb-cc33864d4699", "value": "393216:g2t8beUamPDDeLUt2/URvCdes2DJgTPI+ua6egb0WTbFW/cRaGFdG25B6J2xAtWQ:lwdveLteCINJSg+uSwF2257mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684718409, "uuid": "a34d248f-f607-413c-9de0-431ec076f8f7", "value": 30582464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684718409, "uuid": "cb123d1d-d73f-4558-9677-ad2be16f48d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684718409, "uuid": "84593889-f92f-4564-9ec1-5d77e9911549", "value": "a494e9ff391db7deac7ad21cadf45cca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9386639-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738646, "uuid": "ef725676-f7c1-4750-893a-7c2160d3f542", "comment": "Malware payload (RedLineStealer)", "value": "0127afc464c5230c7ca13f46c1f8ff2e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738646, "uuid": "9b07c27d-ee1f-45a3-893a-febbc8fabe50", "comment": "Malware payload (RedLineStealer)", "value": "59da8ea8579182626fa244c82848ca9856f15fe8b07a1a63546a423ae90784d7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738646, "uuid": "b1619893-8de2-419d-8f58-e0520c9132cd", "comment": "Malware payload (RedLineStealer)", "value": "9cf7409e394202be8e4aa5bcd18e40a09c648893", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738646, "uuid": "c807101e-f456-488d-96b3-2e6fd9b844c8", "comment": "Malware payload (RedLineStealer)", "value": "7c421544d448cdc496de7f0cf1441365e6f88a85f26cdbcdfeb151247458cb7b542b8e14a4aa841a198f952ad405e954", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738646, "uuid": "4007dc69-224a-4999-b00d-09617071d31e", "value": "T13D252307E7C98867C5B517F01CFB12930B367DA28A65826D3B06ACAF5C733949972327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738646, "uuid": "b3c7a327-e584-4ddf-a5af-cb7da9745c58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738646, "uuid": "07303f02-0a02-4f13-8533-7f24a418ed90", "value": "24576:ByVUNBhCKN+jGsm8hMGvyQK8lCtC3MYKgLNJTqT1bI:0MmKKjv7Zh3TS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738646, "uuid": "1e294ed1-c201-426e-b518-5e58e5ccf62b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738646, "uuid": "7aca6ce3-f385-4f14-bec5-f1010f0ba99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738646, "uuid": "80afe75e-7d21-470d-b596-d283483aab96", "value": "59da8ea8579182626fa244c82848ca9856f15fe8b07a1a63546a423ae90784d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b9b04b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752349, "uuid": "70fc1c86-3a0d-487c-9ffa-335546f5d05c", "comment": "Malware payload (Amadey)", "value": "13f470f2d683f93ecd79b93a02b8d413", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752349, "uuid": "9603d548-773b-47bf-a29e-8235d9412ecf", "comment": "Malware payload (Amadey)", "value": "59f57f4327e099361af0c183ca54e0fbbbd637ca846ec76ba75f7f8281459a84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752349, "uuid": "091187d0-2ab7-4648-ba65-ba07905ab506", "comment": "Malware payload (Amadey)", "value": "1eda7bafd9363fa5983f53e15575a6b31756ee95", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752349, "uuid": "9792bbd9-1058-4faf-9ce0-6c2ff7958ce5", "comment": "Malware payload (Amadey)", "value": "269c323c536a66a5359d259134deb47a147eb8a21898b721c1b8d2230c1fb8b094ef170b472861b1ceaba5d417ae0d6b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752349, "uuid": "a60e3e53-41b6-451d-80bb-356788e497d2", "value": "T13925220AB3E4917ACCF567B42CF702A35F31BCA64D78877A26865A695C33190D83077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752349, "uuid": "78a038fe-1cc3-4c6f-843f-4cb6a8843ec0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752349, "uuid": "a75c0cf6-ec56-47ff-84eb-2abe6e33a70e", "value": "24576:zy3UFk3upc9Rj9WbxV6bJdpk6Y9b56l0PNohd/d:Gkkupc42bJHxY9YliNSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752349, "uuid": "44f1631d-ca56-4dc1-84b6-e776fb79918c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752349, "uuid": "5c6998f4-5244-47dc-abe0-821c1c94f4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752349, "uuid": "0bcd9c0e-873c-4c34-aacf-a452370a04ee", "value": "builder621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaa7749-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751936, "uuid": "cab62c06-5631-4bd9-b75f-5995083fd6d6", "comment": "Malware payload (Amadey)", "value": "7b4a8081d774805b1f06a410d2692026", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751936, "uuid": "f86a3583-1972-4cf2-930e-fb648234cb76", "comment": "Malware payload (Amadey)", "value": "5aa31b45d83702ad8523321f094d643b5505effbd19434920c48f8ced28b5982", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751936, "uuid": "ae7210fa-f4dd-436f-87d2-64db05086f63", "comment": "Malware payload (Amadey)", "value": "a0f1bb8284e410d26404911261577e8c4c3d9d0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751936, "uuid": "939839d8-4124-420b-b372-d3c799e05351", "comment": "Malware payload (Amadey)", "value": "55d2a1a463f0ecdc6b71a09bb2869460d5b5b6ed1a7b8da091dd6175c4d79038c3ce39f6399ed4084398a6a5fbaa0956", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751936, "uuid": "df3bc10b-307b-4102-94ee-4a34242f46a5", "value": "T18E252342B7E99032D8711BB0ACF702932A397C96EC7CC36B2660ED5F5CB2582157573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751936, "uuid": "0d69736e-ec18-4079-bf1b-58796523db23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751936, "uuid": "04963b08-47cb-478e-8837-431b1461911e", "value": "24576:lyGSDLkzCgh33EaeE/VaqDrlMV+xUOthA+bo:AVUb1UaeEsOthA+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751936, "uuid": "d13cddb2-c5f5-4222-a3b6-0a164a9f8057", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751936, "uuid": "cce7373b-fe01-4e94-80fb-903ab5f79d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751936, "uuid": "c5bd34d9-9f3d-426f-aa6d-d4c07a18875f", "value": "game902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe303e9-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752482, "uuid": "c08532a3-c860-4b0c-93ce-71e6d3d9f623", "comment": "Malware payload (RedLineStealer)", "value": "90334089f4abf4dbec8919e4855b9e11", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752482, "uuid": "9c5fa507-a36f-4718-9578-fb809fc41f75", "comment": "Malware payload (RedLineStealer)", "value": "5afab200f94b9169f98acda9e0613b3f0c347ef586487ee6972caf762c233771", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752482, "uuid": "4c2ec260-b8d8-4595-a1cf-b78627c4bc69", "comment": "Malware payload (RedLineStealer)", "value": "9a4373e202f98ef05c659fa7a020b86e931b9ce9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752482, "uuid": "4b985e00-f0e1-4e05-8009-bef5842aad8e", "comment": "Malware payload (RedLineStealer)", "value": "67958c55f90c14e48bbfdaf2c1f2b449c78437f52a6dfb6f3bb1b2c5b75415ad6b752940c17f35ee971eac4dd1978d2b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752482, "uuid": "3b51f076-bf7c-492f-9aec-d85ceff64b18", "value": "T18E252326EAF84673CCF50BB01CF613830F357CE18A75825F2796A94F18B2A94957532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752482, "uuid": "24bb94db-22a4-4c65-a574-65e1e1a85ebd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752482, "uuid": "900f8068-7f61-4541-b9b4-811c8c1cf374", "value": "24576:HyVbqwAvV/xQZnMcLCaQLvaZvG3KRsYdv/nVD/D:SUwA0ZnFMuZPRsYdXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752482, "uuid": "0a020fb8-44a3-4b36-9f6f-245ad079ce30", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752482, "uuid": "1c47a179-1fa3-4a8c-affd-d3eb9a2333bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752482, "uuid": "36accc72-3b14-497d-9f48-7b8bf1672e08", "value": "loader433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1d2df2-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752366, "uuid": "2d171f9b-a8a1-4ba5-8b38-defaefc50a12", "comment": "Malware payload (RedLineStealer)", "value": "1fc5f7bc8e7ec47b4e74382ab3fad8a8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752366, "uuid": "9db0052e-d46b-4051-b6ae-fd39107cb6d1", "comment": "Malware payload (RedLineStealer)", "value": "5b2b4ffd9137ad264b50108c1dc55c900efaa2b789a6f7778a9f19408090d170", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752366, "uuid": "1d00d24e-3758-4c3c-9f50-3e93d1008ac8", "comment": "Malware payload (RedLineStealer)", "value": "62a732595f5b1889233fe1a79a251b4819206df8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752366, "uuid": "26fe6b12-ae32-4400-a088-952365b81927", "comment": "Malware payload (RedLineStealer)", "value": "6b52593390e8481455a7644f6bce710cef05c5544d60a37f88a98a1a0aadf3ead3d5bdb0fa87f78a2f0130c633b6ecd9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752366, "uuid": "9e31180f-c5a3-48cf-b367-6aec890f01c6", "value": "T15F25220623D85073F9A5377429F703870E3BBDE08C31C25F2356A95B6A72698A47637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752366, "uuid": "591d478d-781d-4dc0-a7b5-0c09c8d0dbd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752366, "uuid": "51cabdc4-7d00-4f1e-bbc5-4d1ffc5cad44", "value": "24576:XykYch+iHf8kiX7qORy7hUO6bsAUiTjlH/xE7VfmIBbke:ikYwHj07qOT/rUklJqfHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752366, "uuid": "4865b3c6-7a33-4b0f-bf97-40cd8aeedb52", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752366, "uuid": "2dfc71b4-6aa2-4b61-8232-8f5fa732fd1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752366, "uuid": "bed72322-375d-45c1-97a4-d9934b92ffd4", "value": "client739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2722a7b-f8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684788376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788376, "uuid": "a56212f6-6438-4195-bebc-16e3ff0fd8d1", "comment": "Malware payload", "value": "699e657c4fa3284c3c87bdf19fa36cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788376, "uuid": "ce2d8aeb-2bc8-4212-968d-f1e3b06d3414", "comment": "Malware payload", "value": "5b3c365cffe1afef52d38aa90267929d0f4f485241d377ee47dadf9eba63ebe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788376, "uuid": "4366faa7-7b51-43ad-a667-8c1690c284fc", "comment": "Malware payload", "value": "fa950f48df0ef532239443b6a290b35cab75fd3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788376, "uuid": "20878bb0-d633-4990-974c-8eae341fe74c", "comment": "Malware payload", "value": "953e8107693de2407b1c8528774fc78014d4bc9ce2177098f4ada99597a553c28d06faae823a60d6cebd511f96fe5d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788376, "uuid": "c3a840ca-2d5f-4f44-ab94-5cd0d3ac1b99", "value": "T1E064A1C9FBB5AA25C184F7324119842E05218BB73DE2C68A24F8156E1FD26CF2F57F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788376, "uuid": "8f4b9058-7d55-4ca8-8c6b-30d7ab1b18cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788376, "uuid": "db9718c5-8a74-4202-8a2f-13db29ee0c19", "value": "6144:WPLdBmvke5dEtvHVcT6MXUKUNBOA4gygC/jwjrC4a/NF1IPP:oB7pUEnHSgCMG/NF1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684788376, "uuid": "02e2d57f-6fcb-4834-ae2d-d9a98c2f44e5", "value": 313448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684788376, "uuid": "fa2ed559-148f-4707-a1e9-e432f602c0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788376, "uuid": "a3f6eecc-2445-4a2e-ba1f-78c3fdd829eb", "value": "garagula.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ce9199-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738647, "uuid": "6896ced7-2793-4088-8104-ce31c3c74eef", "comment": "Malware payload (Amadey)", "value": "1efeeadcdbf8b071f2e155cc8cb0a362", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738647, "uuid": "5bef2e60-1a7c-435e-8728-ead1073d5f8f", "comment": "Malware payload (Amadey)", "value": "5c779abb583e74090cc3c892f3f4e602a025fc3fcea9b11540c25cf364b9b39d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738647, "uuid": "3c60bc45-2b86-4505-b120-ef3e1ab02efa", "comment": "Malware payload (Amadey)", "value": "3b7fc2a42f121d46e59857952a08d6f368ae0f7c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738647, "uuid": "8686122a-f8cd-4559-bc27-c79617363aa3", "comment": "Malware payload (Amadey)", "value": "b27f52a2705b5f909bbfb6bde6adf37123224f7caf767914a3398dd950bf78dfb1fe71c7e4a72025e450b9642193dfbe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738647, "uuid": "30eaf361-b5b4-4e7f-b235-bf066e117e83", "value": "T1D8252326B2C85076CAB42BB019F626C71B367CF19975532E2385E81E4CB3455A8B633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738647, "uuid": "ce9d6400-2f7b-4b52-a61c-3139cdaa7fbe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738647, "uuid": "2dc02bf9-c5cb-4b04-ab1f-265445d92401", "value": "24576:qyQ7EkdfJhbO99iwnRkMJDA7xIHdov/NrbeKRn:x4EABhsR9tux2Cv/NrCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738647, "uuid": "9690f712-f197-4875-ab04-382dd3868de5", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738647, "uuid": "1dca3c1e-44e8-489e-b97b-4a3f618c913c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738647, "uuid": "397e06a9-c0ee-45bd-a6d8-a5d4deba6f06", "value": "5c779abb583e74090cc3c892f3f4e602a025fc3fcea9b11540c25cf364b9b39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2476a48f-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752489, "uuid": "007b5e24-7063-40d2-b6d2-4847b1a03e73", "comment": "Malware payload (RedLineStealer)", "value": "3683111aab4ad8c92c502af4a80ba058", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752489, "uuid": "daf82de2-d03a-47eb-9b08-c42ed4a35025", "comment": "Malware payload (RedLineStealer)", "value": "5cc2f0627d172bdf233c6835e7a04fa06810e01aeb9a458471bc473b3f4aae25", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752489, "uuid": "baa29751-1aa4-4d1a-ab26-976faaebb0a9", "comment": "Malware payload (RedLineStealer)", "value": "9456d00604ade037e57c90291310eae45002579b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752489, "uuid": "15c0dabf-be3a-4a84-b6dc-405bd387aff0", "comment": "Malware payload (RedLineStealer)", "value": "ce0f451636d529a2d400d35f411f83cf33868030559eea12dd4122b68a2d4c79a27089f096b6d157b2ef450f05b76ec0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752489, "uuid": "1520f207-f5f3-4586-be44-ba571004d224", "value": "T13325225262E98573F6B027B448F617D70F36BCD4C97043A723C5A96A08B36C56232B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752489, "uuid": "5b21d1b4-76f5-4f3f-b27b-9c97aded6d49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752489, "uuid": "33389ee9-55d0-4d25-bdef-d5748ca83fad", "value": "24576:/yOEOcwuMoAZv8lg++kXVZE1k9c3xnMkONCKMzfgyHzW:KOEwuTtVZE1eclMVNCKMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752489, "uuid": "56c703f2-30d1-4a60-b06c-ea542adffa9e", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752489, "uuid": "2084047b-16e7-48fd-9009-a6c81fe0fa0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752489, "uuid": "41e61fbb-16d7-46a7-950f-0a8d3e08f72d", "value": "manager842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f7a72-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737583, "uuid": "f6d1cb9a-8242-4c8b-89de-df4792ef75fe", "comment": "Malware payload (RedLineStealer)", "value": "0ab066425f75b74ee9eee9ef6e52aceb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737583, "uuid": "6f96d435-81f3-4d27-a4dc-532f7057347a", "comment": "Malware payload (RedLineStealer)", "value": "5d0025ac406011489db694c8325799ea741b576e9de490e156723908c67c8e65", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737583, "uuid": "bba28f84-718b-4895-9253-b89c24f9fcad", "comment": "Malware payload (RedLineStealer)", "value": "14b1e10203a85f964393f9c75dc81ea084995d62", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737583, "uuid": "fb5b26eb-79d9-4a63-8ae8-fbb32257ca69", "comment": "Malware payload (RedLineStealer)", "value": "704e37077b22a38c3fc5d713e04590ba3e1ef507b901ad7d709f04822653c729dbf3ac4fa7091129b6b836b514c7634c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737583, "uuid": "9331cdac-e51c-440f-9792-13da7b3b3f74", "value": "T163252216EFC4A473DDB0277088F74A834A39BDD0D878837B3665A55B1C32285A97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737583, "uuid": "7ca9f0b5-6d1d-40a0-a8a9-5a01e8252d3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737583, "uuid": "c0ab5eca-9d11-4082-9630-dd0c0f83d76e", "value": "12288:0MrFy90TBRi1Dt9NJZcITD5URqVCOOjPTdf73rlfFO9SFOjWlEAxYhJrfsSxq2hf:5yMqbJRKq+Bfz+jWlENr0Aox6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737583, "uuid": "b32989f8-3af0-45e0-a51e-623eaf14dc08", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737583, "uuid": "ea5297b0-087b-4ac6-9717-90f51423ac88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737583, "uuid": "7f5cbcbc-1706-4b84-a678-0a3d92f32de0", "value": "physics790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7722cf7a-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747904, "uuid": "0fed4356-528b-4613-be49-b80439f457e7", "comment": "Malware payload (RedLineStealer)", "value": "f80183a4418d2184e7775a70dc2eeac7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747904, "uuid": "7fa24f8c-5fa8-469d-a44a-fc633d424019", "comment": "Malware payload (RedLineStealer)", "value": "5e1af3f3ccdc900a86f568f25a68dcf76baabc3e0164f7e79e5d63be82219735", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747904, "uuid": "b1d04597-299e-4f4f-9412-3dc827add2eb", "comment": "Malware payload (RedLineStealer)", "value": "ed4de53a03ba156a9b27e0b5c26b2191f3499553", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747904, "uuid": "2e0afad9-d8e4-4515-9ba5-51678891d3ac", "comment": "Malware payload (RedLineStealer)", "value": "06590d899b0b1c168947bb14529da033ef43000625c86cb5ac960d40a5be9f2d2459bd50f3179b48f944f9baa1b2e3d9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747904, "uuid": "9c8f59ad-4509-42bc-a757-6c889f2d561c", "value": "T19E25230395E48032EDB63B341CF202E70E777CA09934A65F269795AD0DB16E8B532B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747904, "uuid": "d7a34730-4588-40bc-b67c-e539014992b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747904, "uuid": "d3d53498-d0bd-43a1-a1ba-329389a68049", "value": "24576:0y69gkRw5NkicWAv/Qyh7ZSn7yAq8S29EvXiQ7iZaF2czz:D69gSAplAv/H5ZS7ndl94O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747904, "uuid": "5fb14374-e76a-4d4a-8d8c-cc2fec57d5d9", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747904, "uuid": "c8478cd8-a0a2-4a39-9ad7-c1c1c6eba8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747904, "uuid": "4022373a-6d47-44a4-bd23-49928f195267", "value": "cumloader252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9a80f7-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752288, "uuid": "fbf367c1-91b8-4626-84b5-3b6059ac9dc3", "comment": "Malware payload (RedLineStealer)", "value": "c7f98d257e6211df3a0a0de6a47c7f70", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752288, "uuid": "401b8e71-23c0-4ad3-af89-847dd70bf258", "comment": "Malware payload (RedLineStealer)", "value": "5e4fa10400d0920c89bad20b45e8337e1dd9e765a4092736d5fa71b771a6d679", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752288, "uuid": "1e0c692e-c766-4498-bec4-0a093a3ee07f", "comment": "Malware payload (RedLineStealer)", "value": "7e0f419f650056496a70d38aaa54b25e039fa9dc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752288, "uuid": "e176e472-bff0-4250-ba2c-579b5106b335", "comment": "Malware payload (RedLineStealer)", "value": "5f2918465b9ccf17b5a99200e5cef4a4ed5b37fc67d7c799bfecc0d3b69937f300445c7a52812222ac95c07274850a72", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752288, "uuid": "b7285411-f8e6-4fc5-8e81-ea69670306d2", "value": "T1C8252303FAD055B2E9B033312FF602A316357D945A74D26B2B0DB9AA5C73AC06976733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752288, "uuid": "c1b33734-5f90-45ca-84f0-e292f4456f27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752288, "uuid": "da4ca703-d9d0-4a00-9b3e-08c03ad5df78", "value": "24576:Rya2g73zAA3iIq39+zjr6BTKbQuO3pCdTmGpikU:Ea2gHAAFq3ozjr6BxIdTnp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752288, "uuid": "b7a72167-43e7-494f-a8bd-41219f04e4d0", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752288, "uuid": "dd38230d-c44c-4796-bee4-feb1ffe4981d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752288, "uuid": "6c5c1a4b-75ca-43af-8488-e6dd32737fe3", "value": "999476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd29a773-f8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684766114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766114, "uuid": "aeeb08d0-2eac-47d5-988e-da3c6ce826a5", "comment": "Malware payload", "value": "7fbead6d928e0955c84f4c4fc0fa896b", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766114, "uuid": "91502c07-1d50-44d3-b775-edc58d570d73", "comment": "Malware payload", "value": "5f9d8b2b560bbe2bfdd8ea59aea03b2cd33a57a6bafbb1e5d5a8da23cb23f80e", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766114, "uuid": "46926edf-55a1-4ba6-8706-60da5b66b257", "comment": "Malware payload", "value": "a929bd80be099fe97109c8a4fdabb33b45c302c8", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766114, "uuid": "b824c798-00ff-46ae-b588-965389b0d152", "comment": "Malware payload", "value": "d3b5a11680f985db3a4a0ddaae47290dc615603053b1b39e04e402c02b9321a5420a502edee773bad8cfe854a60b1911", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766114, "uuid": "5777aed2-96ce-4d01-96ab-0ea3a1a1835d", "value": "T15EF2F1028DA2EB4F348E6225EB8AD5CFC069A98284774D44FD5B23B047D5878CDC3F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766114, "uuid": "1f3ebfbd-83c6-439b-a1ca-532f043c5b48", "value": "768:9cyeQg4oCvG7Q4VWOS+ns2PqeO9Itf2G0Rb+lP3lbW0N0TECMJ:veQoCT4Vx3PDO9Er0hW3U0qTPMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684766114, "uuid": "fd29e847-7e6b-492e-9bb1-9a4104354420", "value": 36585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684766114, "uuid": "4ab48ea2-6f80-4550-93b7-ae8fef625ad7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766114, "uuid": "1cff0cf4-df01-4a11-986e-3e531f0adc14", "value": "Nzetxr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccdd787-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755913, "uuid": "36d9a561-558c-4ee9-a7e5-f5f392387b5c", "comment": "Malware payload", "value": "02f86e268446c4f0ce9a57d5573fd1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755913, "uuid": "e6259742-1c53-4e57-bf0f-fc8f5d1565bf", "comment": "Malware payload", "value": "6063c58b3516c297be2f2e0cde3ca5be1ae01cb934ad039722577f88bf2a49c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755913, "uuid": "29457ede-bec5-4135-94a9-341e878f8a6f", "comment": "Malware payload", "value": "ca77fab67ab67e9330001764a4005a53994a876a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755913, "uuid": "96cbfaf4-e590-480a-9d98-a28ec58af56d", "comment": "Malware payload", "value": "42c8d3c833e88582a7ad5eb023f63bdd8ffdac1db37e131b052d66b90986a970d9c64fd43229539e54c22aada7024dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755913, "uuid": "da1e88e9-16d3-4a36-b59c-761651a7d407", "value": "T1FE23B40D34B0BC82D7AD01FF0D91B2D5FABAE32A2A3646BB2F8825551338543CF6D149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755913, "uuid": "544d6df1-626c-42e4-815a-0356d5318885", "value": "192:hdJA/z8y4Z2FVdQ2+OWvrjLYDvxO9TfXlIr:hdJA/e2FDQ2+OWzXKOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755913, "uuid": "07e84361-bd79-4bda-abf4-4666985dcc89", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755913, "uuid": "94231c2d-7519-43cc-b9eb-b723c61e929b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755913, "uuid": "d0454049-5850-493a-bd15-a0f457e62436", "value": "SecuriteInfo.com.Win32.Walivun.18536.22449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c885b2-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752441, "uuid": "049b86e2-fbca-407c-84bc-2b27cd6c2858", "comment": "Malware payload (RedLineStealer)", "value": "3c665e4d5587865128034c0ac28fb131", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752441, "uuid": "0c45d392-cb3f-4e54-a338-10d1d444d44d", "comment": "Malware payload (RedLineStealer)", "value": "60811b06f98fcf414e9582efba137625712cf89a51540c66b15ba4968c47e289", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752441, "uuid": "f47c1c07-ce05-492c-8553-e62ce7403c8c", "comment": "Malware payload (RedLineStealer)", "value": "9c62474300cf94708c02c68f4fd298a50c58bd49", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752441, "uuid": "d46d9e89-69df-4875-bcf8-e9b83862b73e", "comment": "Malware payload (RedLineStealer)", "value": "ac9e3631d2fc4c3a762adf04d17d6ed40ea5f83de6a6fab6ab4fab3950917e73921afde75c7ffd60c3ae268d62e6995b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752441, "uuid": "45320484-eaae-4572-96ee-541b7d6b4d43", "value": "T1E3252327AFD44472D4A1777018FB2B9B1B31FCA08D74D7263B0A2A8B0C72695A575373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752441, "uuid": "f0a19007-6b45-4e35-969a-035549fc14ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752441, "uuid": "251527bb-e6db-47fb-a43c-6dcfa717203e", "value": "24576:oyigvYq7pqiRpXcpKKRCb4r+2iHN7eTkHLf7:vrgq7pqkpXcpKKyUQMTAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752441, "uuid": "046a51e1-4356-4882-884d-76de6656e1de", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752441, "uuid": "ea6266b7-7382-452f-a625-0d2cb3619fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752441, "uuid": "d48452bf-e8a5-459b-afd1-1ebee0e0e873", "value": "gameplay705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848b017e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752221, "uuid": "a3a98d19-07bf-457e-9b11-bcb3fe95ea2a", "comment": "Malware payload (RedLineStealer)", "value": "041bb38bdb2f9833836ec1f1a1d2223f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752221, "uuid": "c9543ef9-a888-47f6-afff-f9d45e65567b", "comment": "Malware payload (RedLineStealer)", "value": "6089cd15e662a550983e71644626b8d8bc89b54367293244bee64985874b8d0f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752221, "uuid": "a1752db9-0fc1-4040-82fa-a8bdf53d2de2", "comment": "Malware payload (RedLineStealer)", "value": "9faa8a7e50502b1b3922e8fb8faf4b579fabcd73", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752221, "uuid": "ba8e6390-25e2-4203-bfa5-fb790a61d19e", "comment": "Malware payload (RedLineStealer)", "value": "94629c895a570560ca6c02fc9c857e4be42a1b905cf1de1fb93c3b14e5d2a48cad32eb20742af6295e2820209c890f47", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752221, "uuid": "a9ac2dcb-5dbc-4490-9090-86f1c65ec01c", "value": "T17E252363A9E42037D8F533B4A8F747C30B35FDA68879832B6706655B0DB3A809572367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752221, "uuid": "9d2053b3-e180-4793-8381-ab90d98bd5d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752221, "uuid": "aa50c8ed-79de-4531-9871-60a8afd84cc8", "value": "24576:0ywukVclR8cBrqCVBhV+OFvfNG9hplGDrt:DwukW4cBrq+H/vfNGfGDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752221, "uuid": "63b7ea4f-d637-4575-8aae-e07dc1d4fcc6", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752221, "uuid": "c9344f82-a276-4cc0-8701-15e0f190862d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752221, "uuid": "f1bfe65c-e17f-4011-aef2-45079313b3e6", "value": "2467335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede3f153-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745955, "uuid": "e6dcdd5b-3813-43e2-aeff-0abe4ff20b89", "comment": "Malware payload (RedLineStealer)", "value": "b8e7c4498303bf7699ebcca3c97860a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745955, "uuid": "d9ee9c94-134b-4c9b-b12c-e5a4e39477a5", "comment": "Malware payload (RedLineStealer)", "value": "6126ab8318afad65ff8c8a5a7d73c9d4a1a332aef5e1560aba3cc55ebb9a429d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745955, "uuid": "3f3d67ac-3490-45b7-ac9f-ba0bb54c9711", "comment": "Malware payload (RedLineStealer)", "value": "c0f44d534fd511623bee4668c0e50b186ae4eae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745955, "uuid": "6bb2e6be-10d8-44e6-acb1-1b9589650533", "comment": "Malware payload (RedLineStealer)", "value": "c54f896d1c19217096b6015212345c57b9feac39c0aa15e102e584a69bd37e923381d69936cb06adbc657af37bde2acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745955, "uuid": "1ce4ef09-f4e6-4113-abfe-605aaf636845", "value": "T1CA252362BBF88077D5A67B7008F303931E35BCE0D978956732887C4A1E725A4A47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745955, "uuid": "d795a00f-daa9-42eb-a623-28b490f3011d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745955, "uuid": "e299d74d-fe0f-4dae-9f13-e882a6bc031e", "value": "24576:Gy5bpotLWmFPqBXYfmQTcOAhaMCtpNDY:V5ytWmpqBofrwOOaMOND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745955, "uuid": "08c261dd-1ca6-4952-ad48-5e947fd2d28b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745955, "uuid": "49b21526-0369-4866-a0dd-da9a0b3d159e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745955, "uuid": "bedeea1c-d29f-4279-9cc4-05c03848a5fe", "value": "b8e7c4498303bf7699ebcca3c97860a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3a2ac6-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745285, "uuid": "af92afde-0cd9-4413-9c50-2640a93d13a8", "comment": "Malware payload (AgentTesla)", "value": "7bf7d9a717e5dc8b00710a0d1c9f4c54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745285, "uuid": "ce1d14af-ee39-4282-bc7f-f4d7663626ff", "comment": "Malware payload (AgentTesla)", "value": "61460fe1019d76b7dececc3c70ac70f58b05a372bc08ed5c591a521fc244d740", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745285, "uuid": "497a5d4b-9b4b-487e-86d7-0111c7bae242", "comment": "Malware payload (AgentTesla)", "value": "ab9007c7d782e3f1c12a2a1ccf741c489668c515", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745285, "uuid": "5852bcdb-fe63-4ddb-99e5-1092b948366b", "comment": "Malware payload (AgentTesla)", "value": "cafd742dd1d1e41107ed755c3822f8e41b8741f74ed055452a270cdaf9a39ae81484cb252d3858b8859a2ff0c55addf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745285, "uuid": "eea6b644-969c-4436-9f0b-b26c8cf58b9d", "value": "T149E4F1C126988C00F5AB9EF85AB7F27443B56C91DF27834964E42D8B7C66B827B017C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745285, "uuid": "c7a0035d-17ec-405c-9d92-92ee6aaa911b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745285, "uuid": "dd354b70-6c48-4868-b009-3a27c3590a4c", "value": "12288:WT8x0YPX/NqPsAvjqKVd5P1xNl7/KCRsb8o0iun/uV484LjN7:WTLHPswqKVdt1xb7i5zjI8Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745285, "uuid": "1fdac584-4dbc-4972-abb3-2aeec5deee8e", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745285, "uuid": "7535f9c8-48ef-42eb-9ae1-2ae73d0911bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745285, "uuid": "0484309c-9118-4ec0-a2f3-cc6be128ccbd", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d39c993-f86f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684739351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739351, "uuid": "cf51b1f8-ad92-4ac9-b05e-52749e6a167d", "comment": "Malware payload (GCleaner)", "value": "51029274ed19a656cb81820c404d8c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739351, "uuid": "93313648-8469-42dc-9fb0-0483e10e119c", "comment": "Malware payload (GCleaner)", "value": "6162516ace2bf031a896ad4896d4f36e37c35487cdab84f659a4ad8a8368f08e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739351, "uuid": "08738dc8-9a23-4524-98dc-3411a5b08ba0", "comment": "Malware payload (GCleaner)", "value": "58c5e0bc5bff300a640367b0306277aee5640d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739351, "uuid": "9dd57687-ee71-4be3-bff3-01ef7648c857", "comment": "Malware payload (GCleaner)", "value": "60d2ebf9275a99bf328570e260fe0cc1bfbe8a34960cd37e6729c14f9ac60d57e3d4daac0e9d77cbf2fd39090c4e9bf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739351, "uuid": "9f7c6178-5432-4ed1-9531-c328c795c3d8", "value": "T12DA533D793AEC075C3B1D8387C07C23C697AB9298B396A2D7730699D0D577C9AD2310A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739351, "uuid": "5f246a42-b8b4-4bb1-8fd8-4a670991a9dd", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739351, "uuid": "6d3a0e91-2d85-49c9-a288-84941f9b4cee", "value": "49152:tiEJ84zyzrpRkZ88s/9DM/X9ACKNvkZ8Os8wuR:tiEJ84zyk8l/GNACvKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684739351, "uuid": "e20a6bc7-030f-4333-8818-130062e254ab", "value": 2093243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684739351, "uuid": "0700dcc7-cbff-494b-8208-d17565ac8f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739351, "uuid": "c2e0ca40-6661-437f-b7d6-5302eedab5e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe568cec-f87a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744265, "uuid": "be78a953-67ba-4c31-84af-4dd722eeff99", "comment": "Malware payload (SnakeKeylogger)", "value": "1265116c4041b2767faeec27d15d6070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744265, "uuid": "84449b6b-2c67-492b-a961-e219255d3af4", "comment": "Malware payload (SnakeKeylogger)", "value": "6170f056f1e5b8b06adbdc3e075a2dbd0d8f71a8bb015f6d6d083a600bf3fdbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744265, "uuid": "d75d53b5-a553-4b14-ac78-cbbed8f99cf9", "comment": "Malware payload (SnakeKeylogger)", "value": "3eee87dd0912e200c65bfc234cf4c5dd249fbb20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744265, "uuid": "ab301606-6568-414a-a850-65426b5ead7d", "comment": "Malware payload (SnakeKeylogger)", "value": "3dc0edc19a1b6ece4aaaf0ad1c601cb8a1e3b48cadfbefb71fb67fa62c06e186525ba9eb6301789209951797c6f07024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744265, "uuid": "eda97e66-0896-441e-a33c-9ba4b055bbcf", "value": "T10F924112F2595A52D2E80A33CC0F6290163CED16687B921F9CD37D1EBFB73254913BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744265, "uuid": "13a83745-4b6d-4bc7-9502-eda29def7d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744265, "uuid": "7a72a369-2f21-4ccc-8d64-1bcd8a83b452", "value": "384:dwgrffffiYYYYYYY4fG2p5LPT/v/ok/iTIsyNPNZJ9afel:G3YYYYYYYMGO7z/mI1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744265, "uuid": "65d4d0a5-440c-438c-91a6-ebbc78194aa1", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744265, "uuid": "19e46db6-97c1-4918-999e-3d91bc230f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744265, "uuid": "ca6f93bd-489c-4765-8169-cbd7a337a716", "value": "Jinwtqn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fa66ef-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737681, "uuid": "6ce97245-f2c9-498c-860f-056cf70002fd", "comment": "Malware payload (RedLineStealer)", "value": "0611f32e4947f6cd2917b748b135f73c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737681, "uuid": "ef17aba1-b884-41d2-bee3-8736798e049c", "comment": "Malware payload (RedLineStealer)", "value": "617d91bed9e6e3b984d8dd4cd61f15d707956e0a5360dc18619a8bb2390181a9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737681, "uuid": "948bc24c-258b-4a88-8933-22933d7e8469", "comment": "Malware payload (RedLineStealer)", "value": "2868312b8bb30afd9a79c2658449f72a9fc324be", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737681, "uuid": "7cd62d56-65f6-4476-8b73-b61768d4e48e", "comment": "Malware payload (RedLineStealer)", "value": "6ada5daad6315ba78f4d2f04212dd7b3db1f55f19a9344de0eae68f7ac437be127a4a5eda366d6a598ddbd49c13c5e5d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737681, "uuid": "541cd730-26b7-4757-8f99-5e9fa4397250", "value": "T1E4252226BBDCA562D9B527F1A4F602830B213CA59CB4822337D42D574D62A89F63077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737681, "uuid": "89e9c398-8b70-4076-95f7-4b866cf41f63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737681, "uuid": "27824190-b51b-43c1-bc14-2ad9ce08cf48", "value": "12288:UMrby90A05s48kEOo0Ep5k1vQaa5XlDkNgkvnN2VOhx5CnsSdQHu0JIEsipTG95G:Xyf0+pADN1Yrk12ghx0sSdQBGipTAAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737681, "uuid": "185c3e49-d28f-4bf5-9405-97bf8973fb6e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737681, "uuid": "860fd4bc-8f86-477f-b794-5edc39e3fdd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737681, "uuid": "b8f10842-6f9a-4e00-8802-48dae81ccae6", "value": "translator587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf79a021-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777231, "uuid": "7fc065a4-cf72-408c-af90-b048dacab81c", "comment": "Malware payload", "value": "cc67178f9a0e7bc6ad2dd37e7a3b2310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777231, "uuid": "13b446da-9430-4fc3-bda1-13a60ced8d5f", "comment": "Malware payload", "value": "619d06834c9fb9cb80f5a29d1ccdb90b1a70de7c9b5e0bf5af103a3f363a3548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777231, "uuid": "7f051679-09bf-4cbe-8291-70c2c06c106e", "comment": "Malware payload", "value": "e5951d230e16a41a2221195e5fe313600c4746fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777231, "uuid": "9d6c1f65-9703-4033-8ed2-ef39b6b048d4", "comment": "Malware payload", "value": "b30336fb655e9783306073f1985348fdcaad78d5f84f839c63cde3b6e001af498181a1a69d29cf9eaaf6d44cded11596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777231, "uuid": "1357f971-3665-4aac-bf7e-777f00866174", "value": "T13A82AE857310C88AC5A805321C13EABD76713C3A8C2A9D4B3FD9930F7E367E5AD05B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777231, "uuid": "dbaaf3d0-eef5-4d63-8773-b8e44cafbb9e", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777231, "uuid": "f974aa96-1eae-4f76-a80d-33f64646ccd2", "value": "384:aLDTs8hsF6qtK8lzQ8+Sych3mYvCPHx5NYm:aLXVhaTtDE8VfCPHx5Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777231, "uuid": "4daa09c4-4bd9-4aa2-80bb-dcfcfd1c24d6", "value": 18050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777231, "uuid": "a2c962d3-728b-488f-9be7-50063208b4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777231, "uuid": "ef2d32ba-9c93-4d58-bd0d-0b5a881620c8", "value": "SecuriteInfo.com.HEUR.17620.26046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ce71e2-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752467, "uuid": "c2d22eeb-2bbd-481c-9326-89e998c800f8", "comment": "Malware payload (Amadey)", "value": "ab1b0eb9f8256ff6e5612f663f4c8ba7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752467, "uuid": "97ef0f92-3328-4350-95c4-d7ea32f05fe3", "comment": "Malware payload (Amadey)", "value": "61b58b32921e4b64770e56f0400ffb4b07d1206ba6070fb2e7cedee542061ab7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752467, "uuid": "c8ebc223-b601-4d62-8d42-b31b1b3878af", "comment": "Malware payload (Amadey)", "value": "1f6cc80553f9f3c3901c109d473c3e1ff6770b6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752467, "uuid": "7b73faba-0cbe-4541-80bd-a6f84d84952c", "comment": "Malware payload (Amadey)", "value": "2803f327ac7fff83ab222c96d6a7360ad499d8868779e7ea06a23a3906af47f9076f50c202ece3b704bc53c7b2f9c230", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752467, "uuid": "1bb516cd-163e-4702-ad7a-0e3c60d7bcaf", "value": "T1CE252312A7D880B3DAF537B088F607C70E36BDA19A74429937D1994E1CB36D9983172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752467, "uuid": "e31a3d1e-d08c-4e5f-b136-31a8caf38b72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752467, "uuid": "d7ed731e-5e80-4dae-861a-5a3fc95a4b40", "value": "24576:Yy6zbsXYd1W9gLCv/3xxXI9pZVOn9CkwB:f6XsI1e659pZV49C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752467, "uuid": "7cb2ab2d-7802-4a69-ac96-1a1c8bbaae1a", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752467, "uuid": "3a0ada1d-c8b1-43e6-a992-ed7e4d2cb1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752467, "uuid": "77446b54-b6a6-4c1a-9e92-2fa30b85dee5", "value": "invonce501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a830c97-f83d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684717898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717898, "uuid": "63e1a47e-c4a6-4376-a3ef-c4044fd82dec", "comment": "Malware payload (Formbook)", "value": "372daff38ea8b876b01803b474c7f687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717898, "uuid": "49ca6193-c868-437b-97ad-9afc507452fe", "comment": "Malware payload (Formbook)", "value": "625f5caa0e4422a01de12f875b7acf8c4edb699f36a7237c18bf3df7772a7e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717898, "uuid": "a8849552-37e0-4ef0-a7d5-9add991c1778", "comment": "Malware payload (Formbook)", "value": "3e27eb6a6e9ec8f8be6609c85bb6b16376907fcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684717898, "uuid": "bd0abcfb-72cd-4de6-b730-dbbbb917c0a8", "comment": "Malware payload (Formbook)", "value": "a4d37d740743085f1b31a8e707379844f4d043345e53f0bb98d09aea154ca3b9b858b5cb24c634fb12095192e150effc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717898, "uuid": "dfc616e5-688f-415e-a0d6-eed061ff2497", "value": "T19D15E05126A88F55E2B6ABF952B2E23443B52C15F636D3184DE02CDB3D76F823701B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717898, "uuid": "97576f04-57f6-4374-af41-7dfcd0930b63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717898, "uuid": "6fedf27c-5aa4-4499-aac6-ab954cabfbb6", "value": "24576:C0t8P0kqs+kTIvMRGfdx9YLXy+DB87qkC:IP01sWMRGfHuXy+Dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684717898, "uuid": "c1de4c84-aef2-4ef6-becd-37f3092fe6d0", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684717898, "uuid": "23dfb252-f732-47f6-ba1d-ab334625aa54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684717898, "uuid": "2753f4be-6b79-4999-a90b-998458163ef3", "value": "372daff38ea8b876b01803b474c7f687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126e8045-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752030, "uuid": "d6d7d33d-5497-4c30-b3d1-cfb888e8c490", "comment": "Malware payload (RedLineStealer)", "value": "a15a33fa31aec90902fe0e7e27e6ce9c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752030, "uuid": "41b1a0b3-ebe9-4d4b-b5bf-1214472bfff0", "comment": "Malware payload (RedLineStealer)", "value": "625fac6331368ea9a29d245739659c51c056ff20bee1b5829a1c16daf5e1b9d9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752030, "uuid": "7b27f75d-9cca-4187-88b9-73e95c9054cd", "comment": "Malware payload (RedLineStealer)", "value": "556293191526d7cb626bbcd28ca858a62eb31813", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752030, "uuid": "e16b0449-747c-4f8b-ae46-6ee5a0b86311", "comment": "Malware payload (RedLineStealer)", "value": "d9c24b89587592575f203543d9b79e8d259610efee9cfc0a1500f69eeb33c4a5910aa848c15629bf8745b29fe93bb875", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752030, "uuid": "2abbb465-c439-44fc-a7c0-d3508cb59a82", "value": "T18B252300ABD85077EAB42BB049FA16430B39BD928939936F27825D4A1D337C5A47377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752030, "uuid": "af0ef69c-66d8-4dcb-a256-d73deb41d95a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752030, "uuid": "c117305c-3e19-460e-88bb-04e049261cf3", "value": "24576:nyttlrVl9vbKLVdlDNxgGSMPQZPha2zBZwfiO1Yd3RS:y7lrlKBphSpqTG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752030, "uuid": "9775b5b1-e364-47ff-b22b-d0e04c0b121e", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752030, "uuid": "39e6f262-3f19-460b-a965-6c02f0a92bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752030, "uuid": "7d162e6f-3f74-42d9-a500-d7e69ccdd6aa", "value": "recorder933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4351b82a-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745240, "uuid": "9654ab19-1379-49bd-93ad-321c4fbe21fb", "comment": "Malware payload (AgentTesla)", "value": "404453c503071a38e62c6c7f33aad2c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745240, "uuid": "3cf753bd-a8d9-46ab-8252-f5d80d9fe772", "comment": "Malware payload (AgentTesla)", "value": "62dc73beb92c72827a3408e42c9220f5d33258258ff03bfc7285d02f7372eee8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745240, "uuid": "c5afc415-b58e-4e67-a63e-1a8917ac8a5f", "comment": "Malware payload (AgentTesla)", "value": "6e046e750d746e7f78534c447067c6d2c29e0c4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745240, "uuid": "bb12ca2b-de8f-49d7-85bd-f91504d78536", "comment": "Malware payload (AgentTesla)", "value": "2c372f40a08b0f73fdb0f77feeca2c97253b9115c7da3439c484c01b6bfca217bd2edbef6b7bcbd92cca5625d03744fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745240, "uuid": "8d420771-c0c0-44bf-a9b3-65c482f26481", "value": "T1F4542245BAF0D8F5F47A72F1BA7A8678CBA29810209C174723410BCC7D57B94D94EB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745240, "uuid": "98cc6eda-20bf-48ce-bd24-ab86dcfe01c5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745240, "uuid": "0a3afd97-1876-44e5-9104-de0be1768cc2", "value": "6144:vYa64E69ubSN7IL3DQ2/TAM02FjGOhCIqXG6EY8gnCNUkhJCoA:vYWE69QSNh2/TA7QyyCP2vfNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745240, "uuid": "a178c84a-33f4-4c26-989b-36c4291164df", "value": 304821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745240, "uuid": "b487ee9f-10c7-4f87-9eff-d78533a78baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745240, "uuid": "6e69da46-5c7d-4a04-b523-c3684346baf0", "value": "temyiz tasla\u011f\u0131 yedek.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4e019e-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744666, "uuid": "a7654bb6-47dd-42c7-8e74-deccdf3c460f", "comment": "Malware payload", "value": "96bde8c395b4db92821512c003b0d143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744666, "uuid": "5e68bc69-9cd2-489f-b740-16d7ca6ddcdc", "comment": "Malware payload", "value": "62f2124dbe83d59d6a5a481343f0716c8a57ddc511b9a310f7912af77d81460e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744666, "uuid": "0aacad3d-d0e6-4cd9-978a-db85a253f098", "comment": "Malware payload", "value": "8dc6f3bdc24e5928b279917300b70d561cffc2b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744666, "uuid": "f2b01985-9872-435e-b595-e85c662f2a32", "comment": "Malware payload", "value": "9527579eca63c9665ebb21e5f2bad2a952af18386e0b6e6c4778f85b76d31767ffcfd9501b8e4f8da27c4eb3553fc16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744666, "uuid": "0ddf94f7-4986-477c-8188-04cf8362cef9", "value": "T1B6D4238D331E9364C9BF2BB6A0E6169943F18817DD4BD72C1EA230FE14AB709465670F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744666, "uuid": "3e7e0930-6846-45a2-bdc2-43ce48520971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744666, "uuid": "4f50f5f5-3ff3-4b93-829d-7cb51293de96", "value": "12288:XOXbOvmJo4z+Qc/hQyqoA76S5l8rpJoDK2/T/ITUtEHVA4jtPNUklCi:XOXbuuo4yQc/hQy876ZXYKKK3Hq8tPSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744666, "uuid": "6f3a5bb3-eba3-47fc-bdfa-66f8b9bc0448", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744666, "uuid": "60a1776f-6b62-4863-80c6-355a408c2f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744666, "uuid": "9b684475-f766-433f-b2e6-a4150b3fdfd8", "value": "96bde8c395b4db92821512c003b0d143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835b6ce6-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "ecb10dc0-a365-4d5e-af86-c0c7f35e5b67", "comment": "Malware payload (AgentTesla)", "value": "026a10e1c6d35c1ce51d4f88117b7034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "a2ec4b31-1a6a-4c74-a05c-adf46183cdca", "comment": "Malware payload (AgentTesla)", "value": "634d85d5b533562ab4f53b5777a2b228067d400ed6a4151184d8b5b8c6dce151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "e68ebdea-c0ab-41e0-88ca-76a71a147891", "comment": "Malware payload (AgentTesla)", "value": "7ba86ca1a9c7a14976f6bbee892353babab04504", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745777, "uuid": "e675dc60-ce2e-4ad0-ab0f-b044af35fd87", "comment": "Malware payload (AgentTesla)", "value": "43455b650a8e2e507f9328bcfa43df3e106ea7d0f9756fc77ff40da38983952bb1de0c2a75ec9c9fd9bb0e53c26812d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "839fb542-daa3-48ed-b38c-3bcbe40f918f", "value": "T118E4F1C127D48C11E69B4EB94EA2E27453B42DA2EF23C30D54F42D9B7C66B827A057D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "0d9bffab-70ee-4d35-83b9-6d85c9df2aec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "408e1ddd-932a-4a5a-bc12-23c7aaa682d7", "value": "12288:ST9x0YPX/NqPsDA+obq4n/PA/U0YGGuT4mHy7UJUYh4yYgC6G+:STYHPsbo24/Y/U0YGNT4mUUmi4sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745777, "uuid": "78f9f96b-4713-4776-a149-bcf44eab4b07", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745777, "uuid": "6d69e1ad-be8a-4e4b-a931-cd1f29afeba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745777, "uuid": "48293bb2-7f7b-4761-b436-4e89f0ba53ce", "value": "026a10e1c6d35c1ce51d4f88117b7034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d14b033-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684779562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779562, "uuid": "339c1b60-869e-41e5-8107-25caf3736955", "comment": "Malware payload (Formbook)", "value": "a7bb4487571bd68e2b616db60682bb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779562, "uuid": "c626301f-54a7-4836-993d-ef235547b238", "comment": "Malware payload (Formbook)", "value": "6371e6f808e46f98c8d2e98d1a81203dc6ec3aa755ee5e61bee436bcfdb92cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779562, "uuid": "24f3ac77-4d8f-4331-b78f-6fdd40e8c7ed", "comment": "Malware payload (Formbook)", "value": "d82dd455ac706b68c81781bb25d78f22aad518ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779562, "uuid": "b49e336c-2b22-451c-bd94-2c167fa5fc28", "comment": "Malware payload (Formbook)", "value": "8064b56e24800dfe17f6df111bb316a723ce0a697d8c8e7fc8ed40fccb1084007adfa13e091483db034382af58799d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779562, "uuid": "7c447915-fa54-4a9b-9088-f93c6299bdaa", "value": "T1B7F48B5633B57621F47D33FD0119A388CB38B44A2062E12A1F5A3AD552E37EB770A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779562, "uuid": "526de03c-9160-4506-ac7c-735f67e822eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779562, "uuid": "23ec6353-2cef-4faf-9700-d336574dd03a", "value": "12288:lvV+s1bSQT6tjjdB44W3uYAkfcHxo5FAE54zJodXIdm2xeQ/JlPKFiu:ltqquYYHxo5qhUYRj2Fiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779562, "uuid": "6c57ee08-3f2f-416e-b512-907b54971d50", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779562, "uuid": "fb04471b-20be-4d7b-a271-d067d1aeab12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779562, "uuid": "4a3c9da1-c2e1-4ed3-ac84-69b1147154c8", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc908fd-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779587, "uuid": "1b2cca8e-3a07-4db6-ae5e-bc2eaa9cda3e", "comment": "Malware payload (AgentTesla)", "value": "d88ccb5c465e1721cb3cdc981b4843ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779587, "uuid": "ba6aeb8e-fddb-4eb1-bd40-6593cf649042", "comment": "Malware payload (AgentTesla)", "value": "6375d8784dfa25c5c8500a59995c6ac0732eae84d116d08a3e5f6ba7ad9e536f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779587, "uuid": "5da3927a-16c8-4839-afaf-d2d8921b391a", "comment": "Malware payload (AgentTesla)", "value": "f4ee9eeef5890b1ed947d36a8a0d1b79b137df7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779587, "uuid": "3bf2d2ef-a7fe-4e45-88ca-f33c0b795635", "comment": "Malware payload (AgentTesla)", "value": "15e0460f8ecf362d1352ac647d49558a644d89bc725c5c0887385e1c66225db97bf60375cf5341370f3357796f1ce8ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779587, "uuid": "5cc0b964-4da5-4812-975a-73bbbbaefff3", "value": "T171F48C9533B5DF2AD87E43FF06F0908D0BB874467026E2195F9735D67270BA22A48B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779587, "uuid": "ba847c65-90d2-4e3c-b6bb-e5ff2ffa1cba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779587, "uuid": "7e529877-f250-4be0-abd1-b57a6166e73e", "value": "12288:nDX918WfIM+C2AMVGG/PN4ZngZYpbn+KXwI9dyZ5xmmqdCaZtkFx:nR18WfWCMrd4Gsn+mdyJmhdCaZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779587, "uuid": "05981d8c-2ef0-4c7e-b0d5-06ec07c99058", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779587, "uuid": "05945861-9a22-4105-9356-bee34f7fc6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779587, "uuid": "44675588-e6a0-4f35-b901-f81a70c87260", "value": "TNT Parcel Receipt_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897bc79c-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684752659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752659, "uuid": "fa5f4797-b92c-4b17-8a80-af97ffb5d4d3", "comment": "Malware payload (GuLoader)", "value": "228fb89e5dd1f9e4d9fb3e3c07733ee7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752659, "uuid": "ade072c7-2f1a-4594-8c27-ae448d198e1e", "comment": "Malware payload (GuLoader)", "value": "6624a371621df5a2d1ae1414e8a609f72a21f7886bac9c767f2a7aa1b2666097", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752659, "uuid": "904ca0cf-cd2b-4f2a-bf70-4626978c12e8", "comment": "Malware payload (GuLoader)", "value": "e4e11339272b6aca8fbc8e98b9d7c3ecb0c0fb36", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752659, "uuid": "39381758-a75c-45c7-ac81-077bd2f3d0cc", "comment": "Malware payload (GuLoader)", "value": "8b4e7acd13de4eaa50dd29709571984f1cdb4c1c318c026ed90146de25b51e9219eaa421261384762e1184ccec967cb8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752659, "uuid": "1cea8c63-efa5-4e6d-ba3e-1985eaff790f", "value": "T152D313289F961F76D555B4101EFFE4C69BAA350F81A44BF40D72627301C1D2ABDB33A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752659, "uuid": "cdb49995-60ae-4a25-abf4-fe140842880a", "value": "3072:qcwhA7Hpt/p+n08s/loa4igIhQcB4QhLmtoM2DyXw/A:zPFJQHs/loaZgoDiKxyX6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752659, "uuid": "f6418c0b-2cdc-42cb-b0d9-0607d9b1a4e0", "value": 140917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752659, "uuid": "f362be5f-0b5b-4a1c-b6b7-93a8cb246d11", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752659, "uuid": "1d8a2489-92f5-4fe8-8c4d-5afd08363f1b", "value": "E-dekont_pdf.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9871672-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752283, "uuid": "37c056fb-5a03-4ce5-b97e-adff36468513", "comment": "Malware payload (RedLineStealer)", "value": "e9463dbc3dd44a056a4d37a5e9cbb36d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752283, "uuid": "1db10704-e10d-4b87-81a8-271677df9038", "comment": "Malware payload (RedLineStealer)", "value": "664e8ab2aa03bbc0e33829bbf72c5a5b4d4bb6e6706674c65f29e24d514acd20", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752283, "uuid": "f938c13c-c16f-4629-b6b1-abd5c905d920", "comment": "Malware payload (RedLineStealer)", "value": "8154c276225a007ee577d7f4e0bf6f29016dda17", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752283, "uuid": "26b27703-82d7-4a0d-9111-563349721a3b", "comment": "Malware payload (RedLineStealer)", "value": "450d735216fd564c75fbfc52315c1299aa192b4d9c0be51111afd68ef9521204bf415fe8e6eed691913ff7d47329e363", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752283, "uuid": "2fd911bb-ad07-4744-ac22-1817259bcabf", "value": "T1D2252312E2EC0172ECF5677018F953830B3E3C52D8BA13571B419A0F5EB36A4B5A676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752283, "uuid": "c0205415-8dd0-44ca-a127-8adf8bf703d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752283, "uuid": "606b67b9-14fe-40aa-bca6-2387fdfe8e45", "value": "24576:/ylemo1ulZxiJp+b3KI3iXo3WD+slhj5D3EZGG3u5:KlOYu+gHlhGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752283, "uuid": "e99c3ba3-597c-4eec-84b4-2783d1ce51cf", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752283, "uuid": "6181f9a7-3b4f-43ce-8216-674034508a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752283, "uuid": "2d723e33-5fd3-4545-ad5d-1376c6b09844", "value": "86968997.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7ce312-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738650, "uuid": "c022b6e6-02f0-40cb-b3dd-5180040d9ed8", "comment": "Malware payload (RedLineStealer)", "value": "e079bd4289578643f159ac5f3a6c5716", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738650, "uuid": "ae15f33f-1b4d-418b-95a4-f4d5a8ec7e3e", "comment": "Malware payload (RedLineStealer)", "value": "664f2db3367d95021cf06885c6c8c09e8871ab08b546da9837c4ffe1d014dd9a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738650, "uuid": "be9e2561-3ecf-4a61-877d-518447ab7332", "comment": "Malware payload (RedLineStealer)", "value": "3f2dc0abdf0840807a2648660ad3b32ae20577c5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738650, "uuid": "31766e13-edd6-4f85-bb0c-2eb300883bcc", "comment": "Malware payload (RedLineStealer)", "value": "4dfb3993dc5cef077ca81cd23f5304b37d3dd46a8fa01576f3bbd18e1a3015a1809e468c1913c5581f526ed68f4b94d1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738650, "uuid": "fd5f339d-b038-4539-80d8-60607aa0dfb2", "value": "T143252316E7E510B2F9BB373080FA03C30A37BDA18478874A2752555A9A73F91C4B577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738650, "uuid": "415fe6a2-7ec9-4fee-99c4-b8c00e5bb373", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738650, "uuid": "b8055973-38d6-497f-86f8-ffb6ec266177", "value": "24576:JyAEm0/OOumRqZoTnNXKfhuP1dNDKjRvKQZ+JvI:8AEJGOFRqZAjPxswQZ+Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738650, "uuid": "1ae74ad7-9081-4433-9bd3-a34d03f7c59a", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738650, "uuid": "207d1d5d-cb6f-478f-97a1-9a24afae6ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738650, "uuid": "42921f3c-4d42-4a3a-b2d2-943a2109262b", "value": "664f2db3367d95021cf06885c6c8c09e8871ab08b546da9837c4ffe1d014dd9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207e81f4-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752483, "uuid": "e61610b9-c81d-46a0-88b0-97e9006c0224", "comment": "Malware payload (RedLineStealer)", "value": "5b1a1e88cb68c0737cf7ce9090e5492d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752483, "uuid": "03ac93e1-2d28-423d-8c97-9aa787449ad3", "comment": "Malware payload (RedLineStealer)", "value": "6655a6c7132b4a7d5d2d23a8740e094605f86f0fd882223200db23c6f0324eb8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752483, "uuid": "b3bf1af9-be35-4370-9f20-d1fd7c75e63f", "comment": "Malware payload (RedLineStealer)", "value": "2de186dda87005c34f093f98f6651ff72cfe348e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752483, "uuid": "bfc4e74d-69ca-42ff-befb-8ea6eeac03f1", "comment": "Malware payload (RedLineStealer)", "value": "0c24602ffc46dec93f61d584f60aa815a65153e31817da44959a197864a126ad6e52a7a91814de4afdaa4482e462af55", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752483, "uuid": "6b744272-cba7-4557-9092-4ff00320610f", "value": "T118252216E7F81436C9F92B304CF152C31B367C91ACB6875A7B9A7E4F5831291A43632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752483, "uuid": "bdba8bbb-c462-4e94-a7db-e208a8d876ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752483, "uuid": "8e2b983b-a124-4b3b-b254-cbf796b7e910", "value": "24576:ty4M9WOxHm01Gwc6SEhv4Lc2g8COuvg3XYIEX2ih/o:I6LCd4Lc6uvgHYhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752483, "uuid": "816e3e1b-9d0a-4884-9499-161adcdd9786", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752483, "uuid": "dbeab81b-51ae-47af-b2e0-fe61e4ce9a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752483, "uuid": "b74b982e-90ff-44b4-a303-56579ed6478d", "value": "loader867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fce90c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752359, "uuid": "c9ff0398-3f86-4142-9077-85eb7e01587b", "comment": "Malware payload (RedLineStealer)", "value": "5edb8d6e6ead673d1013a6fc178d9a5e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752359, "uuid": "fdc0b197-c190-46a0-a75a-29de514ddc4f", "comment": "Malware payload (RedLineStealer)", "value": "6657767cf9fadb348debcf43f759f69be71896546fa04bd4334c8d744dbe0c57", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752359, "uuid": "73090c85-c9a2-4f02-8d84-ec26800be54f", "comment": "Malware payload (RedLineStealer)", "value": "dcc12eb0d301f597a2090846ea3d97a5ff8ef493", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752359, "uuid": "f15b85a1-196a-4845-a30d-2f1f177d3edb", "comment": "Malware payload (RedLineStealer)", "value": "7dfe389aacb64963b4c3134d99520f6dda38651e3dac185936bf385ade6101b7c823d21d85e34e922fa9d5f7284b43aa", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752359, "uuid": "120b753e-7a74-4524-82f6-eb74396a845f", "value": "T17325220BFAED84B1D830137948F616D3423A7CA19E74C76B37866E464C73394A836B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752359, "uuid": "e383044e-8cf2-440e-8a2b-460305872859", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752359, "uuid": "f5bc2b27-33b6-4d0c-a229-638625dfb7cb", "value": "24576:pyFT7WwUN2n9qmG+5jPToQMV0Fyx9TckXyreN7Buz1:cF/WwU49qmN5jDMV0FytckCreN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752359, "uuid": "79293925-44d2-4d7f-b1a5-444e21bab639", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752359, "uuid": "1546cb87-70a9-497f-a309-80ce28a4180b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752359, "uuid": "ce97f4a4-8d15-438e-a5eb-c4602d24bb4f", "value": "client187.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec194c7c-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738651, "uuid": "624a0c01-cfa3-4df9-bc49-daa2e7a59bf2", "comment": "Malware payload (Amadey)", "value": "35dfa5e9a45e07cdcb4cec94b00e5a79", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738651, "uuid": "00fb6060-b2c6-4d47-890e-5956ef92ea11", "comment": "Malware payload (Amadey)", "value": "669f815573a9cf83d226d5b43fd8926b3d100f7b2fc787b078c855f4c17a97d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738651, "uuid": "45c11850-3ea1-41ec-89fe-34aff954e7e7", "comment": "Malware payload (Amadey)", "value": "32361cfe0e14d3df94d169426b9f2c6b13f16b0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738651, "uuid": "5d5be3bc-ac36-435f-ad70-e51653bee30a", "comment": "Malware payload (Amadey)", "value": "c9ca079465c574f469c1b3fcd40148cecb4f33046f68ffba58bafe18e8da608295fe09d9d07c1eb9874273557b63a818", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738651, "uuid": "0f51aee4-e9dc-416b-b6e5-bbbd3a9a1f84", "value": "T199252303BADC9071D9F5277855F262831A33BCA2C47CC71B668AB81E1C721E8DE39756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738651, "uuid": "bb5e9fbb-a427-4624-81d8-5a86ec70f732", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738651, "uuid": "5f51dfde-0f14-4409-9185-9899bc163039", "value": "24576:Qyj4IVOvkqNeB1SfPTuHMEkw+2ncM0g0kUJO1ZdV:XWvd+1GiHMMcM4kUE7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738651, "uuid": "d16a698e-3813-4d57-8dbe-11663ba78175", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738651, "uuid": "223abf79-7f84-425a-a6db-a7b09fb1db34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738651, "uuid": "dcdb12d6-c305-4ea2-a7d6-1ac5d8f71d13", "value": "669f815573a9cf83d226d5b43fd8926b3d100f7b2fc787b078c855f4c17a97d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9709afd1-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1684752682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752682, "uuid": "19a65d0a-d5d0-4ff4-9ada-cb88db57459c", "comment": "Malware payload (DarkCloud)", "value": "61a5fe3a5b2a0e678a76a56ce971e867", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752682, "uuid": "766c719f-6bdf-4295-bdc1-0b7f89a4f9c6", "comment": "Malware payload (DarkCloud)", "value": "6702d83cf217ca30a4176ffe7f5f4d2dbd18898b0136be95373c9b5d4b79f228", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752682, "uuid": "33f48ddc-f8bb-4dd5-bede-5df179723fb4", "comment": "Malware payload (DarkCloud)", "value": "b5733d287407a0f39f3ff95d982454af52052e53", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752682, "uuid": "c72a4c0d-85c0-4a38-9ab6-5faedf5fc236", "comment": "Malware payload (DarkCloud)", "value": "5ca8c145eec90a647a52ad5327f6e8e8b0e4da2dd71db5389db8fb9acd6bb92d98be6c8deefff1878f5264487fd22457", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752682, "uuid": "90a3e718-e487-42a4-98e3-5bb69eddfd59", "value": "T17875BD5233B57621F47D73FD00196388CB39B44A2022E22A2F5A3AD546D37EB771A6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752682, "uuid": "cb628a8e-2d5e-42bd-b8b8-c2169d17ceea", "value": "24576:8tIAuLop2vS9uo5frpVB+O08dhvAxkkK2vqN/:1AO6YctvVzv8K2v8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752682, "uuid": "0eefdcdd-72f5-47c4-851a-cf3d8bebfe08", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752682, "uuid": "5b2832ae-c5a5-4b45-8c76-f79e3f4d4b3a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752682, "uuid": "53644843-31de-48a6-8466-fdf311fd4c5e", "value": "PURCHASE ORDER- REF QTE-2202689.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f416887-f84a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684723490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723490, "uuid": "75f602a2-c25b-4bfe-a8db-e19fe98e6d37", "comment": "Malware payload (Mirai)", "value": "d1f6e9cd41af8e9f35aabd756cbf694e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723490, "uuid": "1df4b484-c0db-4576-8453-eaa11362cfb0", "comment": "Malware payload (Mirai)", "value": "6739b6d2bc0133ee200811665c164c0e0866cc9223a00819844d58568a7e4ca6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723490, "uuid": "de5097b6-6e06-437c-a21f-8d116acd1d01", "comment": "Malware payload (Mirai)", "value": "d795e090d1d84e8469fd30cd0daf4dc54091eb26", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723490, "uuid": "4ce15744-bada-4d9b-a341-0f5a2059c8c5", "comment": "Malware payload (Mirai)", "value": "8d8dfe839acb3f5f6aa81d3be19eb170527387b793107c4c5b5132c3c281055196e44b3236c098e93fa4cb6fdc1b5b6b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723490, "uuid": "85901be2-8e27-44c7-b945-7c61f874c08c", "value": "T1BFE3A1C3A456D5BCE44890380EAAE1FC8440B4A971756FFEBA89BF751898BE0FC4D435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723490, "uuid": "cd6aac8b-568d-4dcc-8ab5-a94f421de554", "value": "3072:RrKxwZVn5LIuqD5kttSCFwDzqMp6Vdlicxcqnf2xquY:RrywZVn5LIFD520CFw3qMp6YZ2fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684723490, "uuid": "9c5c24d4-86c5-4f9b-8473-c563fc1a970c", "value": 145600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684723490, "uuid": "7bf6ec0b-8d7d-4424-8848-01286b7c98ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723490, "uuid": "996083c3-a78b-4648-bea6-f094f14aff8b", "value": "d1f6e9cd41af8e9f35aabd756cbf694e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f2a3fe-f89f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684760000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760000, "uuid": "ed8213e0-0b9d-4a6e-ac11-759d2aa42239", "comment": "Malware payload (AgentTesla)", "value": "c1a0d16468ab1dbada80e546adb073b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760000, "uuid": "bb5f0f78-3e55-4be1-aadc-e07254c6282f", "comment": "Malware payload (AgentTesla)", "value": "67aa6dd3cfc208be2bf9bc11b9e2ab4dd59f594653f4f073c8b96b5f5872c286", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760000, "uuid": "6b933db0-c308-4b01-9943-fe5417ef9fd1", "comment": "Malware payload (AgentTesla)", "value": "05595c8b72d01045b7c09a254399788f7cdf116c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760000, "uuid": "8d053f2a-92fb-4016-b8d1-0e3938a3c059", "comment": "Malware payload (AgentTesla)", "value": "7dbef817499af0c451762abd7d988d28c9f0be1f3d8dd980a7c7df1ec52f07d4ad09cbd0c8042538089b82e448c6ad39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760000, "uuid": "a16d0346-9a81-4094-bc77-4b8dcd2b48b8", "value": "T1F8F47A5733B97619F47D72BD00245388CB38BC4B2012E11A2B967ADD52F27EA770A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760000, "uuid": "6450b19d-e943-4f59-a258-b9f46e8ba2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760000, "uuid": "6cc43e67-5bd4-460d-8a57-1edf93b4fc07", "value": "12288:wvV+s1bSQT6tjjdB4zdIu5oM3U6trvo/e3sO7ZMhPYexageGOhrCxNHbM0TOyHL+:wtVyu/31dgyWhPYeglfIm0THLXzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684760000, "uuid": "a4f003b9-74d9-4b94-962c-afdf7dca688c", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684760000, "uuid": "129b68b9-444b-4f80-acea-030b2c2fb2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760000, "uuid": "7d8327a5-6038-4b9b-a160-91b152353cf7", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec56b502-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745953, "uuid": "e9f41d64-a7b5-4ac6-9418-5fda4407fef9", "comment": "Malware payload (RedLineStealer)", "value": "f248c7aae2601b1a02194856d6fa81e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745953, "uuid": "f5dcaf5b-0bcc-4189-9368-8aabd4099d12", "comment": "Malware payload (RedLineStealer)", "value": "680b1154ca1889304151e7f8392223f9c212b9a7068279f603229e30c7f1ee70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745953, "uuid": "64a4b019-5956-46f9-993f-ffb14fffe96c", "comment": "Malware payload (RedLineStealer)", "value": "86980fcc9a3d06d8d6bdfd007d85d191529010db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745953, "uuid": "8977d1b9-4781-486a-8f05-caf933c03e87", "comment": "Malware payload (RedLineStealer)", "value": "ed3da72259e71c4ec1c361f5da81ca8c492a2121ab5846eaee2e42b2bb2bac643571542e5ccf50f551a0f6483a89b1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745953, "uuid": "4899753d-2bee-4b4c-b51a-5dc04e84ab0f", "value": "T1DC252262E6D98032C8B617746DF763D31E36BCA09E28971B2705AC750C732D6AD313B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745953, "uuid": "1a546a20-e062-4d99-9b37-aaf75c23c9f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745953, "uuid": "f648e38b-799e-4136-ab24-d54fe5c34ceb", "value": "24576:CyVvLQfEg6jOHTofquNtxAQq7hY6FZlp/X5mR2Ak:p9LjgZHTofqQKhJltkRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745953, "uuid": "0517dd73-2df2-4367-8812-f84b3cf0b0c4", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745953, "uuid": "2c379ae2-ee14-4731-a1a5-0f2b468d9ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745953, "uuid": "87d9b346-88cf-4ec3-bce5-4755117e6e02", "value": "f248c7aae2601b1a02194856d6fa81e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77acf2d-f8a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684764332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764332, "uuid": "bfc046f2-0eba-4f9c-97f0-880654a2ec56", "comment": "Malware payload (Formbook)", "value": "df8b6cc1f871db34157a3d23f85450cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764332, "uuid": "1c975308-9ade-40ae-8e20-8188b8e27f83", "comment": "Malware payload (Formbook)", "value": "688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764332, "uuid": "dd2c475c-baa3-4742-9513-5fc9e7dc94b9", "comment": "Malware payload (Formbook)", "value": "d9c03b376704e43ac5ce983a15b81a5010129aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764332, "uuid": "62c2a346-d564-41b8-85a0-3a947a3beaf0", "comment": "Malware payload (Formbook)", "value": "3ab849b4ddbe50e2a4f8eac9ec1ca0afdc565100f6be06f3a93ef527fa9a40eaa361811704b2cf3f0b5103c13784fb57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764332, "uuid": "7f823f7d-6801-4fd4-a73c-d7d8824982a9", "value": "T1E964E12176C0C071E17306304AB1C6B68B3BB86187B259CF6BE1567A1F763D2DA34757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764332, "uuid": "a4701ace-79f2-439a-abfd-01908815c733", "value": "91e52b5b5b8df9c17be98b9e4559a03d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764332, "uuid": "d9cf7943-d8a8-4a42-9b55-1ba50209f5ee", "value": "3072:NuuVQvdgLdXX4TZtFxV6qLaKrxV+SjCPGCl4tk3xMIlx29vSRqGPalkzWcB1fqfF:x+m4rFZCSL44tk3Wy2o1ylWhfCOCDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684764332, "uuid": "a9f9c8b8-9e3f-4c8b-9f05-7c1fda7ef05b", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684764332, "uuid": "d786a964-1958-4d89-8802-9374acafe521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764332, "uuid": "73c91448-b27b-4db0-a923-624a47f89434", "value": "CAMSCANNER PAYMENT DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33b161c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752353, "uuid": "d2f487d8-e56b-4f58-b7b6-7045148135b5", "comment": "Malware payload (RedLineStealer)", "value": "da6014af034c2e86e59b5557bf6cec47", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752353, "uuid": "85fa0a89-ade1-430c-80c1-3b1c54403326", "comment": "Malware payload (RedLineStealer)", "value": "689bf1ceb7ab321316278bdc5d10f098d37c1d2992d9d3c453bca028cb506859", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752353, "uuid": "8fe5afcc-87c4-45d0-8769-acff7e399b38", "comment": "Malware payload (RedLineStealer)", "value": "d74d2f17e556a7107aedb73b1f993ba7283f30e6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752353, "uuid": "3bb817de-af24-49de-b62d-9090bfaa8a1f", "comment": "Malware payload (RedLineStealer)", "value": "a34a564ae3359196d99c5ff47e4cffe2189d76517944d55f47cd7760f98d5b376249abbc1209c5d0055a6e7356ee564c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752353, "uuid": "93da8351-b98e-442d-b323-24029ad2728b", "value": "T1F225230AA9CD6036D8B133706CFF53831E3ABD224D744A7A17496A1D4D326D4AC76B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752353, "uuid": "f5ca4a58-43c8-4071-9cdd-bf4fe1bd22b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752353, "uuid": "8984a013-d002-4768-a64d-ddc42896e962", "value": "24576:YyK68cvrmJ8quInr3BiCKn0+Y1UeCH1CS8wezXA9e:ff8SmJ8quC3Bi7y1U51qwes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752353, "uuid": "fa88ebf6-ffd8-48c9-803a-4d1d6594663a", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752353, "uuid": "ee5c84e4-601e-45ac-b4af-79797d2f02ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752353, "uuid": "fd87438d-ea31-40d6-b3da-58766b85078e", "value": "calculator747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990b5b20-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752685, "uuid": "2f03b183-6f65-4d0b-aeae-553cc633c690", "comment": "Malware payload (Formbook)", "value": "7a147f304e1216a50112254f6f20100c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752685, "uuid": "10bff98e-3222-4a89-9c0f-e886427a64a0", "comment": "Malware payload (Formbook)", "value": "68f316caf1db1379d780af6191eef775bd9d9386b58d173263f210eeaae45769", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752685, "uuid": "caa298ea-27a7-4d6e-936d-4f39d3f6103e", "comment": "Malware payload (Formbook)", "value": "3e888226c6e78fa69ff0e328e21d244acb41a9bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752685, "uuid": "c830519e-70c1-490d-91cc-f83f8049469d", "comment": "Malware payload (Formbook)", "value": "1285c46aef4253147246405c14ef0061b5bc0c2d558cd6772c823c9e41b2c8a66f70beee324d7ec428de36d4352b6f47", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752685, "uuid": "49993855-1466-40ff-8c02-04a541645ff8", "value": "T154E433A5BB3B80E09BA9F72ABDB7F4D4ECF184EF895047543E857017272103492D2A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752685, "uuid": "3b9aad17-87c4-4ec4-b85c-528b82844a07", "value": "12288:N0fm7fa11HVHHD/MZXzaRUyC0ZjFBx03z9I8fNq7bOwyf1bAQ00Cev70AK:N0+7fqHVHjwORJC6jFA3zpfNqOdpkevW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752685, "uuid": "653c72c6-b3cd-489b-ba12-5b03e6fea490", "value": 686538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752685, "uuid": "2ce4e139-ad67-4c07-a549-661f0419c182", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752685, "uuid": "89d701e7-df81-4469-a4d7-c502f8550e16", "value": "RESonak Corporation new OrderPDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da7b006-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684744908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744908, "uuid": "f2c93dd7-cf1f-4398-b7a2-5140fdd0d5dc", "comment": "Malware payload (Loki)", "value": "eb32a109da2e5ef12b0c38bf795f9d3c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744908, "uuid": "de16635b-7f8d-4f84-b0dc-d7369092448b", "comment": "Malware payload (Loki)", "value": "69704e1557eedaf80a571bd9085928698abf47299b32ee2aedb04fabb4de5f97", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744908, "uuid": "19ee2b9b-ee42-4af0-9470-5b337858d002", "comment": "Malware payload (Loki)", "value": "aa4db4468c57681bf9ecec8a0caf0e52822db9ba", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744908, "uuid": "a2552278-781d-4b18-b901-f46de7ee1a35", "comment": "Malware payload (Loki)", "value": "efe0dffa36ae7a60fc6a2f56291da454c7605d5a3899368f2bf458369f84d2a0b515da84d91fb76851c997c12ebee11b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744908, "uuid": "b513020f-b844-4c52-8796-f439fd69ad6c", "value": "T13D45F102D648AD8FC68547B06B4B7898621D7D72BAC55987370CB35F0FF3AA5AA13C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744908, "uuid": "374a0e6e-8250-4ba2-bddf-a0f19bb9571d", "value": "24576:GLKE/ur/4QmQmz+MXU2+MXU5lYk5YuxoNXXXXXXXXXXDXUXXXXXXXSXXXXXXXXIq:GLKWcI+MXN+MXYlYONS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744908, "uuid": "98f8d241-8542-4784-94ee-27646e2b309c", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744908, "uuid": "3e69770d-c63a-4e59-86ec-4c36e406aaab", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744908, "uuid": "af90ad91-7260-4d66-a379-e8fed7e2e798", "value": "PAYMENT ADVICE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383b7850-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737061, "uuid": "77d18c0b-e5ee-41f6-aae2-387092724d7e", "comment": "Malware payload (RedLineStealer)", "value": "7e25333496284a03ac7d7bd2aafa8ef7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737061, "uuid": "316801e8-b9c0-4ebb-9ff0-af7b737fe986", "comment": "Malware payload (RedLineStealer)", "value": "69ff13ada0d47c7214df2f339fba6694ce8d57ccf8d004f24f211fbb875aec75", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737061, "uuid": "e65177bb-38a8-4bbd-9311-2b4b5fdb0451", "comment": "Malware payload (RedLineStealer)", "value": "a02a761fe57363c4c0cb8356651c05d83152cc46", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737061, "uuid": "5751f270-4395-4feb-ba0a-dd6e1622d5f6", "comment": "Malware payload (RedLineStealer)", "value": "997015de8dd9de6234d0269c6bc007e143dd4f029cb634b98bd686edcdfb213d39ba2f94f31702d18a4c14ee4684b252", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737061, "uuid": "b34b5926-fb30-490a-90ae-55c614907fe7", "value": "T165252342E6DCA422CC713771E8FB03931A36BC608D75866E3B816D674972941BD72B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737061, "uuid": "20383cd9-fa79-4c00-a4cb-6af1b67e5b57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737061, "uuid": "ce32d521-790a-470d-aa0b-7949bf465713", "value": "24576:pyfs/DfA/MMBQbq0CFdiw61rhfOR+0h8qtA6B3TnYhswq:capMoq0CniPGs0Zq6B3TYhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737061, "uuid": "5af8b178-1ec3-4ad0-808b-6b03600b4329", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737061, "uuid": "229438f8-dc36-4159-942b-4877a833824f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737061, "uuid": "ba71bbb8-eab7-4169-b090-c30d0a4dfeda", "value": "24468592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed15cb19-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684738653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738653, "uuid": "fe9e217b-bd85-4f63-ba0d-d0dbcacdd253", "comment": "Malware payload (RedLineStealer)", "value": "2373e2802e3b183f85bc6a48b7c071a0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738653, "uuid": "ba24de6f-55a8-4096-a608-4365044c4297", "comment": "Malware payload (RedLineStealer)", "value": "6a434f36508c77ee3f1c103d4c0b9e5dc9abcf4d6b9c2c1a791459ff4ea3abdc", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738653, "uuid": "01735926-ecee-4343-b115-e7ea1b3458b7", "comment": "Malware payload (RedLineStealer)", "value": "cc94caae860fb912553e84e55c32b04876bb086b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738653, "uuid": "41d0d941-2a8b-4ca0-b7a4-78357b82f411", "comment": "Malware payload (RedLineStealer)", "value": "dce8ca71a7681851ab0d307b0b9444fd0d04e7f1c26226ca865fe733922dc1a77aca048c673b7e6a4876761316f78365", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738653, "uuid": "ca425498-7c5c-4b7a-ba9a-30f070fe702b", "value": "T148252313EBE98467EDE9337468FA52530F367EF09C7406632680896E6931740AE3573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738653, "uuid": "87c9a9db-bd91-4ea6-a00b-13b9cdd3d7d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738653, "uuid": "f3b4c880-ea8a-499d-8d91-f0caf3219e99", "value": "24576:MyFYEJ/eWZMrqbaR2u9nPcrpWQxG72MJz:7yEJ2WMqbg2u9PHQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738653, "uuid": "479eb304-a87c-4003-81d7-2ca2fd117445", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738653, "uuid": "4bdfcd4a-ee4c-4700-ad13-84061369c4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738653, "uuid": "978333d6-0ea0-4d8e-b8a0-103955966866", "value": "6a434f36508c77ee3f1c103d4c0b9e5dc9abcf4d6b9c2c1a791459ff4ea3abdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4101db9-f8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684789211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789211, "uuid": "8bbe5b95-ef29-4276-86af-04cadb5cbc22", "comment": "Malware payload", "value": "1697d7a7c5a32a2fcd533b220bd4618d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789211, "uuid": "d69a6667-f85e-48f0-b444-c951ffbb7228", "comment": "Malware payload", "value": "6aa2089b50ca2d6792f3f8b0014587d631575a13c8af2807ee0e0f91df0b6e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789211, "uuid": "9ae6a5b8-6d73-4474-94f9-6f3652460753", "comment": "Malware payload", "value": "be4e2a6226931d27fdaa6a0d1145381cfa906b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789211, "uuid": "7e02b759-5203-40b7-a0f4-df7bccc63608", "comment": "Malware payload", "value": "773bdbd621f56e7ea8952b45bf57805ff39863a958517f28bf5329e8bfc1593515d4c84613b3dd49168e759901531a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789211, "uuid": "92f58441-6366-401c-92b0-3b8c72bf89fe", "value": "T132763B07F85180E8C1AED230C62692A3BA717C955B3027D73B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789211, "uuid": "6f1f1609-dbef-4add-8571-15d0ed633fa3", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789211, "uuid": "be88e37f-6c4f-4ca0-ac4f-28373c0517b9", "value": "49152:De5y2JM5tXNXrb/ThvO90d7HjmAFd4A64nsfJi2tZujXRfcf1j3rd/DIQYOLU47d:U0Bdfq/scnS6pyVEuAz+7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684789211, "uuid": "1133277f-9314-40fa-af5c-f55b1a8d69de", "value": 7806464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684789211, "uuid": "587f7ee7-7332-4e2b-a85c-6a8e27cb79db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789211, "uuid": "0ed51298-f2cc-4452-aaec-f7769dbd0cca", "value": "windows_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8034aca0-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684745342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745342, "uuid": "5dbb6a67-bebb-4651-9c97-dd01f0997742", "comment": "Malware payload (RemcosRAT)", "value": "50fbbe5308873263be2e63f5a1e9c307", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745342, "uuid": "4a3ece77-8b83-42b2-885c-61b2acbd1673", "comment": "Malware payload (RemcosRAT)", "value": "6c0ada79dd45bc04b221641b23a396d9e26b478d107f779ce5b719b991593778", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745342, "uuid": "8399f370-79ba-4af4-bfee-251d30eb00ce", "comment": "Malware payload (RemcosRAT)", "value": "1b840fbb1de8d83a083c557fad2fabb89c02d29c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745342, "uuid": "d6f80e05-51cf-4f39-94b3-b43863c61d28", "comment": "Malware payload (RemcosRAT)", "value": "7ecbff87f360e39755daba441d24e38b6807a3a4702fc41ed80efbd4fea7b02698e49b07588a4b0371c842cd22ff5508", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745342, "uuid": "b320546d-681f-4765-8e61-f188f5f3d9e6", "value": "T1695533E3D866E11AD2B398323C134FD59B007B5876147D238192276F28A16DFA7D93F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745342, "uuid": "b633dc91-763e-4c9e-899c-54a1fc4cb8df", "value": "24576:SChGAB1WAR4haC3ywivAkOOx7OaWAR4haC3ywivAkOOx7Ox:SCf/CCRAkOrKCCRAkOrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745342, "uuid": "7b8cf254-bf08-402b-8119-ef5ee2d85be7", "value": 1306368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745342, "uuid": "2345bbca-4056-4f3d-b137-044979a57c0c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745342, "uuid": "552eaadb-7d95-4c70-ba9f-043cc3bbf44b", "value": "RWR0000INVOICE.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0be5b2-f834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684714005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714005, "uuid": "d7ee6c31-6976-42eb-8fda-fd26d63d7e31", "comment": "Malware payload (RedLineStealer)", "value": "99c5fd9eb254902fb104d6ee3d08b596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714005, "uuid": "80461698-dd4b-4ef9-876c-59916220bc5d", "comment": "Malware payload (RedLineStealer)", "value": "6c493ed68a392eee1cbe0eba367effe396fd3f648906def5ed6e34c28a5f02a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714005, "uuid": "c9e4ccde-831d-4e16-b0de-a787f89cd54f", "comment": "Malware payload (RedLineStealer)", "value": "7b03b5ea2d7897f73d21a3904f1b45cdaba84f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714005, "uuid": "491629d8-d564-45c0-9607-29a26e00cbbe", "comment": "Malware payload (RedLineStealer)", "value": "3325b6f8ba0db96b99020ce1ed0173df909f9eca252d4a248b9099806fb91661a16f64efe8bd129b48ebbc07a29733ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714005, "uuid": "37aab4b8-b169-48d8-9e2e-78f63cec21ed", "value": "T1572523561BD09576DCFA03B04CF202931B367CA28878935F2748BE5A4DB3BD56A7036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714005, "uuid": "ec0f63c0-5dbe-4047-a0f4-830a24d0c3c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714005, "uuid": "9107ef77-d197-444f-a86f-c68f24468653", "value": "24576:dy9ff/Yksf2U8vaFy6opoHIcLHLHjFheVChIJ:49jtT6vHb7jFhEuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684714005, "uuid": "5cb03c91-4b52-4006-9568-539479e544e8", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684714005, "uuid": "68696587-a945-4f2c-9266-9182060f9d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714005, "uuid": "8006584d-3b0b-4c4f-87c0-320fea4933b5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc6bdfa-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752669, "uuid": "bbfc11f3-2ba6-4be6-8141-dc0fe0178dae", "comment": "Malware payload (Formbook)", "value": "ee9015dba8e57de7c85dfa0f123e355e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752669, "uuid": "7a965330-6654-4365-9c7c-6aa4af9134eb", "comment": "Malware payload (Formbook)", "value": "6c5b4378745340c16dea4416b667471193eb51246b48c0a2e69b7c22ec94c3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752669, "uuid": "81ac3ad0-a90e-4006-b1a1-490385ba4639", "comment": "Malware payload (Formbook)", "value": "17d0e1882520aedcb3c8364828774483116d27cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752669, "uuid": "b33b5077-804c-45fe-9c4f-dd3fe8aa46f0", "comment": "Malware payload (Formbook)", "value": "7723bb7dc81888a00bbe083ec6f119cc9c509b0182e70d4e0d4554659d8b9318c251e224249f425011d89607e06e7545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752669, "uuid": "5f1697e6-a2b9-4fb9-8710-4e33a7f5e14c", "value": "T1D7F4F1C12A984E10E69A5EB50AB2F2344379AD51EF23C74D28F46C8B7C56BC27B017D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752669, "uuid": "9273b8e0-98b3-416c-96a5-274c60b3b06a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752669, "uuid": "1f63b671-078d-4d78-88ad-d7689234ffcb", "value": "12288:UTyx0YPX/NqPs+mYQ261glD6CMaIRv7e9Kcwejet/kZ3IVSIcTB:UTBHPsLYn6nuOe9Qkb0SIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752669, "uuid": "cd395544-8e54-4441-a591-5fcb8e7450c7", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752669, "uuid": "4b4fa8b5-2646-4ee1-9252-42dca9d0fb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752669, "uuid": "3ffbccff-93d6-444b-afa7-3b53fe90678f", "value": "International Remittance 023ORMTT0045123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846d8f26-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747926, "uuid": "29b1e88a-08c7-4d37-ab2a-63d5678b38b2", "comment": "Malware payload (RedLineStealer)", "value": "f5d4e5fe1bcf300fd6ad7d438bf30ae0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747926, "uuid": "a7e8d106-454f-492b-bc6a-1d0fbc4d4669", "comment": "Malware payload (RedLineStealer)", "value": "6cda05cfd27c45c1551fe29593905f510eb80611a4d61f8dcd5a3d44fdcb13b4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747926, "uuid": "be19c88d-8157-4eb8-885b-0b96cffe36de", "comment": "Malware payload (RedLineStealer)", "value": "88a3176f3a043f7b7bcfb7affbf0cb0c31507957", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747926, "uuid": "33da7d6e-82cb-44b3-ac49-f1083818044b", "comment": "Malware payload (RedLineStealer)", "value": "50c38c78ea037a513ade471a23d0a6dc3cd2f984ba2fd0faa5c6b203e2c998fb1c595e70b65049aa61b8c3e2443a7a0d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747926, "uuid": "262ebda8-9139-4049-a4f1-efa623e65213", "value": "T19CE3E824279F8930D6BB493DACB19DC076BCEC12A942D34A4ECDF1593973B80DB116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747926, "uuid": "3fb40f55-ad5b-46bd-9de7-bcb1aa99fe60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747926, "uuid": "01403e86-27a2-42fc-81dc-b62fa23dce53", "value": "3072:oV+m5czQmRS9Ynk5QXNhhRbG5h5Zx8e8h/:ojKtM5h5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747926, "uuid": "c4b8f028-f706-4767-b60a-36984389645c", "value": 149304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747926, "uuid": "561c6e68-bef1-49b8-b79b-c12e5b454950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747926, "uuid": "edf5805f-6773-4d51-b9e3-71258fa2f810", "value": "filter822.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e3e3c-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745940, "uuid": "eac65bbf-64d9-45f7-83ea-2386293e5eca", "comment": "Malware payload (RedLineStealer)", "value": "dac083cd48766cc0ec5f392a93605911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745940, "uuid": "fd22720d-fffb-4e60-a0c0-04308cca1d1d", "comment": "Malware payload (RedLineStealer)", "value": "6ceb43d53d43670fc4eeb39ba6544b6af92f422a6bdd41302c5e1b029766772b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745940, "uuid": "e4cdd2b9-f88f-4cc5-a04b-45426b982015", "comment": "Malware payload (RedLineStealer)", "value": "a94402d0e111cc659202d31bb1d22801265f0178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745940, "uuid": "9c1e0804-21a3-4c0f-ad20-b717e17d6118", "comment": "Malware payload (RedLineStealer)", "value": "ec497141142772cc6770c610982929fa519ccae0d4c69db4c19cc0fd9321fb991ece88080287e905b90f73734d23daaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745940, "uuid": "75122e2f-7c64-4b06-97a3-a8dcf14b458d", "value": "T181252313A6C86061ECB3277094F747D31B38BCD09E3483AA379A755D59322A43A3277E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745940, "uuid": "635d5b53-155a-4742-8439-802112b83780", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745940, "uuid": "2fda036b-6e80-4934-bed0-73957562b0b9", "value": "24576:Ry+T+p6f9RRYqHeAXs7X45xYCG5hGYXv7clyjuAeLlyAV8:E+T+p6f9YqHNXaOaC0hG070ylkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745940, "uuid": "3e007cce-c4a0-469b-934b-ea0dcdbe0a74", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745940, "uuid": "690cf373-bd57-4c44-910e-dbd3999d1799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745940, "uuid": "3da2bb86-e9e2-49c5-8a34-eb9d6b5fb185", "value": "dac083cd48766cc0ec5f392a93605911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc16e20b-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751992, "uuid": "c8954d47-6cd9-406f-a1ca-90db1a5d14f8", "comment": "Malware payload (Amadey)", "value": "fc46913ddba0d5607498935047840384", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751992, "uuid": "9d921ce3-c365-436d-aeda-06ab780ad8f4", "comment": "Malware payload (Amadey)", "value": "6d2af725f72ee92c719ddebf98126f0bbbacdec4895ae3502faa5eb3997a9c21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751992, "uuid": "cc0f22a6-e568-4f46-ab16-7f1633e0b6ba", "comment": "Malware payload (Amadey)", "value": "a7a396c50e0ff3750930bf1ea5ee9ce4133d1c5f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751992, "uuid": "48e50b92-a75a-44a1-b510-6a71718a8d59", "comment": "Malware payload (Amadey)", "value": "b609d3fd9c0130bca9b3f62ea52117732bf7ce11890b9c99f830bc1d6df71fcfa97680d8d685f0a907fda6a694a75c8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751992, "uuid": "9b8cab81-2094-44fa-ac4d-3bf9908644d1", "value": "T1AC25235267E880B3C9F417B199FB06831B31BCA19CB8D337239745AA5DB3AD4A134367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751992, "uuid": "73a3ed79-4ea9-4351-b1fd-28222b685d5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751992, "uuid": "d6aeb182-e594-4826-822a-f42e73365430", "value": "24576:VyWtqwH0K5sEmWzjwFsjxoeI2lASgBODEKDjeumN:wwqwHPtAFsjWulASI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751992, "uuid": "355370ee-284a-4d92-a6a9-d15f629cdfe3", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751992, "uuid": "c7dc3e6a-ae83-4af1-b24d-ad5f369f1f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751992, "uuid": "295b7d50-4892-419b-a047-b75e980c3d4d", "value": "loader785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399b927f-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779583, "uuid": "9e248ce7-9a22-45d1-84e9-a1cf4e2d19a2", "comment": "Malware payload (AgentTesla)", "value": "f3be03df82db7515eb59b5ede7629cf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779583, "uuid": "e11129fe-d296-46d9-9f24-864eeab7e8e9", "comment": "Malware payload (AgentTesla)", "value": "6d4fb35f1867014da572205afa5be3569d96479f00cdcdff785dc34d02ec146f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779583, "uuid": "7188981a-ebfe-40b8-88ab-1df9b654b6c1", "comment": "Malware payload (AgentTesla)", "value": "fe5ba2415dcd22e2a560c75dcbd7ecb56a3f6006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779583, "uuid": "58cbb5c9-7c76-419c-b077-9db678dd2e6d", "comment": "Malware payload (AgentTesla)", "value": "bd092c45bae47c90c39e6c6516e48888168dc6ba1c42d2c89d965662e7be49b4f764cc78c30c90b169867d86a796e254", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779583, "uuid": "d2187e40-e4b8-4417-9318-cb320e2f54b6", "value": "T187F49D953375DF1AD87D83FF06F0908C0BB8B446B026E11A5F9735D23270BA66A48B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779583, "uuid": "a162585e-4da8-4456-a040-4b3b7c82edd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779583, "uuid": "cbcb84ca-596e-4dcb-9fb9-015fac12af81", "value": "12288:vDX91YXf+MIqTvhtOt9jJMNKi3nP7AFlPicYYzEdKP4+jvrdY:vR1YXf+XqTvhtOXJuglKNoHg+jvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779583, "uuid": "9be828b5-99e5-4e00-8254-287c0fea9777", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779583, "uuid": "ebd18a01-df80-45db-a2da-6f70399c98b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779583, "uuid": "34fba490-c229-4df4-a4df-78c6a5e50209", "value": "Orden de Compra 2526 RE URGENTE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f64502-f834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684714181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714181, "uuid": "28b4d7fa-33f7-46ad-91d3-b6d7a393e1ae", "comment": "Malware payload (RedLineStealer)", "value": "ded040027e98d0cebdc067d5abc81fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714181, "uuid": "21dc7412-fcb1-4497-ac98-07f9396e422e", "comment": "Malware payload (RedLineStealer)", "value": "6d8f3419d1a4bbacdc3b41336a8690cfb2f90fa7e5c86785a4a676df9bb8784f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714181, "uuid": "8a525a2c-059a-4421-ad6b-df367184054d", "comment": "Malware payload (RedLineStealer)", "value": "202644f8db6d0efc1edd2177585f92f12b3613d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684714181, "uuid": "69e20215-fe07-4b19-a3a2-5a2f887ab181", "comment": "Malware payload (RedLineStealer)", "value": "b5d41533cf9fb1377f659311c797d683675e786bc898b9d10e29f5ab5d795ea84c9e08bf8062e670cef91cac78507038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714181, "uuid": "b30b4bfa-ad61-4ca5-9439-ad5fe41b8343", "value": "T1DC2523127BD45523CEA82F71A8FB43D70B3ABD719CB0831B17505E5B19A264AB0713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714181, "uuid": "96ecf69a-ae14-40ae-9cdc-58120cf42910", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714181, "uuid": "adc4e544-879c-4e25-ae50-2baeacd0923d", "value": "24576:iye4qEZ8KFB/klG+niI5yjG20qRTpv8TKwP5+/VhNrbR:JWEZ8Kvl+T5qRcj5eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684714181, "uuid": "9db4a914-1e63-4915-90a5-866ab08fffa4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684714181, "uuid": "018c6417-9962-4a1d-917b-92573b1a0a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684714181, "uuid": "cdcbae13-0085-44bc-b43c-d4dce3f13588", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4ba882-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745179, "uuid": "8b622f00-cb54-4e97-afb4-86bdd0e8bab2", "comment": "Malware payload (Formbook)", "value": "d63cfdc43ab25f47b84b2bc2e4002ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745179, "uuid": "2b702b00-9310-4bd2-b772-99da5381a7a5", "comment": "Malware payload (Formbook)", "value": "6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745179, "uuid": "2f0fd3b8-27fb-4efa-b899-aa1854d2de23", "comment": "Malware payload (Formbook)", "value": "ee87801c70a1db156cedeb31738a5da39cff1dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745179, "uuid": "f7fe6791-c474-4608-9400-9121134e787f", "comment": "Malware payload (Formbook)", "value": "f5548fafc839cb8f872cfad390e520e3a0f0d506fea54226e391324563ac8b029c2c341ad75baa5efd761c016fe5477b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745179, "uuid": "a31595aa-183b-4495-9516-28a594fca7d7", "value": "T137E4F1C126949C14F6AB5FB94AB6F23442B46DA4EF27C71A24F42C9B3C66B417B017C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745179, "uuid": "bccec47a-0783-4b6c-b5df-5c8bf963ac0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745179, "uuid": "bf3afb2e-28e3-4ffb-9e36-3a971b690891", "value": "12288:GtYx0YPX/NqPsZ0wF9Os3QBtFcqNbttGnQaemdbhIoQC1BmEnq+m:GtPHPs+wKsqbtTaTJrBvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745179, "uuid": "76ea4cc6-0b3b-4027-93e9-ef9f3fb77f33", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745179, "uuid": "fd4fbd49-d000-478f-a1f3-eae1caf30932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745179, "uuid": "df5f7372-e452-46b6-ba7a-3ca8eb5901e3", "value": "Product Inquiry - PFIZER 05.22.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f1416e-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744303, "uuid": "a6038e5d-9a4c-4ee7-b929-714a3563ad10", "comment": "Malware payload (SnakeKeylogger)", "value": "32edf854e42b5323434fce6a04546ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744303, "uuid": "5bb5dc45-9f49-439c-885e-57fba2e435cd", "comment": "Malware payload (SnakeKeylogger)", "value": "6f438e6e004889f2f85032d8d44202f2854ee8cbb884ba1005d1fdaa5b7d8f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744303, "uuid": "128173aa-4b7e-4aee-991f-a9a91ee41bcb", "comment": "Malware payload (SnakeKeylogger)", "value": "5eb698ef55d21adeb80317b97ce37ebfc07dc1e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744303, "uuid": "4d8474ed-4b78-4bb4-9a79-90a443c5402d", "comment": "Malware payload (SnakeKeylogger)", "value": "4bb67d16e794b358b2db2ee9baa0f9e430f5313fa75adc6805288bebd9f9a5fdc19e004cf9b97987e3213350b31ae18c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744303, "uuid": "f065f6ef-0a2e-470b-9092-7747adcc5f6f", "value": "T196E4F1C15B988D15F6AA5FB54AA6F23443746CA1EB13D70D28E42C9F7C62B823B017C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744303, "uuid": "e8fb5c17-f969-4f49-ba51-cccb98f32908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744303, "uuid": "3933d17c-ff51-4f60-aced-809aab4634fd", "value": "12288:uTKx0YPX/NqPsA1OSpfxOJTxC2iiSZ4NT3BolldTJ54:uTpHPsYsTxC2tqsoDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744303, "uuid": "bc65d015-e209-4bbb-bcd6-0cfbf9217580", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744303, "uuid": "92e84caf-5a74-46e7-9aeb-e83653a6d5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744303, "uuid": "a2438204-2fc8-4ff9-8241-5c7facbd833c", "value": "HSBC TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a850128-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684779612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779612, "uuid": "fe547bcc-3748-47c1-8a56-fde5ae1438c4", "comment": "Malware payload", "value": "b239d8601aa55d184cf8bf44d18e7ffb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779612, "uuid": "6f25efbf-04c1-4295-bd02-9b5d21fcd670", "comment": "Malware payload", "value": "6f71d0ec96daa79c7ba3655e06ff8cc3f6d59c5a9cf713a5e940d8b854923b74", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779612, "uuid": "b2e60783-5f63-4a5d-be74-615d330620e7", "comment": "Malware payload", "value": "e91823bdf6c822ef6e10cb010ff29f79ee32d158", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779612, "uuid": "480da2fb-6376-4d29-937e-93a7e671d822", "comment": "Malware payload", "value": "0f63c87cc31a1ccf5b0bb83dbef64be8350be93e694f2afe0ae934d96128c0b2d5703016950dac3dbdb20d7d0895a679", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779612, "uuid": "ede27abf-0201-4c5a-ae34-5d34fcad379b", "value": "T1D924AC5362E85CC4B1F22A13A8BB55314BFAB9959C3DC94D71C4C76CCEE290C98A17E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779612, "uuid": "6611fd22-378b-4c0c-a90e-32fe550a6fc0", "value": "768:XnHGdUBDCKtfYjE3Luo4+eaWTYFPk9Wai2d:XHGd+CKtfSo4+4YFNai2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779612, "uuid": "560c79b2-a67e-45a0-b621-c94aca335a9b", "value": 228140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779612, "uuid": "80b5ced7-8c37-4a8c-8356-6aa7670ecc76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779612, "uuid": "6c1e93db-7eae-4454-b84f-97a4cf5206a9", "value": "ORDEN 679564.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c3d850-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684779597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779597, "uuid": "4e5effb1-accc-4cff-b643-adf1831e7493", "comment": "Malware payload (Formbook)", "value": "c32fa4afac006aeea5067fd19c30e335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779597, "uuid": "7014a75e-c9e3-43bf-9e8c-48fbdaf3c499", "comment": "Malware payload (Formbook)", "value": "6f9e6daba8384e0535415277476d0bc21a6943ed2cd1483b18259280fab5e2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779597, "uuid": "f27e6902-072d-4d1c-b609-068dd7c58d38", "comment": "Malware payload (Formbook)", "value": "12e9e6e7e31f2a21a2ae9795bedf8a2c644f3b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779597, "uuid": "759a5f33-a974-4e63-bdee-27e4150e783a", "comment": "Malware payload (Formbook)", "value": "18434b3e760a10f772e44de0985aa0514184f583d7263f2c608b2c81b0108a9e651453cd20be47b7a1b14ab651c2690b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779597, "uuid": "a7bb5a4a-1496-46e5-8de1-39031605e3b2", "value": "T187F49D953375DF2AD47E83FF06F0A08D0FB87506B026E1195F9635D27270BA26B48A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779597, "uuid": "7d9a8825-a5ab-400c-9480-722cbcfd6dd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779597, "uuid": "a8ef7b5f-c24d-40ab-8b4a-0301705bdc63", "value": "12288:IDX91tCfTM2DgUpZDlbVmT8UEtqnRxxtlJ2QTEvldAvfh5jnxv:IR1tCfBwTmtcRdl8QTEtKR5zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779597, "uuid": "92a6f294-cd2f-4de6-8903-ab7c98143307", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779597, "uuid": "6337c175-a7ce-4a8e-a728-353b0b655433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779597, "uuid": "f9f6b983-07ec-4e4f-9ddf-308d614f1209", "value": "COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3927d75f-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747800, "uuid": "727d310a-68d9-4869-914d-9e0b6bdcd626", "comment": "Malware payload (RedLineStealer)", "value": "908fda6e339a1f047b75089c3380ee92", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747800, "uuid": "6f494dd9-7aa1-4ab2-b9e2-ff9845a78a7a", "comment": "Malware payload (RedLineStealer)", "value": "7248bda70889d71a324907943ce52d2a658be049b3b1152eac35929431ccfcfa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747800, "uuid": "d200e47b-1f80-4f50-b672-807a8ceaab20", "comment": "Malware payload (RedLineStealer)", "value": "a6aa01dcca4d719b3cb93dbceeb59febb69e4ae4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747800, "uuid": "a9704fe7-29ae-415f-ac98-1ddc653f8f91", "comment": "Malware payload (RedLineStealer)", "value": "3bce2a8ee8ecdefeac2814b48e0bbff05e5ddf6d5a50866d3b0efbeb5063fa5b86f524703e41a5e0f2ddd8b410bec84c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747800, "uuid": "e8c71f51-015a-4783-b8c7-5d02681c84b0", "value": "T143252326B6C45463C9B127B048FA4AD30B39BD915EB4C22B378A9E5D1C726D8D93037F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747800, "uuid": "ce335cac-8a5f-491b-818a-06752a896919", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747800, "uuid": "b6fce75d-2b47-4590-a003-deaba0f16c89", "value": "24576:+y4wCfUB7aeJIHTJv/NNxz0Ckuxl43Bf2DbLEi6LA9sB:NL/Chxz94f2DHEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747800, "uuid": "71b54a5c-c3e3-4cbd-a3bf-ccd13462091c", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747800, "uuid": "47000782-1a66-4710-bb0d-4d13cbfbbc67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747800, "uuid": "afad0196-1788-4f93-987c-b57a808038ac", "value": "1212324290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0fc0ce-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737552, "uuid": "1fec09fc-2914-40d9-80ba-f2b9c6d77a48", "comment": "Malware payload (RedLineStealer)", "value": "efaa3263b5d49dcb4d6821a5c676cf04", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737552, "uuid": "6ce82a32-86e3-4dd4-b26f-134f8fe9ff35", "comment": "Malware payload (RedLineStealer)", "value": "72a04b332e5c3a7abb5548735235baff1f4b4f5eaaacfcc81e7f19e6ce238821", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737552, "uuid": "d08011b4-09eb-4931-9c8b-d927cfdc2c7b", "comment": "Malware payload (RedLineStealer)", "value": "c85bbe38bc82952abb98db55f4fa9db4eef08249", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737552, "uuid": "d332e4d7-756a-4d25-bf02-0dfdebaf2fb2", "comment": "Malware payload (RedLineStealer)", "value": "3cca8cc0f37c1aa41c4da1123ca60476d9d3e849db5258ea3e7421f1ae78e863df84f01888447232fa1b966c14e726d3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737552, "uuid": "d9eef8be-b2f2-4658-a8ad-02af24978784", "value": "T14B2523075BDD4176DDF52BB0ACF211931F35FCA28C689B2B2781AD5A2CB1584D83236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737552, "uuid": "1679d57a-6a1e-45c0-88e5-80f7f7cfdc7d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737552, "uuid": "0b2ed877-4947-4bec-941b-54741fbd527a", "value": "24576:gy8g0yaJp/q+qj86gyqA6E+rZPuc6qCTspnTkFr8d:n8g2JRq+qj863qAspnTkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737552, "uuid": "753167e4-088b-4688-af96-86408ec3d88f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737552, "uuid": "d7be0a15-0aa0-4c71-9b7d-2eb4018d7a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737552, "uuid": "29714334-2a61-4d44-b607-e2f17bb776dc", "value": "parser968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cef9385-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752450, "uuid": "18ce2d69-a665-45c5-a009-589f50a1e6cc", "comment": "Malware payload (RedLineStealer)", "value": "b0f335aa1dc7ece31eb432576876cf14", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752450, "uuid": "d68b04de-b79a-4817-8075-9b4b6b53f669", "comment": "Malware payload (RedLineStealer)", "value": "72d7e0b33b1bbbe20c776479429a273fd8e9f9e659aa55936344bb36848d4172", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752450, "uuid": "29a65733-18c0-448a-9cad-58f841eb1435", "comment": "Malware payload (RedLineStealer)", "value": "ea85702e5ea01347797c25adeb80f6464b9988d4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752450, "uuid": "235fd25d-6c97-43e0-960f-5a7d17c7b043", "comment": "Malware payload (RedLineStealer)", "value": "085bf351264068d9301a733d5f84632836e2fa9ea41d7342e359b518bb31beef2595c2d51b93707672e8b4afa38b921c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752450, "uuid": "dfad7878-c33f-484f-b2ab-44855152a959", "value": "T154252313FEC85073EDB52B7048F603931A347D66A8BD922B2746699B0CB27D495703BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752450, "uuid": "d9ab42bb-f1b0-4669-afc7-9ee2acc5f318", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752450, "uuid": "0ca2158f-3faf-4950-9893-1e54702b3222", "value": "24576:LyXKL2WLjauI1cF3oRKYquFp/vhiDTgufPTRiJUY:+XK3LjaV1ccMuF1yfPTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752450, "uuid": "b90422b5-efda-40b1-ae82-95d740a5badd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752450, "uuid": "224d3261-046a-427a-989c-12236e5fcf6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752450, "uuid": "41ad3495-fccc-44b5-a921-2926feaa477c", "value": "handler703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659bc168-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684747874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747874, "uuid": "8ea54227-c16d-4e9e-b950-b4f2e35d8958", "comment": "Malware payload (Amadey)", "value": "3dcb44ddec1e0eec5a76b9e1c42dc77d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747874, "uuid": "69391bfc-82a9-44fb-ab75-155f5be45337", "comment": "Malware payload (Amadey)", "value": "72dba2af02cfe929fd59874422520ee330ab7dc75d349321fc351814dee3980f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747874, "uuid": "31a8e49f-6980-4143-94aa-466e2a649141", "comment": "Malware payload (Amadey)", "value": "1667716c582f5b26b80b2cbb6c9a0a47ee7c2d4d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747874, "uuid": "ec8b2572-d5e8-479c-8792-cf4b3ebf14ac", "comment": "Malware payload (Amadey)", "value": "7d94d7283d7dd9b967f69e26965da61de27425fc5c3f43e0931a214ee7d4a444f78a0451bfd4795fd1ca6150362052ab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747874, "uuid": "5ce14520-8192-4f8f-96d6-082877118573", "value": "T1982523A2AAD59837D4B22B7054F703C70B39BCE25A38660F2346BD5D0472384F53A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747874, "uuid": "4df7003c-de2a-495b-9b13-e099008f47e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747874, "uuid": "20759ccb-1b88-4da0-a01b-f5e8739003fd", "value": "24576:trysQRGZfT3o9Mv19UtKnjTWiZuOvt37Ek:teb6fEidjQQ37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747874, "uuid": "bc0e9d29-967b-444e-b4d4-210e9a344dfd", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747874, "uuid": "0a6bae2c-d883-4836-b4c8-8b056e255437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747874, "uuid": "81aac99c-b17c-4c27-a430-0f3ddde8bc07", "value": "builder756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22056042-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752485, "uuid": "413466c5-013a-4712-8094-052ad1e949c2", "comment": "Malware payload (RedLineStealer)", "value": "7b0bc7ced44a58e6ea67e257577c7c48", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752485, "uuid": "843fd8f7-0167-4ba2-a6b9-3284d51aa877", "comment": "Malware payload (RedLineStealer)", "value": "72f0d3b804cf905f6d7f652f809d5ae1e5efa30690e8b6abc0bb88cd023da0c0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752485, "uuid": "532a0f85-d36b-43c3-9305-bf26e20271cf", "comment": "Malware payload (RedLineStealer)", "value": "c436037eddb9709b44894c929047fe700ea9e02c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752485, "uuid": "4d936c99-c95c-446b-90f9-5767bc3fde24", "comment": "Malware payload (RedLineStealer)", "value": "018f45b4b3f6812d887836155574e59dfaef4210d8f0393155ab7f5a3dc9f08d4ef5276a2dea88292fcd22dfe2b88dfe", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752485, "uuid": "e9355bcc-abbc-4d19-9795-da09498c0d43", "value": "T1362523179ACCD463DDF66B3004FA07830B38BD855D39863B2655786A0D72B80F972B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752485, "uuid": "33b780f6-4901-4b9d-a3f1-368cd3ef235f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752485, "uuid": "3b6dad76-8d30-496d-95de-b37cb9b12e29", "value": "12288:kMr/y90JLVqesHm+2E3B6VZh75fA35Rqu5B+sxkc6pWE2KJus8PLQlL7zudk28jt:ryaZcm+2m6PoDqMbxkconnqkVTf3tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752485, "uuid": "c9fd846d-2c22-4f00-8db1-7cd2e1896ac4", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752485, "uuid": "08ef4f20-8a9c-4f21-b3af-0e034ba714fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752485, "uuid": "a0f61dbd-bc10-49b9-b1ad-e29f36774099", "value": "logger883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d64f47-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752497, "uuid": "4e98128a-913b-4af0-bcf3-9f065fb6a870", "comment": "Malware payload (RedLineStealer)", "value": "7a8faffed123ebc592314c0de1a688ea", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752497, "uuid": "1fbba461-9d59-40db-916f-1dcee2c8bcb0", "comment": "Malware payload (RedLineStealer)", "value": "741016cc122506710d11ca226ab36257a02481e36193c75775b1985b9d01e84b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752497, "uuid": "bb47feee-80c4-4360-a96e-0d64de81101c", "comment": "Malware payload (RedLineStealer)", "value": "1ecc8c183781e85da1bd4c0d11073c8bba62544d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752497, "uuid": "2c4da6fb-60aa-4246-b9ec-51d13228301e", "comment": "Malware payload (RedLineStealer)", "value": "6fb19913ab32b221942641369e30f305488779a8750c0562554b108ae5509b136bbd3a295f79f5c4525e39ff00cb75b5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752497, "uuid": "91121f36-d8d1-4397-be9a-f83a1e4ad76d", "value": "T1AF252357ABDD5862C9747BB128F602571F32FEA44C38C15B264169A72DB34C0ADB332B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752497, "uuid": "d016e16c-32a7-4f5a-838c-cf242d3a9a81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752497, "uuid": "eb308968-9fb8-440d-9c0d-b8f469e14f9f", "value": "24576:xyfKEYSJYVhTcK7eqASdh7qa2mTz9KdEj81JLEV9EbRLxp8:kcxz77eqXdh7b2AKGjeJYVkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752497, "uuid": "4c516c2e-12f5-422b-ac44-b3cd0afb839c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752497, "uuid": "e8df5731-0e74-46fa-a5fe-15cb5a3a045a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752497, "uuid": "5c726c5c-c054-451f-b55a-d17dc55f6f75", "value": "networking127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8342dce3-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744918, "uuid": "12cb23b4-2434-4e46-a2e6-53528d1f6299", "comment": "Malware payload", "value": "521c7408ffe64b9dac4df886e79ec831", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744918, "uuid": "f3d9443d-215c-4c25-a677-e7cf0c1c9c34", "comment": "Malware payload", "value": "7416db63fa07f02b101da8477459d4e8489c01ffcab99e42e826a7c8a44957e2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744918, "uuid": "c7af95e4-1561-448e-836f-4377039d19ea", "comment": "Malware payload", "value": "0b3745e6c228df6fb84075e520dcd1ba41a4f061", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744918, "uuid": "3ed172f5-3ea3-4044-a5eb-8bb201e3fe83", "comment": "Malware payload", "value": "e2ecb1736e94993528042751aa3b54ec87cc0906078b1617d17933112f09f489fe5080a0595e600f35246fe5e904eb8c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744918, "uuid": "aeb78428-ba2a-4efc-b074-a570cb3e812e", "value": "T10124D315F755C57BFA484B39AA9282971225BC73791AC94721C3B30F2B33FA19D32E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744918, "uuid": "b7d0f245-c8db-4873-bfda-85eaf7283370", "value": "6144:uZ+RwPONXoRjDhIcp0fDlavx+W26nAQV0o5md0g:AGoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744918, "uuid": "88c2648f-22a9-42b0-a950-642a30476d8c", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744918, "uuid": "2a8d1d26-6b9c-43ac-88e3-3e5951271365", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744918, "uuid": "7d6288d8-ca03-4da1-b971-4424f1978967", "value": "PI.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92db219e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752245, "uuid": "be01ebd5-8d89-4b54-bc25-77464a814203", "comment": "Malware payload (RedLineStealer)", "value": "73cd1538d6fb37c08b209faa44dc3553", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752245, "uuid": "032e6414-b8b0-4bea-90c3-ba1f79851d79", "comment": "Malware payload (RedLineStealer)", "value": "743808d3f55cfcd10cf6b9f747cc2495f290b159f8b82adec4a2c24fdea4076c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752245, "uuid": "a6c798b8-d132-42f8-97fa-a1a8bd54715e", "comment": "Malware payload (RedLineStealer)", "value": "0c9cbcce7d8300ba2bf650f136a50a72e6ab3700", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752245, "uuid": "29ae3403-e44d-4ff5-b2f1-b528a4b91910", "comment": "Malware payload (RedLineStealer)", "value": "1540ccc92cd8258ab2156b878e36f83613b038a542e5d15d5d11d982b8e76ed2532122f1e386c366ce442d04d30147b9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752245, "uuid": "cd7c738d-88a8-47ca-b4b3-b239fcf0f85e", "value": "T1D5252303B9C56576ED753BF098FA42170732FDA298B4DB0F36691E5B5CB2D00A87072A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752245, "uuid": "bc708fed-1324-42de-8c58-71935cda567a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752245, "uuid": "cbc23c40-e9e0-4a92-b9b3-7fe61e453627", "value": "24576:KypUe4CXo+/qjUsqxwz7uSeVG0RCvBNXRl8ZFr:R97/qjUs6TyvnXT8ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752245, "uuid": "096b763e-6715-4fbf-8c3c-a93381007ed7", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752245, "uuid": "4b2259cb-eb0d-4d61-95e9-6fe407a1748e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752245, "uuid": "95aa5a09-6088-4af3-8e6b-19fa26ef5b46", "value": "353512876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2bfe9e-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684752663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752663, "uuid": "cf30053e-6ecd-4781-b1f5-850af1c05126", "comment": "Malware payload (SnakeKeylogger)", "value": "a13701031a135fcf63cafa35de62bb93", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752663, "uuid": "34cfff86-fbed-4dce-842a-82532c28ced6", "comment": "Malware payload (SnakeKeylogger)", "value": "74c5ade2fb0d3703be16b4eb80687cc98f56c1a1a2145d53f0706248376f0472", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752663, "uuid": "a6ce1a98-6198-4293-b1bf-17911438f7f6", "comment": "Malware payload (SnakeKeylogger)", "value": "ccb9864f45db6db0d5a9befcff593b5d8299b46a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752663, "uuid": "a7f46a61-196e-404d-83fe-e511eeec31a3", "comment": "Malware payload (SnakeKeylogger)", "value": "df4dc665032d23072285ea8d9e202fb79ff3a6d728fcfaa37751bae8142d6577a91cfaa826244a0a9db549da29dc5427", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752663, "uuid": "67e183dd-2e6d-44a8-a6cf-ee9a79b98a79", "value": "T18FB423090EE9F74452D3F3CB9A03446539C20F3185C8EB6EA2139152576E315DB6FAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752663, "uuid": "dbde9bfe-e877-437d-8d7a-2abd26974bee", "value": "6144:h/M4fBCJUdo7+MnDSFHtBetZkWz56hUE75mygnCN265JYWUyvfKabHYHnoMXS:5M4fCd7+H7PIvnCN/kDyXKaT2noMXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752663, "uuid": "fb50b4c3-fbd2-43d4-b473-4a13b0f4341a", "value": 533717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752663, "uuid": "3ec418fb-58c8-4f0a-a9c5-4f7fcf16ac2a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752663, "uuid": "84bb9159-6c82-4a03-9998-8d3b2f91ee49", "value": "Halkbank_Ekstre_20230321_080804_358439.pdf_1.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19233268-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755906, "uuid": "0d1ee527-b2a8-4e2a-b4d4-f30628883bb5", "comment": "Malware payload", "value": "a4cb0c886907fcc11705d759e84c5403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755906, "uuid": "8355a4af-ef97-44ef-b28b-5598bcde265c", "comment": "Malware payload", "value": "74e6eb96d51cf8b4e251fa747ad435e403154a8b7521a6694e99278ecdf805aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755906, "uuid": "dd9bf237-7564-4e27-8675-0b4573918b65", "comment": "Malware payload", "value": "71a2e937f3f3b4c9248381fc0ad4ad9416dc9e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755906, "uuid": "91b4dcfc-d9e1-47e9-a30c-e0e1033550b2", "comment": "Malware payload", "value": "05b7b079bda96c5c94455862172cac0d220c320cafbc82f420031e45cce74543c737969017b2a5ff5d1f88078ba4cae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755906, "uuid": "5c660661-8fb7-4246-a1ac-ef8d7431f7fe", "value": "T122341226C88710B5E4B720362DF6B1B91179CDCAD9C0685FB9A1F23D6F742342A9E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755906, "uuid": "59a4110e-1d6b-40c0-8100-0e4797bc7736", "value": "1d88d597200c0081784c27940d743ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755906, "uuid": "6c2fae91-e1b8-4574-b01a-8e18196ff496", "value": "6144:WprZj7FrFn26hf5rakYx7VVBxc9mGrPlyycNcHwToS:WpV7Fr86hBQxB5cMGrdqcHwToS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755906, "uuid": "1645ccb0-2150-4307-ad68-a6ecfaac3b04", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755906, "uuid": "dfc6bf5b-fff4-4dfb-be9c-1762a5ba7bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755906, "uuid": "f0df3160-9e5c-4198-b937-f0118455697c", "value": "SecuriteInfo.com.BATCH.Virus.25461.9500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a537c-f894-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684755291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755291, "uuid": "234f217f-706f-4802-8835-30fefa79bb6c", "comment": "Malware payload (Formbook)", "value": "be05c5bc5f62f2db1bdbea191e5b1062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755291, "uuid": "114f3c26-7333-4872-acac-90ba3743fa5d", "comment": "Malware payload (Formbook)", "value": "75774b1adf09d7375f2cc83bb9ff6f6ecee4f09acabbbbcb799f184e80358269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755291, "uuid": "2eb19eb9-0211-40e0-83cd-738794651aae", "comment": "Malware payload (Formbook)", "value": "76823ab85844634b98ea1203340c63bf8acf5d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755291, "uuid": "66aa94b5-efda-4306-90ef-1fd08a336202", "comment": "Malware payload (Formbook)", "value": "654a0f32145aa0faf3a44728fcc89a819f4d4f465fabdcd44cfc026e305d25cb92a7c98581b5b7f83c0e288fae4d87fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755291, "uuid": "e67da54b-9f18-4c56-bc45-024ce46d3f22", "value": "T14254130B5BA5C060E9E60F3845B41F5DC5B8FDC22DA3E22D4C69734728BEA045D97E35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755291, "uuid": "d3715a7b-a57f-402e-bd7b-74b068499a58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755291, "uuid": "5e7e9efd-228e-4d7d-b801-04e6c24e401c", "value": "6144:smDAURUZ2xUYjtUGGJHm8Ul/lxWHwNdjY99l1bqm4DkGI9cL1kBeBGGGJzm8Ul/v:zeVYKJDA2Hsc9l1bqG3BfJXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755291, "uuid": "94c7b7d8-23c6-418c-b0d7-26dd15ed179a", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755291, "uuid": "056b96c6-24f1-4921-94e5-bedc65843531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755291, "uuid": "4625159b-7d7f-4ea1-9168-f7c4e65d37a6", "value": "be05c5bc_75774b1adf09d7375f2cc83bb9ff6f6ecee4f09acabbbbcb799f184e80358269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cf1092-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737265, "uuid": "518ba054-b02c-4195-8647-e4f532d400cb", "comment": "Malware payload (RedLineStealer)", "value": "66e504114737d056cd8617b9a937572c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737265, "uuid": "54d2bf59-70a5-401f-8c6a-a5478440b90d", "comment": "Malware payload (RedLineStealer)", "value": "757db050d1c53a834511928b3bb9b673438bc941feace24dcb7e4e212ed436c8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737265, "uuid": "6fe70f6e-c201-47d7-8216-e1fb992a1b36", "comment": "Malware payload (RedLineStealer)", "value": "4a1e63f805f15823b979202b0198fa7b513a497f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737265, "uuid": "9ebf4ba0-7170-4622-9c45-3e237de04d90", "comment": "Malware payload (RedLineStealer)", "value": "cf23666ed3482aed7e6c67e39c4468286a35f012428479314ea71b720de5d5aee4d06582068ad4b25e9e2729618915f8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737265, "uuid": "012fdbe7-b174-4661-8d68-cce6bee4f831", "value": "T14425231387DD54B2F8B517B098F803C30A32BCA566B88217374A4E9E5CB39D94A36777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737265, "uuid": "1e9d44a5-e163-4e31-b487-390577b8d483", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737265, "uuid": "18ab07ae-5e2b-4267-b040-b46bad9a0f78", "value": "24576:fymVk7lp+Nzo+DliXK4MovE7iuj7ocNDgc+3VmkmTxB:qV7l7+Dli7s7iu3NVgcimkmTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737265, "uuid": "baac3ef7-62e7-4e97-89f4-3082aa31271b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737265, "uuid": "fdfb76eb-b7a7-4611-b3b3-de2170f3eefb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737265, "uuid": "13eed893-503c-4072-a5d1-148801449a08", "value": "AI354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ed8cc2-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752007, "uuid": "a9e9b09c-815e-440f-b3a9-94c0c694700b", "comment": "Malware payload (RedLineStealer)", "value": "e28f3c9d80bec3d1ec34d0f9b5f7ea4c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752007, "uuid": "f37af924-3921-4208-bab0-d986f56c5d17", "comment": "Malware payload (RedLineStealer)", "value": "75acfd65bddd90aed0a022399aac2a30ee600e25eaa9a40c535cc68dbb0f7bd6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752007, "uuid": "95b545c0-e2cd-4371-a447-3163634c5750", "comment": "Malware payload (RedLineStealer)", "value": "594d333f3f439bca186035058770a8aed78f2034", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752007, "uuid": "413ee9dd-9d93-4844-8754-6a1a362b3d4a", "comment": "Malware payload (RedLineStealer)", "value": "77413ae06fbf03e4565794024ab4a25ae126174e77df90c702e86aa2e633ccee4e6730bf659848c5e2e99af8ff5e756b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752007, "uuid": "5738ba46-019d-4795-8ea7-53fed13faa85", "value": "T1FE252392B7E95077D9F427720CF602871F36BD128FF0423B1A85A89A19734E5B4B472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752007, "uuid": "11d36583-a56c-49a2-9f72-d76779939a2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752007, "uuid": "a1ec393b-f173-4ff8-b6ca-733b3cff8510", "value": "24576:jysOjVBvuYuo4jBEitYCQG1Gz1T021JTjYatPF+:2sOvvnubtd1g1HTjbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752007, "uuid": "2bcca523-5b8a-4eda-8100-34205b886bb3", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752007, "uuid": "65bd5c87-d3f3-463a-941d-f615a8a2283f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752007, "uuid": "ef64eac6-475d-4ab1-8a00-18417c6005bb", "value": "localization569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fe6da6-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752016, "uuid": "07cfe6d4-dbb8-4b1e-a5fb-65219134dd97", "comment": "Malware payload (RedLineStealer)", "value": "77503d3cbc7ec343a284dbd5482f2d33", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752016, "uuid": "7caf3965-03d5-4af2-8781-0eb39441be28", "comment": "Malware payload (RedLineStealer)", "value": "76672f74fb3a82cf30602e32a8faa9d51547c6830f15706ea44282f69402df66", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752016, "uuid": "d8f98883-1ad2-4913-b27e-e507a527540a", "comment": "Malware payload (RedLineStealer)", "value": "475541d670a7f6ce13a53da3e583077e6b38da60", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752016, "uuid": "9cc11935-d37a-45bf-9403-a5203ddb25af", "comment": "Malware payload (RedLineStealer)", "value": "d52b8e213c1d4e478ccc6c91d4f454aabc2940bad038e9604e1c976226b2e643fda7ab56efb010880ea31ad759091c02", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752016, "uuid": "bab7263d-76ff-4c7b-95d0-7d42cde704c5", "value": "T187F4E7D223C28E15C3262A3AD773865427E5EB011623C377EA9F22975F53BB97D406E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752016, "uuid": "13882da7-d411-4ab3-9522-ac12ecf22f8f", "value": "6144:2DNptsYrmDwTaXEaZ3ziHjQ+jN3uhk3JWQm+kT8YtSthFDU+jUKJsywG6:2RsBR3w9N3uW3JW/eDU+jvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752016, "uuid": "48dc5bdf-52be-4836-9fac-6cb379129dcb", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752016, "uuid": "3e883f65-2704-4e5b-92e6-c68582b5e7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752016, "uuid": "abe33adc-e3f6-49e5-a733-38f6006fff29", "value": "noname878.Transactions", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3706021-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751843, "uuid": "9fb77f7a-6595-4914-933a-1369c4887ca9", "comment": "Malware payload (Amadey)", "value": "7c368b0806fe6739273c08e5ad136882", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751843, "uuid": "0e2a0aa4-29a9-4abd-84b4-c978351e1260", "comment": "Malware payload (Amadey)", "value": "76a30526e3ebb176b70eea83e0f104b01d1f10da0f75729c7d21a1a0f3644051", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751843, "uuid": "931a1a38-42fc-42d8-90f7-d8f3366c5e8d", "comment": "Malware payload (Amadey)", "value": "48c5f81303073339409a170d1729190cc9f4c04c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751843, "uuid": "2edb432d-cf1b-48fe-aa26-aba0031e305e", "comment": "Malware payload (Amadey)", "value": "512a21926cf10b985cfce54d13c8eb2675ede72e76a25f697bc52ddb04a7eafee2ff4565359a700f33f52e58be088761", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751843, "uuid": "35c09905-f6a3-4037-bc21-5eb0f6970dca", "value": "T1F6252352AFF495B7D9F11BB098FAA9C70B353E5289B4426F33019A4A0C336C0667176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751843, "uuid": "c3d7c7d8-73a5-48a2-abae-1efd3d57910b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751843, "uuid": "b23d064f-01d0-407a-9800-165c5397e76d", "value": "24576:2yvTQWSLsvgi070x8hSf1vlYPT6twG0lh2+su:FvTQ329x8hSt9YPdG0lh2+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751843, "uuid": "f00d3a7e-eb16-4559-ae84-2c70e5a99156", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751843, "uuid": "128d1ffd-5a02-4f5b-b678-3de5740da29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751843, "uuid": "0830ed92-6b47-43bb-b4a6-5e7bc7dd83c7", "value": "999477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fa552e-f87a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684744217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744217, "uuid": "3de98cbc-c6fc-403a-a97f-f4f3a0413a59", "comment": "Malware payload (NanoCore)", "value": "8c80588296d6b189a1115a07ecfc048f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744217, "uuid": "d2347f3a-dbb4-4208-8c6f-f8c3b098e988", "comment": "Malware payload (NanoCore)", "value": "76a59267c8c6b0e6878ad01204e5971c46726bcdb41bd74818b038baa597e027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744217, "uuid": "343a4a19-401e-40e2-8095-c81ef1e7ad70", "comment": "Malware payload (NanoCore)", "value": "02e2a7b6ee6c658df1052f94def4fc595e57b43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744217, "uuid": "d7dae3a7-f626-4804-b592-c5456c328f2a", "comment": "Malware payload (NanoCore)", "value": "65e5ab12c7bbe1aece255ef08986c53a7cc99fdfeb09f8d259fcad4bf5198c603a5fff8c95d8f44fa2bd27de9b6030e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744217, "uuid": "632ecbac-de6a-4ad5-9b85-65600829e886", "value": "T10EF49C5633B57621F47D33FD01156388CB38B04A2122E22A2F563AD546E37EB771A6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744217, "uuid": "4b1e56e2-da07-4965-8d3a-cedacef5c0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744217, "uuid": "0e57d3e4-2706-4915-8116-3ceb38869982", "value": "12288:6vV+s1bSQT6tjjdB4LeTuq1S/pmnfX2GQjdl7hHfDdTFJM93Tla/LukFb:6tViuqA/M2njldhW3Tl/ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744217, "uuid": "0864042f-c1d5-431b-b80d-84108cc5d53c", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744217, "uuid": "2f49e3e4-2848-48cd-be4f-321be06fef1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744217, "uuid": "2b16d890-0571-4445-b8c9-363c293533af", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e68f5c-f87f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684746021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746021, "uuid": "f6ea1c3b-5f4f-49a3-82fb-410e573de3b8", "comment": "Malware payload (NanoCore)", "value": "f1353b17fbc8ff11fe2c8d01e7ad4834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746021, "uuid": "82d57550-b6e9-45ea-92a0-195c2d336c72", "comment": "Malware payload (NanoCore)", "value": "76e99b721f51b1f6c0f4578362c0cd3088338b1c4ea42a32380b558c908eb31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746021, "uuid": "1328232f-fe6b-4a04-9f9e-dbe39359107e", "comment": "Malware payload (NanoCore)", "value": "ef8816697152e288d4ce2e99896c53cc3fa93388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746021, "uuid": "a690bd20-1be7-4ddb-92dd-597bf3755a10", "comment": "Malware payload (NanoCore)", "value": "cfe5434f03b032db372ab9bbac8153465a0ff7e78dbfb5a3c46085da158a67da9980b9b599a42f1bf64cbe48eefadc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746021, "uuid": "ef36f80b-d717-4f60-8858-3a6c96739b68", "value": "T1DCF48C5633B57621F47D33FD00156388CB39B44A2122E22A1F963AD556E37EB7B0A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746021, "uuid": "f7d72a55-d67e-4016-9abc-caae9db6a853", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746021, "uuid": "f5a6ecb4-bc75-4b0d-b7e4-4bf2be5cb6f4", "value": "12288:fvV+s1bSQT6tjjdB4piduTB01/i6n0XvlRM5TQux+ULvGHBN+jr8baI:ftf4uTWJTELM5Vne88ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684746021, "uuid": "c689b5ab-c3b8-450e-87fb-40117141f899", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684746021, "uuid": "ce2868d3-9ff4-4ffc-b97b-99e848cdb0e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746021, "uuid": "b186cde6-fe50-4b8f-b037-8a1d98cf28cf", "value": "f1353b17fbc8ff11fe2c8d01e7ad4834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc88bb0-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752369, "uuid": "d93f9a3f-0fea-4d24-916e-6a8511435237", "comment": "Malware payload (RedLineStealer)", "value": "6959f784efc8cf1eea70431e45e9ce3b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752369, "uuid": "f3912a5e-b3ea-4675-95b5-333fed7419c6", "comment": "Malware payload (RedLineStealer)", "value": "776bfce6918667da75123b325de7fd42a0936e1bb28fd528dfdee97cf880ca48", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752369, "uuid": "92462a24-971f-43d5-a9b5-6feb54c33f60", "comment": "Malware payload (RedLineStealer)", "value": "f3e663b867d1620b83f2c41e5ef4740e5a5518f1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752369, "uuid": "af8aac4d-072f-4b6e-88d5-1abf15dac0ff", "comment": "Malware payload (RedLineStealer)", "value": "c12222d45bdff9c445d5ac81ab3ab5f2631331011d934708401ba79a50e8a0f18b75e135faf53ff8b89942327aa345e1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752369, "uuid": "fa71fa02-d688-4fea-96ec-324b4696578d", "value": "T1622523436AE0C471EEBA237168F603931A373CA06D38476F338665564D339E9AA31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752369, "uuid": "b05b1db6-36a3-4515-8137-4df1f7e6bfda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752369, "uuid": "2a9508f3-6eee-48f6-8d1c-abb208705224", "value": "24576:OylYWBWjbF8e7RQpOWicRlEVGkyON8Se+lXKID//bq2dWMfqVSTKtjj7:diNFdQaweV1yg8rI7/N8MfGSKjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752369, "uuid": "31adaf4a-8478-4dec-8998-9535db874eb0", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752369, "uuid": "dbaac096-d112-4f66-abb9-e0c7db818f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752369, "uuid": "f9a97984-a3a2-4b41-82bf-67a69e2b22d9", "value": "config255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092cb3fc-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744283, "uuid": "bf5e2ee0-fddf-4db3-bf65-50a41e81d032", "comment": "Malware payload (SnakeKeylogger)", "value": "a6fb78ace213482e3bd7a2cd1dd56eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744283, "uuid": "18d2cbc3-ac7d-4287-b8f9-301273aef21c", "comment": "Malware payload (SnakeKeylogger)", "value": "778412788bae3d5bfa6db0153e492c048640e65accf0fb507e4882d8c2a83817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744283, "uuid": "4d10cde5-816d-418d-943b-e7dfdc89686b", "comment": "Malware payload (SnakeKeylogger)", "value": "53fb8160bf855f689db5e4133adbd99a27650a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744283, "uuid": "1b873cd7-50ae-4b22-869c-6314ec4b3851", "comment": "Malware payload (SnakeKeylogger)", "value": "643105e43b0e202c802d5bc0b4065bd676cd599011a2f1088b5c9a2cc7c5afde8785faccac8aaf7a201556216d6573c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744283, "uuid": "b66b241f-349f-4263-b45b-0f0ff18cee69", "value": "T15ED4F1C126985C01E6AB5EB949B3E27043757C61EF27D74E24E42C8BBC96B827B007D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744283, "uuid": "5aacf287-c2dc-4ace-807a-554106087b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744283, "uuid": "97f4ad9c-df2d-4cda-86d8-7fee99882834", "value": "12288:VtSvx0YPX/NqPs82pM9o9tLzBu41QF2vAYWDtHp6XpabY6ya3DtLd:VtSKHPsTi9ozzBun2vAY8p+769BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744283, "uuid": "9c1d0991-cb0d-4e59-a9ac-06b284f3bd7e", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744283, "uuid": "90bee45a-6fb1-4458-a171-2013ae721d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744283, "uuid": "992faeee-783d-4534-ba7b-5381f55a8ed3", "value": "View File-JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6404bc-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738655, "uuid": "54045c75-7520-4548-8d1c-3af020d9945a", "comment": "Malware payload (Amadey)", "value": "a63a8159ba5fb61d9613bad35e569191", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738655, "uuid": "a225cd0e-f257-4586-b579-88d6e7d11a5b", "comment": "Malware payload (Amadey)", "value": "77eadf11f8cb6361a979424d12b836d9e3f577acce73075d1e305f810f0d9939", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738655, "uuid": "2f5436c7-d01e-41e4-aaf3-124655711f62", "comment": "Malware payload (Amadey)", "value": "28b45534c316a7cde5bc7b69eab040cc53903fb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738655, "uuid": "100efd17-22c6-4eb4-87b9-a1d516ef6b48", "comment": "Malware payload (Amadey)", "value": "1fa1006cbc9c42e57e373e2eff13ae68566529282b870c44426895428e2ae8b12171e78352a392f09f759a568a435eef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738655, "uuid": "90c8e5e8-5498-488e-8e6b-608e89c25916", "value": "T199252317BAE98536C9F437325CF203A30F3ABC619DB8536A65829D579C32695B034B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738655, "uuid": "db85832a-7ef7-4662-9ec9-023517d71f74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738655, "uuid": "d92510c9-cdce-4d62-ba41-ed4dfbbc7ec2", "value": "24576:PyeZ6MbzcNbzbqE3d5B6mYYshBH3dTJdKqDIFIYsUeUXZYJOTBM9M8fBE:aXYQNbzbq4bYtKqsIYsyXZYJ+GJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738655, "uuid": "224f7505-1fb7-4b86-9365-de1e1b79aca6", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738655, "uuid": "d1e74a21-9249-4e8e-9467-97b43144c68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738655, "uuid": "83cfd23b-7069-41d7-bab7-e3a94ac15573", "value": "77eadf11f8cb6361a979424d12b836d9e3f577acce73075d1e305f810f0d9939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8a2669-f8be-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1684773441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773441, "uuid": "e4635233-c77c-4b04-8a3b-7cdf2458a79e", "comment": "Malware payload (PureCrypter)", "value": "57fd7854e1244c276e108eed092453b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773441, "uuid": "66a0f206-d786-4016-a04e-a0e8049e6506", "comment": "Malware payload (PureCrypter)", "value": "77f931c1106338939ef706544e7e1655264bff60f5cf612a15c23a0b06edc5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773441, "uuid": "e68e402c-95cf-4a45-83fa-f35a41a49b19", "comment": "Malware payload (PureCrypter)", "value": "25c79e19280211f5fb520e2b7a8bd574ff63acbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684773441, "uuid": "5a3216cf-a4a4-494d-a986-a6f71b8cf327", "comment": "Malware payload (PureCrypter)", "value": "b86aac613a2198aa97d5cbed14ae54cbd80fb47ffb27a773ecc29faabdb20e7aa0e8bd1b7473e0a1960015f2b5d3918c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773441, "uuid": "3ca028d2-f070-4c5e-910f-c8541b0d1e91", "value": "T1AC522B117B689237C5390B7354035B800377EB1AD523DB5D988D366A9E633414AF33F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773441, "uuid": "921adc9f-301e-4589-8e9a-0db94da1a09e", "value": "384:kffffKnmx+LRIMaNYhL3LiLBLsLyOV1XADHf8F3LCM:32HMbe1ABV5c85Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684773441, "uuid": "5dd84838-3c94-4e83-8b5d-ced9453008c4", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684773441, "uuid": "2a3d71ba-eb4f-4a62-b13a-92b8d9a21d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684773441, "uuid": "870ebfbb-abc4-44b4-bf75-48ad97e5adbb", "value": "Ksoyn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef09ea7-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684738656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738656, "uuid": "1ef485d1-4acc-492e-87fb-1da565ee13a8", "comment": "Malware payload (Stop)", "value": "a51e5debd0bc94ce389201ea2ff0d3b0", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738656, "uuid": "c3bd95b8-a03c-4888-acab-45b8df97c626", "comment": "Malware payload (Stop)", "value": "788a987ada36d230b6a4e4ce1ff98296b85b3335469985535cf4d7981bf29c1b", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738656, "uuid": "9aef49d6-5bf5-438a-bf57-149ea80d5558", "comment": "Malware payload (Stop)", "value": "2398908f9fd4b68c4082c1f6493633735d59c19d", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738656, "uuid": "534ec771-07a5-4775-89bc-71cd3677589f", "comment": "Malware payload (Stop)", "value": "3c5ee4a97c651663d23a2a90bbe266b09333e8d24691d6ea3505c11bbefefb15a1c941cbaf5910411191031bdd6e1e15", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738656, "uuid": "01560f79-c972-401e-a829-3bcec62c1cea", "value": "T16DF412227BE0C072F283993856B1C5F61B3BB9618F3769DB2784457B5F782C69A31312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738656, "uuid": "cfe11e6c-30b8-4bdc-8135-a0665c5dfba0", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738656, "uuid": "e5b735a5-b431-4c84-acad-50772a9fa168", "value": "12288:EpvVnb23ewzM7TJMbvha2l31tRtuAKVH6llJJwZpkjyS:WOvM+bpa231jtL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738656, "uuid": "e0646b6e-f605-4d3b-897a-ec879e508790", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738656, "uuid": "38fa91ec-e415-4b50-9f75-b1cf26674d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738656, "uuid": "c327c161-268f-4f54-b9cb-74bf6f0dfa0f", "value": "788a987ada36d230b6a4e4ce1ff98296b85b3335469985535cf4d7981bf29c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279bf455-f8aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Lucifer)", "timestamp": 1684764521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764521, "uuid": "ab17bd5c-b406-4745-9036-8f85338a111a", "comment": "Malware payload (Lucifer)", "value": "e2ca6f8e77cbaa4a7adf56242880a30c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764521, "uuid": "dc5dc03b-4205-45d2-a718-c31848116a08", "comment": "Malware payload (Lucifer)", "value": "78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764521, "uuid": "ff65eeb9-c822-4bab-9fd6-dfd3fb3e1abf", "comment": "Malware payload (Lucifer)", "value": "3e97fefef460224557d2ef8671a66b82dd63d021", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684764521, "uuid": "2671110e-a656-4688-9091-7af5753762c3", "comment": "Malware payload (Lucifer)", "value": "c1c4d39b9deda677b5d4a32f81f5b030f3389cf2bc6c50d30f5e0ce3484ef372b9dad18262c8a11c47a761f6635a9d08", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764521, "uuid": "2e35a730-2143-4b3b-85aa-d2b6511b8288", "value": "T16D04AE20C281D2A5D5216A3AA517CA103A67ED7BAC61276F35CCBB1F3F73311D12397A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764521, "uuid": "00571da5-7e77-4fc0-843f-ea70bbede1b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764521, "uuid": "8c711c4c-24b0-4353-88dc-12fd660e855e", "value": "1536:/6TizBVEjB1904v70xbWlMjUUdIDfY+pn72VmUl4tIk6o9NbWNEqp01Zhi6Tiz:/6mzBjGKbS0cfPp25wNF71Zhi6mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684764521, "uuid": "680c6239-f029-48f8-aedb-0980fd6df622", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684764521, "uuid": "ae019953-1040-468d-a3ee-f62b91da288d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684764521, "uuid": "a8ffa89c-c011-47ee-985c-9bbabe94b716", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a5f692-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684745168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745168, "uuid": "45412b9f-11d0-4906-ac25-842d85ed6533", "comment": "Malware payload (zgRAT)", "value": "392028bba89383aa1c3626817ed9d384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745168, "uuid": "18480382-f6d2-4281-af6e-d917ae3a4eea", "comment": "Malware payload (zgRAT)", "value": "78deaca404841b87b37d691c334956dde34df67449b3b95b030edc0c5a7ecffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745168, "uuid": "495a7988-cb12-4f36-a1d4-a40a74b58c0a", "comment": "Malware payload (zgRAT)", "value": "231ebe6bb7b533b2a266c0ebd1a0b2defca56df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745168, "uuid": "a3172f57-dd7c-4909-b1b6-90a8fe8d9fcd", "comment": "Malware payload (zgRAT)", "value": "f60b2777b88116ed41802e3652058b317fab7f9ef91793bd26c3a4d8fbf947c09d6431603bef4b488f172d9fd83cbae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745168, "uuid": "070b0513-d634-4244-b208-67e55deadab6", "value": "T15F6412A767E7DD51C685C134D1E102113730A7C624B3DF4BBA8982268F83BD3B71AAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745168, "uuid": "bbf1637e-34c3-49c9-a904-2269f8932de1", "value": "6144:8qlb1KiwiZMOxWUGTBqCfeg1r0kY1R1OeDOJTX+t0XCPZkUEKlCYvj5:Vlb17wizxETkCzru13Lc+tW2ZCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745168, "uuid": "236889f2-ea12-43aa-95c5-1c43b20e1e6d", "value": 333888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745168, "uuid": "c10cea38-d210-4675-ab7c-4c0c42575101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745168, "uuid": "6d7569f5-70bf-48c9-9a1a-341f707329a9", "value": "PR 190041030211 - TH\u00d4NG B\u00c1O C\u1ee6A \u0110\u01a0N H\u00c0NG - VINAKRAFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f126c9-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684748058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748058, "uuid": "0e9ada1c-09f9-4359-92e6-4310f7913fc7", "comment": "Malware payload (RedLineStealer)", "value": "179a3a090720ea1ee6f647988cfdda5d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748058, "uuid": "d200d94f-0227-46c7-934c-aac14397e549", "comment": "Malware payload (RedLineStealer)", "value": "79241ab494be9434c416a11f0daac7fe080b050ab60feebdf28411881da7ec85", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748058, "uuid": "aa878b55-648d-4ef2-9d5b-d122412e10a3", "comment": "Malware payload (RedLineStealer)", "value": "1a991d5e2df3e0456a54c9062ff87dd898b8ad77", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748058, "uuid": "f231b356-4b30-4290-a52d-37360f5f613b", "comment": "Malware payload (RedLineStealer)", "value": "f286d841943fe1e3e553342ae5ff68deacc86de80742ad70aad53c3187dbf76eccc08991229d62a830b7f8b9186c5d8c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748058, "uuid": "8af2ab49-7fb8-4868-acf8-7114ffef156b", "value": "T1AB252313EBF44536C8B41B7048FB17C31F3A3C919970867A2399589D2CF21E96936B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748058, "uuid": "5eb5d53d-ec85-4142-bbcf-c71fae6383fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748058, "uuid": "3810c113-d0d6-47df-a32d-1495379cdeed", "value": "24576:oy8W88MzxhhKB+vLAIxAa/gXpyV2TnrVlC:v+Rf8/PgVg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748058, "uuid": "949c081e-9795-4532-9c03-bf74c9e77962", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748058, "uuid": "5813e360-c9f5-44dd-bd94-12368efed9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748058, "uuid": "5d25c2cb-bcef-4053-b47b-8775fa379280", "value": "start268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913ee4f1-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752672, "uuid": "b7d80145-8707-434f-b3bf-5ccb0657ba9a", "comment": "Malware payload (Formbook)", "value": "c139982dfc21ff9f327ddc2ef3cb4de6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752672, "uuid": "a96b3a02-0908-49f6-a876-4c1381b5a2df", "comment": "Malware payload (Formbook)", "value": "7930be0f6dcff1837340710bbc4a364f6de34073ebd95e831c86dc522dacff41", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752672, "uuid": "bcce38f5-ffd3-44c9-ab12-a6a16b7a250f", "comment": "Malware payload (Formbook)", "value": "cc004d242fda933688ee4099a0654e1c24e69ee5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752672, "uuid": "c7950e76-2d91-43c7-bc75-87b83190da19", "comment": "Malware payload (Formbook)", "value": "264c814612dff47e2164e28fde3b937c022e02449c28abe7788ef516079b90ee315ff9a32dd77c6527fbdc89762a8be8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752672, "uuid": "7929a2c5-c3b9-4e56-87a8-6b1b7b7a693f", "value": "T114942353F5934793E8CA36A6315A91CDB4A796C4C31EC34E78E6C1F6E30BF51A02243A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752672, "uuid": "fab5f831-dff5-41cb-beee-8bfc943b4217", "value": "12288:q1A0Jy/nwkR68IMAqDLsp0jwWlAVSmVa9d:0A0JSrlSqDLP9AVSmVa9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752672, "uuid": "a68643eb-a42d-49b8-b11f-ab08c85ce42d", "value": 430253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752672, "uuid": "2fb6ffd0-a1e4-4238-8b5a-5cb13ac2884e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752672, "uuid": "6b6333e0-63c8-4518-980d-e30dac06db4e", "value": "Nova lista narudzbi_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779d8b8d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752199, "uuid": "fd58065f-676d-4ece-96ff-026b4ec0b668", "comment": "Malware payload (RedLineStealer)", "value": "6cef7ea3c1faa309eaa21cb7d425b8d7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752199, "uuid": "71d81d66-cfa2-4e89-bfc1-78b351eb7324", "comment": "Malware payload (RedLineStealer)", "value": "79a31846e1432dde8006fb69274a15ae41bd920837a241d070a4d47efe7b876d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752199, "uuid": "8fd17d5c-029e-4a1a-adfa-f739bc218f2c", "comment": "Malware payload (RedLineStealer)", "value": "ceab6efefc9072de30c0e7d19c052dc7ebd93ac5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752199, "uuid": "47c92803-15ad-4288-a50b-a429252c90e7", "comment": "Malware payload (RedLineStealer)", "value": "a3f0d1c345243346afe939c33fd829f614010a2bfd74fc4760ea22f0f9664cc5b1942725f39c7951fa797300b2d7686b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752199, "uuid": "18aa734e-7402-4a94-b4cc-60a5351dfdb5", "value": "T1A125230754E85472D17417705CFA07E70A37BDA6AD7C83BB26D6A82A0CF1B84E1B1B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752199, "uuid": "73aaeba9-a3a6-49c0-bf4e-fef7d8534f49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752199, "uuid": "db1cb45f-8a07-4406-ba48-35fd79f5dbd6", "value": "24576:ByU2lObWtsF9BopFHLGu9pGPM9rl4RbcqPrrGP3THaHkOR:0AbWtsL64YYMDAWP3THaHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752199, "uuid": "196ba3ef-3136-4fc6-9dd9-ad9e5bff875f", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752199, "uuid": "fa096294-94e8-4b0e-96bc-7f5b225a14a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752199, "uuid": "bbf6a069-aef1-4c47-8e72-9701efba53d9", "value": "21324627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c610308-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744906, "uuid": "bf4a250f-2eb9-4617-905c-b8aee4eb5f3f", "comment": "Malware payload", "value": "2ca5daa158e7c7cbb7a77ed4b4a5a903", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744906, "uuid": "f10909e1-910f-43c4-aba7-031c6cd1419c", "comment": "Malware payload", "value": "7b04f9d9aef73acd25b75f8c62ba6656cdf64406d6458eded276c51ec70e3189", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744906, "uuid": "2d39903f-fa3c-4720-ab4f-520f4f34b728", "comment": "Malware payload", "value": "f759ef013a7f0dd1747c25c8d05ef62db0f75d32", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744906, "uuid": "b640979f-958a-444f-a713-a427044513df", "comment": "Malware payload", "value": "4822c64128e7aea0eaa2a85e0fed5303b99dbfcdbc1f539441eef8303452becc177975e43d6d0f63bcebaa2050258e1d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744906, "uuid": "4f8183dc-868b-4416-b588-9d512b779d76", "value": "T17B45F002D688AC8FC68547B16B4B7888621D7D32BAC55687370CB75F1FF36A5AA13C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744906, "uuid": "b5979a79-309f-4d33-9ebb-78b8529d0198", "value": "24576:fLKg/7A/bQmQmS+MXUm+MXUDlYk5rsOdXXXXXXTXXXXXUXXXqXXXXXXXXXXXUval:fLKK2O+MXZ+MXqlY5vJVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744906, "uuid": "88354e61-ecae-47de-a1c2-5bd9478b806b", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744906, "uuid": "d62e9f29-c02d-4660-9cff-1e1774c605de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744906, "uuid": "ce5134d7-7cc3-47ac-9227-40cbc58ce993", "value": "swift _035k.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1834768e-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755905, "uuid": "ce832fba-e757-4929-b50f-870999e6ecc3", "comment": "Malware payload", "value": "b2cf95cdf70170556baaf3b57ee60362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755905, "uuid": "3b2ffa5a-c29d-4ed1-8be9-8b099ea59bc5", "comment": "Malware payload", "value": "7c763e6deae08bc63a5dd7bc9a83f0652368fcb95f3f16b468a8e0c2ae060ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755905, "uuid": "566e1aea-af0f-4d6d-949b-27e746ec134c", "comment": "Malware payload", "value": "aa75d6389c6f35ebbf60325e42d817bf93653bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755905, "uuid": "7e32a46c-af4e-473d-ba04-3d06ec42ea2f", "comment": "Malware payload", "value": "b321c555b7f3465b8198116cc206f76f0486b99485d9fa5d5974e07012770bbf73826c5aad1d6610b9b685eee79ec40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755905, "uuid": "4b7501ad-b09c-48cd-8d2b-56afceec0206", "value": "T1C2C46CC3A80042F5EE261DB0682EDD491A1F3C3EFEB0399D7F96B56616B31C7142A917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755905, "uuid": "9a4540ba-cb41-4111-8a7a-eccac90f7b23", "value": "12288:nHUCVtJ6sjb1e4NXJoSDme9K1piaKEowPYTCNzmCwBIKC95R63TDLBVF:0o6sjb1Xtees1g3wPYTCN8j9VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755905, "uuid": "764d7116-496b-4b5b-88c7-83e3ffcce1cf", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755905, "uuid": "2f885fce-a465-461f-a681-6e907542f1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755905, "uuid": "39fbbf15-7862-4a52-aa54-8b80600b876d", "value": "SecuriteInfo.com.BATCH.Virus.10952.21014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f13af0d-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755890, "uuid": "e8d14a28-dbc0-403d-974b-7f1e2d8c9f2c", "comment": "Malware payload", "value": "ab0e443b5e8c741546dfbe6228dc39a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755890, "uuid": "f8cdae83-30ff-42c2-875f-ccaa4bb3d1c9", "comment": "Malware payload", "value": "7c9002828707ed43980bae215a2153fae1c3bb387d1f284bcd2d80292a395a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755890, "uuid": "dedb1af9-3f47-44f8-a648-d939735bb56f", "comment": "Malware payload", "value": "438a7d400d8e76bdac624ba82e8897e47ab33455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755890, "uuid": "295ebc27-77db-4583-8c60-67d1a2a46baa", "comment": "Malware payload", "value": "8259d76d06064522f4961e089f7e06e5ba9514a082c0300cf55790b1570ea49bff9c8a27a7715529072f1dd487f12db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755890, "uuid": "8d6424a9-bbde-4284-bfc9-0505d6b622a2", "value": "T16EA46CD2A80042F6EE271DB0782EDD491A1E3C3EFDB4395C7F96B56212B35CB142A917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755890, "uuid": "539b02f7-c1b3-4297-8f96-43c3ca0eb83e", "value": "1d88d597200c0081784c27940d743ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755890, "uuid": "844c15e2-6a73-4163-84aa-7c447af8613b", "value": "12288:9CVtJ6sjb1e4NXJoSDme9K1piaKEowPYTCNzmCwBIKC95R63TDLBVF:9o6sjb1Xtees1g3wPYTCN8j9VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755890, "uuid": "9561685b-e6b2-491c-831c-1b92b7c8ccdf", "value": 493676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755890, "uuid": "91a59913-0159-4dd3-a6d2-20cf56d003c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755890, "uuid": "2e51b793-dea8-4c57-ba2b-66661861fad2", "value": "SecuriteInfo.com.BATCH.Virus.25199.5454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38443231-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744792, "uuid": "e053cf4d-160b-4204-83f9-e6085260f209", "comment": "Malware payload", "value": "094b16137c6131b61c7d966aabe22f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744792, "uuid": "3a447aea-1f8c-4735-a963-d9640e6e53da", "comment": "Malware payload", "value": "7cbffb8f9bd55b5d48642dc88705140054b53720280f522159936d7a2f734841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744792, "uuid": "371d1824-a895-4579-be84-7694951cd3b2", "comment": "Malware payload", "value": "39a1a12d9b97bee887e811e77852ca9efda56944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744792, "uuid": "9dc2ae53-d292-42a5-b73f-15d04fa99359", "comment": "Malware payload", "value": "91bf61ce014d1195b985916027c6054c184f051de34dbc1bd968b72bad3587e927c8b8305d554fd1ffa1ce1312ab529b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744792, "uuid": "e28ac37b-237f-4df8-a237-4ab075d966b6", "value": "T1CA865B2B5196A7E1E4D223334BD5A3C1A1A4E23F3D600CEE8CD4AC59196ED73436C6F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744792, "uuid": "b6617f2e-1033-4896-a131-7f8de456b21f", "value": "c983ca29445c3b0f29b987d079b73fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744792, "uuid": "345ac711-3646-478f-b719-cba93a3ca626", "value": "98304:qaqnIPL3ZhQ4MjuAE0bZ2HWM+RYi+bkZlg44wbuwJDI9dD9:qaDJgFuHap4XrXD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744792, "uuid": "e51dda7a-3767-40fd-ad95-9a12a3defec3", "value": 8046080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744792, "uuid": "f425be30-edae-4b6a-96ec-bd288b20bb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744792, "uuid": "84b50969-a1b9-4848-b045-d96eff72128c", "value": "094b16137c6131b61c7d966aabe22f42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef872963-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738657, "uuid": "307e2b6b-97e1-4769-8b6d-212535deb75f", "comment": "Malware payload (Amadey)", "value": "451a21ed33615faacc006751ee4ced8e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738657, "uuid": "a2263455-65c7-48b6-bc7d-26ad6fe4543f", "comment": "Malware payload (Amadey)", "value": "7ecc8d53f21e23bec755311466d950bbc7bbf2015c96be2d621f0a5369138ecf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738657, "uuid": "e254a4cd-e64e-4516-979e-b34247013950", "comment": "Malware payload (Amadey)", "value": "f15c7590baa83faff60cb1745cd67c3e7f37c654", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738657, "uuid": "a0416f7f-4d35-4352-b1ce-84dff070ded5", "comment": "Malware payload (Amadey)", "value": "bbf430ea395cec67c19100683117080558f844370d40a69f6cbcc6f56d976135742df2b5c07c89503b3a16e665018522", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738657, "uuid": "2b393786-c920-4299-b4dd-3921824c789c", "value": "T15225238AB7C644A3D8B53F7014F706D3063ABDA15DF5931B12A25AAB0DB25D0B93073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738657, "uuid": "1b4d299c-2dcc-42fd-bf04-65a0e66ac100", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738657, "uuid": "710e82ce-a8ef-47af-907f-62d31057acc3", "value": "24576:gyjmsYWuyGwC+OOIMOsMXZx7YIUqjio1cFTYp:nzNhOOnsZa9yV1c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738657, "uuid": "783cbdf6-a8cc-4f5d-9216-2cc0db5abb62", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738657, "uuid": "8558276e-5b36-4d6a-a183-f44be49d79af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738657, "uuid": "2905e28f-be2a-493e-8247-650c7001b7c2", "value": "7ecc8d53f21e23bec755311466d950bbc7bbf2015c96be2d621f0a5369138ecf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295dbf31-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779556, "uuid": "220eeb24-2f2a-4ca5-8b49-ec4e1b64a1ea", "comment": "Malware payload (AgentTesla)", "value": "8a600162cd7a629e37b941815012cde9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779556, "uuid": "7d88bb86-1806-4ce7-8f4c-35f8314751a3", "comment": "Malware payload (AgentTesla)", "value": "7f048d017967cde1d43163e9a65354823a8018663589e856a4a644833f6794bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779556, "uuid": "709dede4-a3a0-44a0-a683-7b12ca49773a", "comment": "Malware payload (AgentTesla)", "value": "566e379ce6339a6f3f6990e00f919ffab992a930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779556, "uuid": "3996ca74-4191-409d-9ad2-932d03188d74", "comment": "Malware payload (AgentTesla)", "value": "3a14ecc71ae56071e0cc06fb2c5e93ed37f280c589ec5e02baaacbeb282e8f62c3e5a9b91026dc7d0b841e6d1fceaf67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779556, "uuid": "2d45fc7e-8631-4dac-84b5-2dc0731503ec", "value": "T13BE4F1D126984D04E6AA5FB55EE3F23443B86C55EF27D30E68E42C8B7C66B817A007C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779556, "uuid": "a3285ffd-6c05-4200-8785-a56afb1933a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779556, "uuid": "3f2052d2-9dbc-4fd5-82b4-0cb8ae4f8189", "value": "12288:UTMx0YPX/NqPsyTbp9fDDDs4IkhSmW90F3CtdQbKZ82eirpN31Mtz2:UT7HPscp97vstLBuO8X2blMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779556, "uuid": "179a8b0a-0fe5-43dd-8d2e-fcde70596782", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779556, "uuid": "4cb012c8-0b9d-4374-a965-dd22f01595c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779556, "uuid": "11e55cda-b6be-4df4-a8f2-e1fcb49ae108", "value": "offer number UC23070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24667fc-f894-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684755331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755331, "uuid": "0398f363-ae2f-4757-870a-1b5f83a67a30", "comment": "Malware payload (Formbook)", "value": "ddcc21e4b936490e7559918bbdc4dc63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755331, "uuid": "e69cae2f-dd79-4de0-83ed-7906800d212b", "comment": "Malware payload (Formbook)", "value": "7f627adef8b8843521f8df46818f17c4b1cc9de14a224e622ad2dea6eed70d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755331, "uuid": "e016ed01-92df-47c0-b793-f9beeea316cb", "comment": "Malware payload (Formbook)", "value": "7e05a9c90cafeb40b49e3eb9480e04afe8843c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755331, "uuid": "aabb1d48-5b77-400a-ab90-22f8cefa3c79", "comment": "Malware payload (Formbook)", "value": "03e998230e5888bf37edd6f5e062893d40824eb56325634ca5f77c29db2ada87b8943a174082484892863e8bfcd08e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755331, "uuid": "1db74401-20ed-4c46-b44d-b1919f7d5d8b", "value": "T19B640257B6935841CB4F6A3064808A152235F3EF2663D74F21DC52B70B133C797AB9AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755331, "uuid": "90c0e59e-ca5d-493c-83bf-7e87366241b1", "value": "6144:zaEzy8Qr/LqBdm06hhSg4WViSMKC9fT1ze0xoNfoEZrw6iDvj5:GEzvQrc6HNRVWBC0SfoE5wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755331, "uuid": "78a801d6-103e-477e-9ddd-efcf1eb435ee", "value": 336960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755331, "uuid": "02a3e044-b1e3-47cb-b99b-77b214ccc768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755331, "uuid": "d9e271e0-8550-4619-8dd2-a355851b0b81", "value": "rDUN-1140301-Fo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb33dc3-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737228, "uuid": "a35983d6-9001-4079-bc21-54df024dc090", "comment": "Malware payload (RedLineStealer)", "value": "f4c58ba15ee1cd2a652c972f8203f838", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737228, "uuid": "a8778b56-7eb3-43a6-aa81-5713f9a0e20b", "comment": "Malware payload (RedLineStealer)", "value": "7fc9570f0a51d79afdc9eef1016478023007f862e7eb1c0a1c04bb8eed8c4ee6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737228, "uuid": "f1d154c9-c1cc-4465-98ba-e31da1a93a23", "comment": "Malware payload (RedLineStealer)", "value": "a5ec945e107a2640d5b4e9c0172e90ad3db321d2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737228, "uuid": "8d0cdaeb-0e0e-4a94-82ed-86a348aef00b", "comment": "Malware payload (RedLineStealer)", "value": "206688c0f30d3076a8ef4a31128c14fd6678de4ec57380d501303024aafd724134b2d3962ed4195bcd5f994cf525f988", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737228, "uuid": "71cecb6a-062a-40fb-9205-c5ad7e5296c7", "value": "T1BF252316EBD49472EC357734A8F746930B39FC918538827B37924D4B0D71AC89A327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737228, "uuid": "5fb14079-defc-43cf-b47a-19f129461c23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737228, "uuid": "16a42d4c-3704-4f4c-a0be-0997b09518b1", "value": "24576:DyZc0UE1Oaq7n7WPMOxTTIfFUKMGD4AGxeYnre3zgp:WZc+cvtbf5MGD4AGxe9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737228, "uuid": "2d35b22d-1b02-4947-b538-aa5fd90c5039", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737228, "uuid": "c9f09329-2f6a-4020-b80a-f99da3fc53d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737228, "uuid": "3a0d3c08-5537-4cf8-b6fd-54d835e565db", "value": "526201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f7fb6c-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744306, "uuid": "a0620882-ebdb-4cc4-b115-e2ff04ae1319", "comment": "Malware payload (SnakeKeylogger)", "value": "ae56a3c8d3210da939e7e6e80259f93e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744306, "uuid": "6ab2e5ba-04f2-4140-8b20-17725a46ee72", "comment": "Malware payload (SnakeKeylogger)", "value": "80461b42bc612359b1d72df8bf60ebab0d2330add962355b7ac41a5dc8712ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744306, "uuid": "16e5ccc7-3b9d-4fa7-928c-f819eff14195", "comment": "Malware payload (SnakeKeylogger)", "value": "f044230c33621782b5f62fce9f61f061d298e2be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744306, "uuid": "5bfc0547-76f0-45f7-a7c0-324a6a98fe5d", "comment": "Malware payload (SnakeKeylogger)", "value": "27518419374540516425c8c715403f21700434113c593f4e1bf8508113e87029303621b6422306c37bef1f29ab4e66d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744306, "uuid": "5fc97ac5-616c-4f1d-8987-b9c14f0a64cd", "value": "T15CD33A5D27F89800F1FF5AB305B15212C775BC12152ACE1D5AC2F55A2B7DAA08E0BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744306, "uuid": "98300850-0346-4fa2-b58d-df0252d87891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744306, "uuid": "06359ca2-fd83-469b-b53b-04f9546da067", "value": "1536:U8PYLnB8YYXdxN7bw+vBUFrlY9wrKfiMFyHrYbtZebKuMgVxMq5nEpiOWBvF0Kcl:U8P8ni57twrqCbfrxMQuwBvFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744306, "uuid": "c344ef44-ce1a-4db9-8681-f55a406ddaf7", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744306, "uuid": "0fedde68-f66d-4059-97da-697ee7b8e6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744306, "uuid": "0ebe93f6-b95e-4149-969f-96b8161d9405", "value": "ae56a3c8d3210da939e7e6e80259f93e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba16f264-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751881, "uuid": "f7329d0e-6072-49a2-a08d-dd71ce4c21a6", "comment": "Malware payload (Amadey)", "value": "86a8f18f0d6ad19012c42f10b7e79704", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751881, "uuid": "d36bb030-623c-40a8-97a5-6767c25e6345", "comment": "Malware payload (Amadey)", "value": "804aa687f0eba4e5592508336e6e18e7712b4dfb27332ae240c58c660854ae34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751881, "uuid": "0d79fb3b-af24-4cbc-823c-90b87b0cd937", "comment": "Malware payload (Amadey)", "value": "57f48dc7559a64ed6cc5c3bf7960887763232914", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751881, "uuid": "1f743154-5411-4bc0-8f02-ef02b20d6000", "comment": "Malware payload (Amadey)", "value": "eb95894fe8edf373a3472e96199e6974945058ac971478c1560558f16c2f4addeb0676b7c8d0236b725d1f10779cbd10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751881, "uuid": "ddfc83bd-5d2b-4a93-96f0-2b5eabc1352a", "value": "T114252317ABE4D872E9B403B054F903C70A35BDE5CDB4832B3B4568A52C729E9A136727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751881, "uuid": "90d1e237-f856-4753-a9b9-57e8c3c93bca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751881, "uuid": "97de18f9-464d-4d36-a308-951f59b5b4fe", "value": "24576:8yRfXLyiazIbHAn3vmalTUNZWiqW0ITsA0nxTcJTsxkA:rRf+ia07AHlsWiqoTFqxTcFyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751881, "uuid": "81923bbc-152c-4e8f-8157-d6de6746f54a", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751881, "uuid": "f5b9d85b-7ccc-4c4d-9d1d-6842cdd47c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751881, "uuid": "92a5d2f4-12b4-4c57-b80b-91c2429a5290", "value": "connector351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec9f306-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752668, "uuid": "c26cff8d-d3ca-407d-94e8-ed671cd09ad3", "comment": "Malware payload (Formbook)", "value": "5d026ac5531b91c79f7b0eab7ab5f02e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752668, "uuid": "f1410195-decb-404a-84f8-d80bcc4d324a", "comment": "Malware payload (Formbook)", "value": "806c6ea4cb92ecf2b21e2501505537c22fd74f7f7c3d2fdf6db7023c1bb2acba", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752668, "uuid": "db83a486-e2de-4bb6-b52b-95ecdcec2f25", "comment": "Malware payload (Formbook)", "value": "d4b6ac1318a1624e1b548a664157e1d7c82a63dd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752668, "uuid": "265737ef-5744-4e05-ab80-65a3dd5e7d91", "comment": "Malware payload (Formbook)", "value": "3a9c9f1d0f328b7003d4e8a6f4a6808bd222e4351feced5d343bd967f3b6322c85118eaaa8c4bcd65a11d02328be29d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752668, "uuid": "9ca485c4-a02e-49a2-a912-7d55d74031fb", "value": "T116C4230BE6944CDF65F32F05F698DE3364E4B6C4A5C0E2D31819C90BB99C6E42939D4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752668, "uuid": "76b38e90-6c88-4977-a2f6-d04f04e2f114", "value": "12288:LXEadYRrGDOPbTflUAL8+Y+EgPYGC5y4jvhpx8bufD8+m5:LXKlrPXhTYm4jv3xLo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752668, "uuid": "5ed10de6-d999-42d4-a853-3ef1e95dd9ea", "value": 590101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752668, "uuid": "2a2d6cd6-e930-4549-a1f5-e0af4dc3e4ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752668, "uuid": "2b4ff5ac-472b-4c57-9cb5-945aa3a86eab", "value": "International Remittance 023ORMTT0045123_1.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23c6e5a-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762606, "uuid": "bdbf2fbf-6ee6-4a45-9ced-6b094b54f10f", "comment": "Malware payload (SnakeKeylogger)", "value": "42131cc43ab50d3b5e796d44a345ff8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762606, "uuid": "e373c713-6fe5-45f8-980b-cc02980606df", "comment": "Malware payload (SnakeKeylogger)", "value": "80a3bcecad3c5b6fe13c41124af786341400fec9cec151490d7861a3fc83be75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762606, "uuid": "2d41ea8a-885f-4944-abef-1667e31d683a", "comment": "Malware payload (SnakeKeylogger)", "value": "f776ecd365bf2de91dbf0d30248d1c774cffdc2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762606, "uuid": "c777a4f3-75d7-4d72-9d75-a483db37a2d1", "comment": "Malware payload (SnakeKeylogger)", "value": "0501dc7f53ec2c97219690cab6c63dabe03776efbb301d4cf2af607ff42530d5d364f524d9a3b67b7f37dbeed19e2081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762606, "uuid": "0dadd7e2-095b-4be6-bdac-7e057fcc3548", "value": "T1F2E47A5633B57621F47D73BD0015638CCB39B44A2022E21A2F9A79D586E37EB770A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762606, "uuid": "0ecb3e2d-94b1-4a14-ba1e-e816452d774b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762606, "uuid": "08fa84dd-cf55-485b-a1e1-b5ff4dd0a8a3", "value": "12288:LvV+s1bSQT6tjjdB45gyueAACGzgpsFfz2Xa08veSogw3qyuIYo:LtrFueAmz7FL2Xa03SogwaytN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762606, "uuid": "184ea6a4-8672-4dab-a1a0-76f24a289533", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762606, "uuid": "013a4d74-f4dc-4834-b3b6-927fa961488d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762606, "uuid": "5754b57a-789f-4c1b-a587-96b1bd2c6ce4", "value": "cXgElsIZLt0gOvk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4374527d-f857-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Arechclient2)", "timestamp": 1684728919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684728919, "uuid": "210ccb9e-c581-470d-b936-3c67f80b0de2", "comment": "Malware payload (Arechclient2)", "value": "ad8ed45836c7acef689ea94eaa4c72f7", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684728919, "uuid": "32965345-23de-4e01-8e3a-fb9e34ce0465", "comment": "Malware payload (Arechclient2)", "value": "80b738922b17e8aa8adc3360606286a0e52aa8e6529d22a30b86fca5f347e1b9", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684728919, "uuid": "50da0078-4342-4e3a-b4c6-5e48611ad88c", "comment": "Malware payload (Arechclient2)", "value": "9bed12782c48045748e47d04a61deac55c9b2863", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684728919, "uuid": "3174e0d7-3625-4847-b212-a06be81d2913", "comment": "Malware payload (Arechclient2)", "value": "3832109cb85b93aa319e44a6d176aef53470ee62d50eae9ed2afa8e8cb289f8e3b6144ed52251e22cc8a4c538deceed4", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684728919, "uuid": "8cd440f7-c0f3-471a-9f74-794ee4a7fd6f", "value": "T183054A6C774B5A2EDED8737841FF1D1C95A04A6B80A1A64A5C4FF8DC2FA075D930AEC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684728919, "uuid": "3ae4538f-de9a-4204-a2ab-480d09f0af22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684728919, "uuid": "3d2ec0ab-e43b-452f-8596-1b4e89b8bd1c", "value": "12288:Piq3Su0POJs3Hp/ZtSZw+GHLgjZM+k9uEn2NVKDjDG87VDVT:qb3POqtSZMmS+4uE2NV4jDG87Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684728919, "uuid": "124af48d-2f15-4ab0-b961-dd7fdeb681b3", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684728919, "uuid": "223e9e23-4381-4b4a-9a66-a146e17e1aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684728919, "uuid": "5066eba2-aab4-43c4-b362-69405c8315df", "value": "ad8ed45836c7acef689ea94eaa4c72f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88736091-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684752657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752657, "uuid": "6ecb7f33-199e-41ab-814b-c08a2eb9f8ad", "comment": "Malware payload (GuLoader)", "value": "3e790ddf47bcde9cede1b8ca0318fb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752657, "uuid": "19b395e4-e493-43ab-8974-ceef9f95b030", "comment": "Malware payload (GuLoader)", "value": "8100d4ccf3d7afdbde57f4bace6f2e4d160d3d8f79ecf892452fcd7bbcfd6f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752657, "uuid": "9b7ac28d-41ff-4e72-8878-1f397e57155c", "comment": "Malware payload (GuLoader)", "value": "afbd353166fa4df34d5efd04e36a6c4440f81cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752657, "uuid": "ba3f19b5-2a62-48e0-b6b9-827f7efe8923", "comment": "Malware payload (GuLoader)", "value": "0f3fc540411f94aec9c6ac5e4de828871e5148ddb9241ddbcd04d6a4622c2587cee7f68a6415e8dff05cabe4ced022e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752657, "uuid": "fa3abb6b-3ec3-46b3-8258-e32c1200615e", "value": "T1FDE3026572E68863E6934AB0297BCFA695B7FF112916199F5F007FE43C331C3950B242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752657, "uuid": "65087736-fee8-4ff7-bfbe-614407f24e5d", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752657, "uuid": "26c4039b-5f44-4710-acaa-fedeb6a9679c", "value": "3072:1DQkrZoosbIfXJ/ppJCMFm9UxKSiEurlFe9bbxBFg43OQR9+60zK1le+uFtMAAUP:1DpoeJFFmyxRitlFe9PxBleG9+6oK2++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752657, "uuid": "9c204b89-17f0-4299-a290-85853ca9a807", "value": 155638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752657, "uuid": "bd0e2dc8-6928-43e5-a17b-6f8dddfcf9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752657, "uuid": "f67e1d9d-4ac1-4540-86ff-a18c346c5933", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d515670c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752356, "uuid": "8a326a5a-5dd0-4925-afd5-c7f7efb80d60", "comment": "Malware payload (Amadey)", "value": "44e0f077f10f5bea820c7e9a8ff24a03", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752356, "uuid": "ac755b65-3c2f-429f-bb2e-f069a550d38f", "comment": "Malware payload (Amadey)", "value": "812af0023c57a835cfb557bc55408164450659c26d227ee4523d0b4907750e58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752356, "uuid": "ca979060-b24e-444b-81ac-374297d01083", "comment": "Malware payload (Amadey)", "value": "3ec5a6dc5be7eeaa2105cc9d7fbb92f1abafe1c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752356, "uuid": "494bbfa8-8432-4c6b-9d21-59a3344cfb9b", "comment": "Malware payload (Amadey)", "value": "5706b87bf4eda11abeb829e76c3917876b323a7720ab14ca6e47878e788a676c97459f240b8e92c963d9130130d266d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752356, "uuid": "e6b120dd-648c-4959-b88e-282e297a27d3", "value": "T130252243B5D49672E9F9277428F602932732FC339971821A13C5788A4E72AC4B5B277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752356, "uuid": "7a8f6f5e-3fd5-4dc7-a480-aa10858d25f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752356, "uuid": "4a6f716d-0f6d-417c-bc34-e8712dd1b2fb", "value": "24576:uyTrDwn7OzvLyF+paQ4fzPyP12xrzKI7xKr:9THaCW+paQUbKMlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752356, "uuid": "d875aec4-4311-404d-b1f3-872e89348600", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752356, "uuid": "c94d8b91-852a-4211-ba29-a05700bce0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752356, "uuid": "5b68954d-5525-4347-8709-b5cd26e6ae7e", "value": "catalog211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6650c0e-f8a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1684763579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763579, "uuid": "700ff08a-546d-4630-83e7-97d2bdd8ba8c", "comment": "Malware payload (GurcuStealer)", "value": "7eb30449442e959e254a6c13600f1309", "object_relation": "md5", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763579, "uuid": "05a12d21-4a7b-4bb7-9c93-5d44aa6c0f8c", "comment": "Malware payload (GurcuStealer)", "value": "81a43b89336306206511fd81d9a92918e00dd8b4d1f0630268a1a0877dbd4d18", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763579, "uuid": "f2b36527-a132-4942-adf7-5626b6591ddb", "comment": "Malware payload (GurcuStealer)", "value": "38df92ad5d87c2d81ae609c747127938d2483f02", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763579, "uuid": "baad0b62-64ab-4cb5-a7a7-8217a00fedd8", "comment": "Malware payload (GurcuStealer)", "value": "dc3cb5582b779077b731a3a1088496120efe33bc2543798598c01cb4ea2a3f3a5a4ef025e472879e062b373150299d92", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763579, "uuid": "33c3a18e-525c-4e14-9074-d2cc3215aa57", "value": "T1DFE44BB72693EF5ADB770E44D4081100DCADB52FA26899EDBE0556D217A90BCCDB8CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763579, "uuid": "b67b854c-7790-4612-8303-58a641b7cb41", "value": "12288:Q/H30fYteD1Flgst0MFX6F2+qR0nQ92DjJlLkrK0VArdXOpXqg906YoqW5brnziV:Q/H30fYteDOstpFX6F2+qR0ng2DXkrRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763579, "uuid": "ba69bc46-54ba-412a-ba97-006c6178dc1e", "value": 706438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763579, "uuid": "d4663d42-33a6-4453-9f76-607e1dc8d358", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763579, "uuid": "66b22117-2848-4e73-8208-3faf75a64652", "value": "purchase_order.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c6c49d-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755907, "uuid": "a2fb2877-53d0-440d-80a9-6839dc3549ab", "comment": "Malware payload", "value": "e3aac643d42fd57439dca25da8b79774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755907, "uuid": "7c164808-fca8-483c-abb4-d52b7ee319c2", "comment": "Malware payload", "value": "824c9da0f4c9db29174e26877855e920c7aa020a97907f9b16a7db458ea88146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755907, "uuid": "be467080-df4a-4518-8cea-622c5a130be5", "comment": "Malware payload", "value": "d6e4f8f613f31ec49912c5478241c03285d969b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755907, "uuid": "6d5ff911-bbbb-4560-8fb4-9b8c809c9520", "comment": "Malware payload", "value": "4483a4ea0ad369cfa7091c70b2883bf7ca66d0dfd7af7bf0dfed947b6c8333fabdb3527bf20f03e894679bd17b8428b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755907, "uuid": "03253542-be2d-4f13-9a66-55404c60c6d5", "value": "T1501412BD88F0E77AD116C6753A33B31ACBF6B768D87090890A701E23590FD999F16216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755907, "uuid": "919d94f1-7ccc-4d43-9d55-c5a8c67e5a5e", "value": "5318cd03ef5b5da86800f1483484cfd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755907, "uuid": "bed5a9ea-8ba1-43ca-8729-9bfa34ee1bc6", "value": "3072:wCh9EBGeUZW+WHTyYAaJ27Nj25WhmoSh8mHBXnG6LYGF1yoefamoW/4:wCv/stAakha4hR56Ma1ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755907, "uuid": "9ab2c6c5-bb74-474b-b627-237c10d17660", "value": 201670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755907, "uuid": "f4dc4801-d5b2-46f9-b260-607efc344495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755907, "uuid": "45b62c8a-68ea-4e7d-a6c3-571be366a09f", "value": "SecuriteInfo.com.Heur.28859.30559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94d2c7d-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777220, "uuid": "dd533e15-7f83-40ec-a7ba-3f2563383d3e", "comment": "Malware payload", "value": "c8c4b40901052dd411865ba2d3fa98b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777220, "uuid": "c39c83d1-782e-48cc-941c-ce5c7d0bec64", "comment": "Malware payload", "value": "82f84e52e6060acd9e146c1f222449989457a2eced50a52a6c602ae830d69809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777220, "uuid": "fb18e4e7-283e-4635-98d0-c1ec8d838d12", "comment": "Malware payload", "value": "936944742fb21079a00c138b630f72554ebc0fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777220, "uuid": "2f731f31-c7e1-4ce7-8741-3887256d5e3d", "comment": "Malware payload", "value": "1635d6da48ed28aac0c5243e87898fe4ee81fffc0975fecf1379af293a00832fe9881b6abee945d85babdc113a85c50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777220, "uuid": "efe1c247-ddc8-44c0-935e-519a26676daa", "value": "T1D575338BE2D4CC78DD4C8078D8718DB67187BFACA98147BAB384711D7A6F7631888716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777220, "uuid": "a6277133-3d8e-44fd-a2fc-5c4ead2a420a", "value": "368e3e49caa60c6ee064142ef7f4f5b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777220, "uuid": "0dd68e3e-82f4-4e1e-960d-db4c8d00b498", "value": "24576:mbJOgTL0hnUvTMSFLxvnvMIzdVY29XDIYyDUM6CzU/fETSO1Oo4Q:wN0J8UkdVY29XD8U/s7OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777220, "uuid": "95816f87-4e26-410b-bffd-eeffa40d4674", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777220, "uuid": "7f104c45-b6ac-4185-b4ea-5b4e336b0da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777220, "uuid": "2fc8b327-21b9-4fd1-ad39-9ecf87b10af0", "value": "SecuriteInfo.com.W32.SuspPack.BB.gen.Eldorado.14360.22185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c23157c-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684762837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762837, "uuid": "9e5fa896-dfc7-4f82-9151-3115bb876c29", "comment": "Malware payload (AgentTesla)", "value": "2d7ed81d34091273b1538759705ac990", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762837, "uuid": "b96fcb03-f615-4c9f-875c-c101eb237047", "comment": "Malware payload (AgentTesla)", "value": "82ff0a181a498c9a794c085821aeec269122f36c222dfcf31ea39d71d6b4c9f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762837, "uuid": "7c5bd0da-87b2-4b07-91d7-4a9c698dc6cc", "comment": "Malware payload (AgentTesla)", "value": "465b350600a5561ad892e259f81ff2aa065e2b76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762837, "uuid": "65c96285-c19d-4c75-9c60-bbc2aae5e77b", "comment": "Malware payload (AgentTesla)", "value": "61e8444d7d62fe40cecab80559773cda155a0a6e2c9e9ad018dde9a0c58b76d5123d3b5ad7a3ab39a71471cb5179dd04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762837, "uuid": "11d1c283-db54-4c4f-912e-a068b6262d3a", "value": "T107E49C5633B53A21F47D33FD01186388CB39B14A2062E22A1F5639D546E37EB771A6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762837, "uuid": "6bce7f9b-26e7-4cfb-9e98-c63a8a4578c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762837, "uuid": "756dcc98-3755-4177-88d6-469669ad4856", "value": "12288:AvV+s1bSQT6tjjdB408SwuqM9Scx/zChU7z0p2XhIK137I5m1OXGI4j5s:AtHRuJoY/ehU30kh37/Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762837, "uuid": "49abb06e-77e9-4f41-9da4-b96b72e20c94", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762837, "uuid": "e3f75d57-8b4f-4c2d-ba5f-e0b028945bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762837, "uuid": "0f8ca810-0cd8-4ce7-896f-42712ad80485", "value": "Quote 609314275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6673aa9d-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684745299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745299, "uuid": "8de8bb13-57d8-4579-a51c-75085765f813", "comment": "Malware payload (SnakeKeylogger)", "value": "ccd865b80927131032516bf100d4fb8e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745299, "uuid": "ff95586a-2534-4484-abea-81a8da833d1d", "comment": "Malware payload (SnakeKeylogger)", "value": "83dd50d56f5d4c6311db68f8dde795a704c49a160a2905ab2563d29e7ff81bd0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745299, "uuid": "27b590fb-cd40-4d82-8744-53261b173bfc", "comment": "Malware payload (SnakeKeylogger)", "value": "ed9809ef939fc6c52093a7ff5a1e28802a5d83d9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745299, "uuid": "b05f95ed-ab88-4aa8-87b8-adfaaa490967", "comment": "Malware payload (SnakeKeylogger)", "value": "440dddfb76630e1d1b2a20d10ffa651d28e848fc3e4ddd69f0373955e2744aaa7f0c0187139b47961ff13f86928ea9f3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745299, "uuid": "5f4841dd-7964-4cd7-90e4-8aad57f06551", "value": "T1EF06BE334143FCF4E7912A749952AA610C897CE7D32C526CBECD397B35F9590AA648F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745299, "uuid": "018d3bd4-f9af-4e98-85e0-1a47c1e1bf71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745299, "uuid": "f82e2578-34ab-4898-ad99-595c93a1a7ba", "value": "49152:2lcXrMYhHsv0K/klDeySIE47YnzTVFDcQlN+L4BUn8UFMt:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745299, "uuid": "88596de0-9ef7-43ad-8fc8-1c4dfc8473e4", "value": 3883520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745299, "uuid": "c9de2eee-55a9-46c6-82f6-1f0c70bdcbf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745299, "uuid": "ffe8a8b6-1531-4fab-bbaf-23ce429be0d0", "value": "DHL Shpping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7717165-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684748092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748092, "uuid": "a950e099-fac4-4084-9e9b-f53da7f54bdd", "comment": "Malware payload (Amadey)", "value": "c2957738c61a1d7f16e37e6a134a01ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748092, "uuid": "cf6fc4af-98a3-4ac7-9bea-45568ef3d8ab", "comment": "Malware payload (Amadey)", "value": "83f3c50ca0eca9503e89a55313759e140345bf06657ba2be7fbff412d3aa2bf5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748092, "uuid": "7de53ea0-5c5e-4c8d-8764-894b1abc4d29", "comment": "Malware payload (Amadey)", "value": "ae3c80dc49984492ecf9d6b8fef3e94e324f0869", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748092, "uuid": "ef938e0b-d958-42ac-bb3c-20d994f0fa6b", "comment": "Malware payload (Amadey)", "value": "f9160fea2c0106bf93fffa80da2668daeb6f46bed4f9690389b5e6f5eb59ea42696eaad9af73024feae53140997e91f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748092, "uuid": "1cb3a4be-17b7-4985-b5b0-eb44f2202fa4", "value": "T1CD2523167AE4C9B2D9B52B70ACF702D70B313DE1AD3493A77346D85A0DB2191B53072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748092, "uuid": "773ec0b2-7617-4b85-83ac-5e2c0bef9977", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748092, "uuid": "605d2d98-d07e-4c7e-b6d9-1627ab3f8b71", "value": "24576:My9sDeWnvQoqB9qujcHlKXwoyNydTDTrc99ZoVY7:79sDeZocqriDTrC9GY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748092, "uuid": "3c5908ec-f0e9-442a-88d9-ea0e017b23d6", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748092, "uuid": "9bd4ae9f-9e41-4d29-b3f2-16ce2da5ad29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748092, "uuid": "4994f1c4-dfa9-4a25-a57d-1ac9050a8621", "value": "writer960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57179eba-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737542, "uuid": "a040062e-cf50-4d1d-8bc7-8044d888cdaf", "comment": "Malware payload (RedLineStealer)", "value": "ef68b88498ccb6e7b5793a8b17176c9b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737542, "uuid": "1268ef6d-ec41-4d38-85d3-144e08c44b30", "comment": "Malware payload (RedLineStealer)", "value": "8438cd37a6e0aec36c84b4d18ce8005fe856f7b3ebd26d2de58610eab1418a14", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737542, "uuid": "f2c48f71-3623-4a67-8dfa-a7ad3f228f03", "comment": "Malware payload (RedLineStealer)", "value": "d37a8e99da8adbdcee4baf23f83636deae2c6328", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737542, "uuid": "624b0905-0b7f-46b4-9a90-ab1a5244b42b", "comment": "Malware payload (RedLineStealer)", "value": "f766c06ab1f2c99379423702bcbf775307dfacb20fc086ffd09345e2d6b6190fabbf3c97d27fbdabc5bb4f5609b8da95", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737542, "uuid": "1569e0f6-fae2-4dbb-a76e-451736902b2a", "value": "T182252303EBDA8472E8F6573008F205832735BD646E71932F3709961A59B35848A77BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737542, "uuid": "d9461eae-ddd1-4b86-a890-0549bb844813", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737542, "uuid": "7346df92-74ec-4cf3-a2f8-359b46040cc5", "value": "24576:qyopOyTwkYuzrX5qjxUTxqmjzv2U8DEVOJ0AyS6rJPnfaRaP7Kxz4:xoYyTwh2rX5qjxUDjzeDEsD6rJPnfoKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737542, "uuid": "0db918d6-af7f-43e8-a7fb-fca3ff6c416f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737542, "uuid": "9bbeea0e-7899-4a18-83ae-c876885ce3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737542, "uuid": "d2cd9edb-a7d5-4947-a310-b2ff9f801e8d", "value": "notifier578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb670de-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751832, "uuid": "5af3bab9-e223-4486-90ac-8d7b55fd0e4b", "comment": "Malware payload (Amadey)", "value": "66f69475eb8be5733fa4cf6fcc8105a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751832, "uuid": "ee95c440-d056-471a-9834-07d92a0dd91f", "comment": "Malware payload (Amadey)", "value": "84d469f4a481ee704bcccc2f8c5454fa71b9a932015d440288731484ba427fca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751832, "uuid": "d6d7defc-443a-4018-a60e-5dcb7641562a", "comment": "Malware payload (Amadey)", "value": "6479784fcadc9cca9473e36e76df5bbad238841b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751832, "uuid": "ce77c2cb-b7a8-4130-b4e9-289f91ac03c1", "comment": "Malware payload (Amadey)", "value": "3a9017be1e637c61a3134405a7d1fbe0365e95afeb6b4dc1e52fc55c4b203e8726dc02a07b2d10a42a86f7f205b473ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751832, "uuid": "79e05de7-752e-4702-a9ea-c3ea00afb23d", "value": "T1E525236AAEE8D873CDB217B528F227830B3A7DA14D78971B3742E8595C325D17032B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751832, "uuid": "1ec2b670-7962-49c7-aac7-a3c36975110b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751832, "uuid": "d6f05f19-325c-4959-9942-aef412885552", "value": "24576:oynDQc0gkrSS0tcgxSRoLsvMmlAibFKg:vPcSVcQzsvPAib8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751832, "uuid": "b1e99228-6c8c-42dc-afdc-f927db478944", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751832, "uuid": "f46db829-023b-4ce2-b8f0-90750e0d7ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751832, "uuid": "c2900baf-505b-4f0a-a7a9-3d401be637eb", "value": "999396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8bd285-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744312, "uuid": "ad131f02-a5c1-43d0-91f7-640d92715a53", "comment": "Malware payload (SnakeKeylogger)", "value": "c28e151b8cf8469e5e267f33bfd8513f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744312, "uuid": "419547d5-d979-4a14-80e3-5cd87b729cf7", "comment": "Malware payload (SnakeKeylogger)", "value": "8556b28eb846e9ee99a00d6be977a7c76ff496a390e9a6f22150a6e1fb7c0d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744312, "uuid": "9c39907e-f808-47f5-ad00-1e7d2038494c", "comment": "Malware payload (SnakeKeylogger)", "value": "15f83f779dd459b19b184d9142eae9dc884b5ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744312, "uuid": "de46d546-2d53-4b91-945a-356b67b893c5", "comment": "Malware payload (SnakeKeylogger)", "value": "152c1d766abe9e80d025776275eae2b18025db804022beef2681d300dc45966e617b3915bb6472919fac623da5636781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744312, "uuid": "490d93e5-ada6-4e16-8b60-246561f66e1f", "value": "T179C4E16A62F91F63D37947F655B822420B7462A3AC37C53C4DCE34C9E647F500AA8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744312, "uuid": "1f91bbff-2a56-49ed-8138-ba260a04e622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744312, "uuid": "b8f08fb6-2121-4fbb-8231-b13954f109f2", "value": "12288:tuysSnIIz+9Z0tk8Tl8CdLFMSI7e5Ai6a5xyPVtmuN:5lz+XQkO8ChFdI7Nfa5xutjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744312, "uuid": "e9fceebb-34b6-4b73-a20e-a888be8c01af", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744312, "uuid": "57788eaa-357d-45de-bf5c-dd89388ceb4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744312, "uuid": "1cb11aa2-6f6b-4e54-91f8-e74835785c08", "value": "c28e151b8cf8469e5e267f33bfd8513f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbd346c-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684737818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737818, "uuid": "2aa23881-1967-4bbd-aab9-9dd4c47b2fd8", "comment": "Malware payload (AgentTesla)", "value": "25221ffce844e3a30aa0f8275054ddd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737818, "uuid": "74fc19db-829d-4e9d-85c9-c7d110b07961", "comment": "Malware payload (AgentTesla)", "value": "85574a66e3fbb37b82be9171860a77e52033ca6d877f5eb46011ef5d470cbe93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737818, "uuid": "f5a5067f-8219-41a1-bfe3-19712d71c361", "comment": "Malware payload (AgentTesla)", "value": "157eab0cf888be0837a7e9927ea2d9aa88b86856", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737818, "uuid": "2aaa7b17-dd77-4df4-a637-343a69c60a5b", "comment": "Malware payload (AgentTesla)", "value": "048767a8358b43df1c3a55832e57c019cb77ee742ea065501086abeaff09c471a161970fd97db1b8c63554c9e856bfa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737818, "uuid": "cb3c848f-7888-4291-b471-3c0ed240a7a0", "value": "T14CE4F1C116988D14E5AA5FB94AB3F63443786C51EF27D70E24E06C8F7CA6A827B017C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737818, "uuid": "9341c597-498a-4de6-a005-37f5c9002911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737818, "uuid": "d46adfec-6ccf-459b-9cc1-cbf058a90bb1", "value": "12288:pTHx0YPX/NqPs+L7p+UaRGvW+xfoQg7SNWRPOihAQniDS:pTyHPs+ttaZ+xfHiSG2tQnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737818, "uuid": "bad98866-831c-4050-ab26-f7e2c1b79a7e", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737818, "uuid": "c6417744-2ec7-4fd9-a0a8-14b7b7f37144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737818, "uuid": "c54204dc-ae7f-47a7-9444-e041b8951f7d", "value": "DHL Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bede0193-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777230, "uuid": "89d8e398-e50f-4069-a6ad-81553c619f59", "comment": "Malware payload", "value": "b5be6a7235ad9e00d8bfabf5cd292db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777230, "uuid": "012bc351-4542-4bae-910d-900cd7c36ce2", "comment": "Malware payload", "value": "85beb406845c744f7105ab65add81da74a26c72d9ab094b09b67c67e7e38edfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777230, "uuid": "c4d91977-16e8-48f6-b103-f87df5be6324", "comment": "Malware payload", "value": "f4124e1944435f94e55d8f3f54c1135e9fe0e0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777230, "uuid": "29ddf254-345e-4be7-9335-efae9499e6b7", "comment": "Malware payload", "value": "acb905da406540de996dfc6519641681c66712285c1d7127c852d3d80a7f1d3f761c4b6eb411118773cc4cb73c381314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777230, "uuid": "f61c9bcf-ecec-46ed-b149-4b8616c8c4b4", "value": "T1BD827A967314D8BED09454322D23DAB872217C3E9D145E073BE86B0F7E32396EC02696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777230, "uuid": "f46780cf-643a-4eda-89d7-5742e50884ab", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777230, "uuid": "edefd1e7-bbe1-4267-9144-01ad1963ad4b", "value": "384:pLDTs8hsF6qtK8lzQ8+Sych3mYvCPHxFbi:pLXVhaTtDE8VfCPHxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777230, "uuid": "65d80dbd-9cf6-43cf-a0b3-fd058e2d424d", "value": 18567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777230, "uuid": "5f68b752-e12e-4014-a132-67f4c19f18a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777230, "uuid": "eb037c10-4397-4487-bbe8-15a7f66be5e4", "value": "SecuriteInfo.com.HEUR.13982.4586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae83bfe-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763667, "uuid": "a40e5e91-50ed-43ff-a697-ee59a30832f3", "comment": "Malware payload (Mirai)", "value": "fd90c5b7a571a6bbb84564614312f318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763667, "uuid": "abfb4af6-74b3-457a-bf97-1a0bfa7ba84c", "comment": "Malware payload (Mirai)", "value": "866690afdfcc9e24197ede96c45617f3683ff72c7621a0e507cedded8f3bc879", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763667, "uuid": "c1fa34cb-8d9e-4708-9baf-b480c40e0284", "comment": "Malware payload (Mirai)", "value": "0b78d3fa0965f013a48a2034a55ddabc670d210b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763667, "uuid": "4d1eb636-6ce4-4239-aa80-4e1daff71479", "comment": "Malware payload (Mirai)", "value": "5d783ac98c2b63557637c2b8fb16d7fee5d8eea148cd596bddb11642507967fe9c3543e2acb866d1ce7fcb29a14304c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763667, "uuid": "7c05f15a-9c5c-44c2-a5ef-5b925015f1f8", "value": "T10F438DA4E8642DE9DC124478B0788DB9D3934EF545C90CB52CDDA59004FBF4EB58DBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763667, "uuid": "91e912ba-8597-4cb8-8dab-a5d881e0bbd5", "value": "768:/Hm7V4/EkEWjE+nEVEVEG39YBjsxc4ea8MK9fwUnGOA92ntVsRaDRChqmqyhycPt:OpHJnD22G39DPhHgD/Wmtshr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763667, "uuid": "e0d5099d-62d7-4c0d-a31d-bb74f1296af4", "value": 58240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763667, "uuid": "c6bca9b5-093c-4578-8354-6786c34dcd94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763667, "uuid": "208533fb-3dc4-4118-b6e6-9a2068bf41f7", "value": "fd90c5b7a571a6bbb84564614312f318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df9fb53-f87f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684746090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746090, "uuid": "29e5abc3-c4ca-4ad3-8980-b78b30683041", "comment": "Malware payload", "value": "26744c6547491810a71b06b466abf46e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746090, "uuid": "9c4c17dd-c125-4136-bbe1-cbcc687865fa", "comment": "Malware payload", "value": "8673f7dcc57549b6fdee6997c0f3ac0c7ead39b19657e38e428b87a53ac07e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746090, "uuid": "6673b585-82d7-4276-ad6a-9f49a8648730", "comment": "Malware payload", "value": "b7d9d54c0a5878ff1e262cfc4315bed733b8bce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746090, "uuid": "6be370a3-3608-473d-925d-b7fe1bdc043e", "comment": "Malware payload", "value": "9c48b3642253ef2587f2cbbb85727b2be68a1d8dfa750abfdf948a5b2c091d40af753b60763a1e645d21909c8236f3bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746090, "uuid": "2111f0a4-934f-439f-a074-9357d08085a9", "value": "T11095C500D701521ADDBB25E94BAD313DB10CEAE0131464C785C8AAFEDBEA6F13E355DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746090, "uuid": "77813e48-65f7-4cda-b17e-c11847907c78", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq8l/GI3:HLz6va++B6xN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684746090, "uuid": "16080241-eff1-42df-8942-3dd3a3aede10", "value": 2050583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684746090, "uuid": "474cd875-94c2-4669-8578-7dfa8fb87949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746090, "uuid": "50b5e308-ccc0-4e92-ae63-ec0d822224c0", "value": "26744c6547491810a71b06b466abf46e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c920e6-f846-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684721729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684721729, "uuid": "254af01d-5886-4f81-9496-9389b48e46ac", "comment": "Malware payload", "value": "e961a459016d4c21330a27631b3c941d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684721729, "uuid": "5500fcc4-b80c-4e21-a106-6a61af81fe95", "comment": "Malware payload", "value": "867cab5c0ab9a5ee0180c65dea762c0068379ab8da45c696a0340a3d84047129", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684721729, "uuid": "d951144b-ab2a-4464-89f5-2826c4587343", "comment": "Malware payload", "value": "570241437bcf3769d8821ed7723360925d8aad1d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684721729, "uuid": "5884a31a-18ec-4644-b0b4-19372a8ab33c", "comment": "Malware payload", "value": "e694c71a8dbf6b29de24a58c5c69534c6a7264356b56b6deec7a9d8cd5f3a815c4a3d1047a91cb0abcba180651bb3595", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684721729, "uuid": "0c197613-aa25-4c6f-bd74-2244e1e67d9b", "value": "T14D073392F7A8BD2FCC33C1334BBA067216425D158752E71B6825736C68FBAC88E54BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684721729, "uuid": "d6af896c-3660-41e9-8d10-7537d4d652f1", "value": "393216:XbmO5+GEg4/zvpdmt5yMGRo17nBYVqslAKa6SQakZo:LlJOzvpdmt5ERojOqslvhSEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684721729, "uuid": "0994dad1-4bee-4cfc-baad-f81bc9022dda", "value": 17326720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684721729, "uuid": "734ff866-f880-45a6-9948-b1765272861e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684721729, "uuid": "aeade227-578e-47e5-a37b-2b32bc4e6b37", "value": "kurulum.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01304e79-f891-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684753719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753719, "uuid": "d949ff5c-b374-4563-ad03-47f64221ffbb", "comment": "Malware payload (zgRAT)", "value": "bdc8920e18465206297f51b7a4b6c979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753719, "uuid": "9df69d20-7c6f-483f-9e82-de5261942b61", "comment": "Malware payload (zgRAT)", "value": "886dbf75e1d57bbe78da5678cd361a11ab3b21e0fb8aa0d9cc69a6c5add774bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753719, "uuid": "73808f74-4e51-46ab-b634-1b1f6f178a2e", "comment": "Malware payload (zgRAT)", "value": "56435415d56b12fe3c5c644a320e3b2f3f4ee9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753719, "uuid": "fc1ec623-f36a-45d6-bcf2-d78834026857", "comment": "Malware payload (zgRAT)", "value": "e97b7b53ea27d85d5c540752b2176bd3c815a927273a830f81f4a40785b413cd21b6b16acd7f30ec41243d0e2173f15d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753719, "uuid": "a69703c2-ca47-4220-bb76-6d4db1f1bc3f", "value": "T19434F166B7C74C92C59EAA3184C097152370FB9FA1A3D70E32CC53538F233C6D6AA569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753719, "uuid": "9411037c-6959-4880-8afc-be4c18141c92", "value": "6144:oimueHdVfELsan0ohCKainBFgFdkNRQrlIpxMU1WGvj5:zmvHHELs23BaAgbkfQrla+Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684753719, "uuid": "f8da2322-6a03-428f-804d-13ccd193c446", "value": 252480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684753719, "uuid": "b43f1e90-7fd4-443f-8325-707b2537fe14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753719, "uuid": "38cc6d55-4dd0-46cd-b4a4-02327a350c4a", "value": "Shipping Details_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc6edeb-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752260, "uuid": "b71bd435-905d-4a6c-8c9f-62f44a206c69", "comment": "Malware payload (RedLineStealer)", "value": "8b70b6bc05008f15770a004bb8bff3f2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752260, "uuid": "0bbe25f5-f728-4443-bb25-451d8948fb52", "comment": "Malware payload (RedLineStealer)", "value": "8886a922886d66be9deb8157df8dac8dafe13e5e4f02ff874f4bc72f7f49ec42", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752260, "uuid": "cd4e32f7-c8b5-4f21-9416-7337b8e0c8b4", "comment": "Malware payload (RedLineStealer)", "value": "e4e6571d266a84ac996c82966604728d92d56b42", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752260, "uuid": "5246e3a7-58b1-4aa2-81ce-d267beba7adc", "comment": "Malware payload (RedLineStealer)", "value": "3ed54fc3f08b1e8bfd0500c298ee51e9203c6cd9a5bde5e6dccde957bf749a07d52ec8bbf35159dcaeb189c10c08314e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752260, "uuid": "35af3753-cd84-4a7e-837b-30bcbbe1dbb5", "value": "T1CB252312FAE91567D8F12BB018F9038716397DA29CB4836B23C6E55E08B25C4E67173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752260, "uuid": "8d404770-935b-4a40-9124-2a8f1cfcbe06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752260, "uuid": "2f89c58e-953d-4f51-b099-b5b76ff6b55d", "value": "24576:0yGOdZ0+C+fUlQHGDga5J+kS8bP56QFVYg3gkBjgr+IYVyq2zO:DGOdhC+fyPB6AugQQjgrPYsq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752260, "uuid": "ff87b645-baba-4341-8c35-21b22ba54bdd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752260, "uuid": "0446dcc9-1518-4564-a214-3aa206dea6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752260, "uuid": "ac3ecb17-519f-4058-98be-869041159487", "value": "4724144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcb23d8-f8df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684787613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787613, "uuid": "96f2ab6c-6a52-4eda-bf28-573c45040889", "comment": "Malware payload (AgentTesla)", "value": "acfe17878d01e73788528f9c0e36f8ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787613, "uuid": "acc8319b-9007-447f-8a56-17d9d481f16a", "comment": "Malware payload (AgentTesla)", "value": "88c781e6e6adf31e3e128be59b2d85d3e1f06a21cb7ff657e6484f2d6f9e6559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787613, "uuid": "65afee7d-9caf-48bd-bbbe-a8102b83e605", "comment": "Malware payload (AgentTesla)", "value": "5b60c16b85c11298edc82260db00a25f27e4018f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787613, "uuid": "386a3f8d-6180-4b16-aa71-a2c276de88e0", "comment": "Malware payload (AgentTesla)", "value": "846a91bf8a97e88367af8d934d15974fd472c6acd9e2114576b58341fabf17d0423493fb73ba72e72ff5f0e933765850", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787613, "uuid": "9a24bc3f-66e1-45dc-bd17-5aacbe9b4818", "value": "T12AC4DF5A61A4CF1BF9758BF19474FF8063F1B073A4E0D1282F6620C6D9AAF101E5CA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787613, "uuid": "229bc01f-0609-47d9-9368-fe7eebde308a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787613, "uuid": "aeb555ab-3e18-4fee-8ebb-dea982c417fb", "value": "12288:dgENqOB1DvSEPYvTsNnJDjNL58B70sKWXqqfRt:JAOHxWTsNJDduTKWXqqfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684787613, "uuid": "1794e8f9-4f72-4b42-81f4-60f9aba693f3", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684787613, "uuid": "bb20e7b9-eb0f-4f76-ae2e-592bf1db78c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787613, "uuid": "278a20a1-aa46-4508-b59c-9f8aac537e21", "value": "draft shipment document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ed2f67-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752269, "uuid": "12e750bb-da7d-4cf7-be69-2728c45f5556", "comment": "Malware payload (RedLineStealer)", "value": "c1cd471ffa852eb88b963e9be434fa4d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752269, "uuid": "ba5bdf5e-ffb4-4c17-92ef-c2289c5c6e19", "comment": "Malware payload (RedLineStealer)", "value": "88e586a6966cf971757c8480f47e17b2c136664187ec56cd092850da33b28f75", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752269, "uuid": "818d9089-ce66-486c-8d1f-d0d1d646a859", "comment": "Malware payload (RedLineStealer)", "value": "0ab5d0abd92a86983cc8fec8b694ddae94385df9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752269, "uuid": "b754fd3b-a941-4ca8-8c37-6474cb18e22e", "comment": "Malware payload (RedLineStealer)", "value": "12ff83d68c1134deabe2e3de5bc24644f83ac35316fa38aaf3c88ce3e3cbfef765525d70821ce898c4855c331c7ca6e4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752269, "uuid": "221b241c-c6ab-4e8f-8565-47aa954f270a", "value": "T1142523113FE85472ECF06B7060F602530B34BCE195785B2F37946AAB6A311C6E5B1B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752269, "uuid": "84d76a1d-b05b-4ce8-828f-d6dd2047636c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752269, "uuid": "f1dbb51e-9a74-4341-9ed8-adb109b33392", "value": "12288:dMrxy90UAFvP/fle3mEEjyAMDRqoPLtHNcfAKeu3ZEigShAZ32UFGZurvakwRtIe:4yidNEWuqQLtHNcfXyXs0rikBVTIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752269, "uuid": "69e4ca66-94ab-4f26-a26f-7b179610e6bb", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752269, "uuid": "b62c0c06-df70-4e8c-84bb-c07f45067e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752269, "uuid": "e5ae5a50-7d85-4f63-80fb-91f9aedba765", "value": "62263263290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c45df05-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684751805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751805, "uuid": "f0b8ead6-4c7c-4491-acd0-4eb1969754c5", "comment": "Malware payload (RedLineStealer)", "value": "3957ffbf4b1ec6511ea0b2f2f4f2681b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751805, "uuid": "97ef4a3f-02ca-4e2f-9b52-1d707df49dc0", "comment": "Malware payload (RedLineStealer)", "value": "88f618756dc1a66bb022136ebf418f2760b9e41207326896bf7cc982821865c7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751805, "uuid": "05e9eca0-7bd7-4677-9555-7edb85718bda", "comment": "Malware payload (RedLineStealer)", "value": "6c020bf498014868481d4c57ba85a729086585da", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751805, "uuid": "d6f35d07-74ff-4132-9bb3-7d59c49297a3", "comment": "Malware payload (RedLineStealer)", "value": "d08199112c4bbc1421c773053cf7f4d7931f42af7cd0ffe0642e6132a859cc9c33740ab20ba8a1ec2fea1a35666a3f91", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751805, "uuid": "d044e900-20f5-4fe6-b425-d71b2cfad8a0", "value": "T15025231259E85073FEB057B068F30B970A397CA1A534D3662388965A1C32BD4F5B27BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751805, "uuid": "413497ff-d2d2-4022-8976-3c4a74d9372d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751805, "uuid": "9016081f-aa37-4742-b506-6f90ee845210", "value": "24576:CyZEKUAmLRC+vvGM2rHJ8uHM6p2ggCSdv56LUX:pZZU9GrHzM63jw5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751805, "uuid": "5ce84529-0bc6-4498-a948-ba07fcdd19e4", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751805, "uuid": "05a4b760-f348-446e-8bda-04d7250fbcf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751805, "uuid": "68f26a9e-f939-400f-a532-c35d2d9b0fa8", "value": "4743250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69c29c3-f86c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684738185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738185, "uuid": "ef359a23-5ad5-45f3-bd73-e904a8a530a3", "comment": "Malware payload (TeamBot)", "value": "b9318925e37b36b0dc8998ed20c885d4", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738185, "uuid": "5fa09a00-b6ba-45c9-83fc-90429c9db02f", "comment": "Malware payload (TeamBot)", "value": "8925834d9802482b1aaf21d76089690975b722f0c662a0fa12d77ae9df291de3", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738185, "uuid": "d0ead2a7-2d85-4083-a8be-b7db2f40cbf0", "comment": "Malware payload (TeamBot)", "value": "194f68d06f0101844bbb8e2cae7bb8785170a079", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738185, "uuid": "d03b9f98-0983-4c22-9fc4-c91edf7d33b5", "comment": "Malware payload (TeamBot)", "value": "2cacef644e130a63cfd65bb9e69154e17e87f3052979bc9e4acdef3cc974df3185def5fc1408f9a2c14273cff62f1345", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738185, "uuid": "34363b1a-6e9a-42e1-9d48-66352ac821a4", "value": "T1A605F11392D16CE1F7264B728E1EEFA8769EF5204F152BDB2B845A2B05701F2C672F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738185, "uuid": "452b4fe0-9202-48f7-948e-eb3d397507e9", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738185, "uuid": "6fe3d606-7b61-45c1-b82e-d9a2c112c659", "value": "12288:AgmOu9vkdOweP7WoHOm/FpXSBuQXupSAMMvjfwC5yWNN6+CbbNgk:AgS9vk/247uIaSSL3ytbbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738185, "uuid": "978624dc-68a6-4874-b0b4-8ae9602db6e1", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738185, "uuid": "82b55901-bf89-4e19-969b-3f9cd23bd9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738185, "uuid": "96881ade-bdc0-401f-84ef-0270f2056288", "value": "Setup160.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bc2825-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752443, "uuid": "49553fc9-1d57-4291-9b3f-05ba93909455", "comment": "Malware payload (RedLineStealer)", "value": "ab07155324ae696f32b84c7820db4eae", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752443, "uuid": "7357b8be-2127-4858-be4d-7c9b024dc00d", "comment": "Malware payload (RedLineStealer)", "value": "892f0022ebfebd7a0d415a7e080ccb49b2adb23d52968c88206b52fcc5ce023e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752443, "uuid": "04b63424-4a6d-4f6e-b8a5-084b09b25c66", "comment": "Malware payload (RedLineStealer)", "value": "4a137bcf1e62b658da9538e890f02c81e6dac0a7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752443, "uuid": "a707ae60-bf12-4de5-a852-78c0171aa75f", "comment": "Malware payload (RedLineStealer)", "value": "b520d7ad4f9206e126fb8663f293a35198504b3b669f33fef841495d9da898b7727bde97c3b09e7a6f9b1935a7f0dc47", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752443, "uuid": "396cf915-f7db-4252-89f7-787d3b397041", "value": "T1ED252317AFCC4135ECF3737128F61B930B32BC714A78476B2365A51818B26E1A9B536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752443, "uuid": "ea11b73c-fd0b-4203-987f-e7d287bb38c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752443, "uuid": "c8233959-a687-4c7a-83c6-046171598132", "value": "24576:jyP24eQucaHqEEsURivtZyL43LnPi3ineKG9roUY:2revtHqzsUivrdLna3Gor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752443, "uuid": "67d50320-9b23-4954-bfaf-ed081ae3467c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752443, "uuid": "26ef9280-020f-4f2c-8b49-0fd94e9c4274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752443, "uuid": "1813ed85-17d1-4306-abd0-543075f6446d", "value": "generator317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f6bd70-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684762748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762748, "uuid": "dac0ec80-55c1-4571-b1a3-6e6524b35952", "comment": "Malware payload (AgentTesla)", "value": "33aafdcbbee5896be71abe19e26000db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762748, "uuid": "482eb3e9-1974-4c12-ac42-127658bfa184", "comment": "Malware payload (AgentTesla)", "value": "89aac1da79c39c6dca27fbd441600f2fc6b72e051d3e31e6c6738f4fa84698b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762748, "uuid": "f28b84a6-48ce-490c-93d2-e20a20dbaffd", "comment": "Malware payload (AgentTesla)", "value": "108a28b629bd34d8c766face9eebc01eae7dde1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762748, "uuid": "b26dc08f-802b-4ea9-95df-d2601f51af49", "comment": "Malware payload (AgentTesla)", "value": "cb13bbd29a5b4d26cec66cf21608233d033b110059945230d93357d3c9b57933415d5184f83bc430819d888be870c3b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762748, "uuid": "1709594e-bf0e-4be5-a2c3-2fd245422af2", "value": "T16CE4303C2CBA15E3C538FBAAD7D160F3B52B8923B70F9A6500C347267A6692177C251D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762748, "uuid": "4d79092a-2887-4084-8121-7d1e33a315b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762748, "uuid": "cc643ee4-4414-4cdc-a153-c5248b11540f", "value": "12288:88GJcCoz0IPwwpcFlM6xOCvjNgLsdmc1pBWMm:8n5oCDFa60wjAn6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762748, "uuid": "efec8efb-c231-486d-822f-df06f7ba291d", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762748, "uuid": "47eef628-a144-499e-b3fd-26fcddda9181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762748, "uuid": "61a9e3d3-b5f3-41c4-b0d3-6ec9b4cc69ce", "value": "R F Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e04e275-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745177, "uuid": "2346929c-f7b5-4964-862e-c5dedca61d18", "comment": "Malware payload (Formbook)", "value": "65efa9fc533749d45af997a874719588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745177, "uuid": "152775b9-c955-4cfb-bf89-b171c02d7224", "comment": "Malware payload (Formbook)", "value": "89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745177, "uuid": "67386ea0-f136-4fcf-9599-31c99b63596c", "comment": "Malware payload (Formbook)", "value": "4e5702dffa295ec86b48b74fd3f909b8994236d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745177, "uuid": "26b1a7cd-6cc5-4ebf-94fd-104bd2ad435d", "comment": "Malware payload (Formbook)", "value": "70ff09c231035c745257c067e9aeaa0f9b0b91b5d9991906e95549d93d7f6d051738e6763ceae9519f788642ad917f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745177, "uuid": "c4762651-5721-48e6-bd5f-2aa8f0d909f2", "value": "T10EE4F1D136589D10E6AA5FB81AA3E23443B96D94EF17830D24F06D8F7C66B823B017D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745177, "uuid": "6302ff21-4971-4bd4-a124-3e926d923b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745177, "uuid": "0ef17e92-efc1-4a17-92db-cfe5f5f8edf1", "value": "12288:Utpx0YPX/NqPsHqAbe6ZxcbHO+9J53SBkvyo5uwVbRX4sjqxH:UtcHPsHbRZxc7O+7xcNjcbRHqxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745177, "uuid": "3c9872d1-ecf8-4162-a804-65ce6b294a8c", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745177, "uuid": "27a5541c-1dfd-4add-8fdb-db464206da7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745177, "uuid": "ada0423c-afb9-465c-9f4e-062836afca03", "value": "Order Inquiry..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39d0c82-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762608, "uuid": "a37ffc21-98b0-456c-9099-7e96bee91167", "comment": "Malware payload (SnakeKeylogger)", "value": "987d49f108d6547f399321243e4a1404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762608, "uuid": "465660fa-01e9-4590-8eba-491ae10d9d03", "comment": "Malware payload (SnakeKeylogger)", "value": "8a3fc82f5797bd7f3c3419983670a6f51d3111a8a7e7c5ad3e099eda1669721e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762608, "uuid": "16889f42-4f1a-4489-a965-0fc416789942", "comment": "Malware payload (SnakeKeylogger)", "value": "2c26076caa77856bd0e08632080b6a478cf39afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762608, "uuid": "78dd61d4-6e46-4ce6-af82-fcef3e39085d", "comment": "Malware payload (SnakeKeylogger)", "value": "b1fcbcbe6836872080ac4f2f38ba82aece5c99bb2cff3e07e4d6693ea5e914ca41a41e7a4ccb51750112fe50cb9563e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762608, "uuid": "5da3b5b2-2097-438b-b24d-abeb8718b123", "value": "T14425BE5233B57621F47D33FD0115638CCB39B04A2112E22A2F5A3AD586E27EB771A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762608, "uuid": "ca90fabf-035d-4408-a13c-7e023c598c7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762608, "uuid": "b5977f4f-97fd-4af8-a364-d28e15da8499", "value": "24576:3tTJuUS0fQzWRyT5c1m2S8s18Y1o8hcgC7pzXAnCWOFDvdR:dJFQiRA5IZSI3HNzQ3OFDvdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762608, "uuid": "895a762c-8f85-4881-ba4d-02990f8a02d5", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762608, "uuid": "e3478958-1adb-435d-89a6-271d1131ca8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762608, "uuid": "585a792e-4811-41f8-af49-bc11a362b1a0", "value": "Pdf 29384672762783286329462 Image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d873c8-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752228, "uuid": "cc6b85ea-0032-4f75-a395-a118a4a7aa93", "comment": "Malware payload (RedLineStealer)", "value": "5982d92b84ba64a669d25b224a6da380", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752228, "uuid": "c25f7cf8-5b9f-4f4c-9188-f431b6c2ef89", "comment": "Malware payload (RedLineStealer)", "value": "8a43dc947d9b18c7a78caab6386d44d167fc2dfbf6ae3f4ba0f7f1e784e6502a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752228, "uuid": "d6d9c97c-674d-4b9d-ab86-9ba474de7b28", "comment": "Malware payload (RedLineStealer)", "value": "afbb111c0973e1f4ca0f3496a8b4a39590824c33", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752228, "uuid": "cfa3370d-9ba9-4fe7-9b6a-d20633684bbe", "comment": "Malware payload (RedLineStealer)", "value": "79bd20dfc426fdc5d53440c8c5ce66bd9ac52c13a3093e6b753574ab1911c0082b775f96683169b11d739c0dcb00cb49", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752228, "uuid": "0a590dd7-80b4-4355-b166-f0f0028a71d7", "value": "T15F252307AFD88166DDA52BB05CF11B630B36FCE19CB4D31B0789A9AA5D73988107173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752228, "uuid": "55276e77-d921-45f5-9222-bc1b4e31f630", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752228, "uuid": "088ef5c6-f7da-46bc-a487-d92133cc76a6", "value": "24576:3yw+THkR19MHKs/hbqICSjrV2Gtqjyp5vYlaIN+DX4I:CJmLIKspbqwjrVhtqj05vaa++DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752228, "uuid": "58da3dfb-7378-4059-b38f-038bdfbae048", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752228, "uuid": "b3c4a0df-0ca7-40af-89b3-16ea0b2540b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752228, "uuid": "b4d90aa8-4ccf-42e5-8378-3c3d5dbd4650", "value": "26324353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25455fab-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737458, "uuid": "0f67ccf1-9be7-474d-89d5-37f431c9e64e", "comment": "Malware payload (Amadey)", "value": "eed756bd6f1b89ae8ff01abea91ebdc9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737458, "uuid": "a7ff23b8-eab0-4d81-a118-95cb8dbc7a4f", "comment": "Malware payload (Amadey)", "value": "8a64268344a5f815c771d60e01944dbef2da0d113fb28bb4de51346ee70f33d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737458, "uuid": "e944eae9-1430-498c-845b-9ea5526099c5", "comment": "Malware payload (Amadey)", "value": "9b7225b6b69f22d9f7084d55ac1af5743797b8fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737458, "uuid": "8e6dcce8-eb7a-44ac-96ee-cdcb816df94d", "comment": "Malware payload (Amadey)", "value": "e0d427c0628c0b65a61b4b9ddf5fa7a1b5da09c9515a6ac2236fa585599814a56fd79c93b19b4755db5df56edb85c772", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737458, "uuid": "44d4a2e3-bffa-4413-b73e-a17a4c19b02d", "value": "T1F9252326EEDD4061E8B8773495F602D31B367DA26F7843A73B0868891CB35C4B93573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737458, "uuid": "5c165ba3-9c64-4c6e-bb8a-d45eba0ac873", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737458, "uuid": "e005760f-e9f4-4a0c-802a-8f47658fa15b", "value": "24576:TyCfMTZ8uObQql0SgRtSJj8XpaGi1teU+:mCf4DWFl8uJj8Xpjiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737458, "uuid": "5e520b74-2d9c-41ed-8c12-663f95f9e39f", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737458, "uuid": "97215de2-a3ca-41e2-b2e6-959125b93538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737458, "uuid": "74401dcf-d12c-456f-9bc4-c403b41d3b85", "value": "formatter496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3803fd6-f849-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684723094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723094, "uuid": "640b4230-3bce-4c0b-9dc1-e24b1d229e72", "comment": "Malware payload", "value": "9b414b7d91b67f019b3a63382dfd666a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723094, "uuid": "eb82d630-9772-480c-9977-e614b3cfd30e", "comment": "Malware payload", "value": "8b24c35a9543f25a7d45ea63e8e45389d94d3a84162d7d720b0e1edab4f5b304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723094, "uuid": "ad309737-ddde-4473-86c8-64cd67883a73", "comment": "Malware payload", "value": "1350417b0c8dc74f7efb5d862e96f115adf3e995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684723094, "uuid": "fdc68492-ec35-497e-9fcb-37e851ee8a1d", "comment": "Malware payload", "value": "b1542a1c62c5fc7f8c3bf561d161579b935e091c6f15f933b0b3082d5dcedfd541ffeba46ed886b7abe1c0d7d2234a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723094, "uuid": "bef1b13b-19d5-42a8-b771-37c575fb3fb3", "value": "T19A26335462A40EF8FD32813AC981C509D6B2B41117B5D79F87A4C2A25F2BBE07E3F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723094, "uuid": "95280b7e-ae67-455e-9c52-4335ddeeedaf", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723094, "uuid": "5c5521d1-0545-4aab-91bf-b9f475ed7c7f", "value": "98304:L/mrHQktlw2Kce0t+JhVWn2xxjsAIzsQlA67LVN:L43tlKXjXWnA3IznF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684723094, "uuid": "5564f06a-b100-4e2f-a24c-c094d4f2a944", "value": 4632204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684723094, "uuid": "1a66cf4d-cf6c-4a10-8a0d-7a6236c890f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684723094, "uuid": "d01c45bc-8a10-438a-87c0-53776f5e7979", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab45476-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752231, "uuid": "e6fd953f-7d40-4cc4-b497-3b8cd6b8b1ee", "comment": "Malware payload (RedLineStealer)", "value": "5c22fc6b5fa3fdf465b43aa8b56569d1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752231, "uuid": "56171eda-49af-445b-8aff-5fb304922cc7", "comment": "Malware payload (RedLineStealer)", "value": "8b67e7b1505ef5ab83c8589cbdad0f4b164e7976058e78d31233f4e80c15757d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752231, "uuid": "2e197798-9095-492e-9cbd-ed7e590a3bea", "comment": "Malware payload (RedLineStealer)", "value": "f32b1e9138e97545a55907120ae15db2f29a3f31", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752231, "uuid": "0e03de74-ab30-4c5b-b476-56fb55b12fb8", "comment": "Malware payload (RedLineStealer)", "value": "50247aad0dd06f11c5ac5396cff86af5e3a375ffc16afc35a39af8bd86aa34300b6c9d7ef37cce7c6c1cba1b408c0756", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752231, "uuid": "305ef234-f3a8-4669-97dc-b61cfc795ca2", "value": "T173252303BBCDC532DD79237128F217930B31BC528D79666F23892A5F8C736A496B1726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752231, "uuid": "c617af5f-7463-4415-9487-ed744162c54d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752231, "uuid": "ff75a44b-7311-45f7-9a84-1cea4b951d42", "value": "24576:oySfIcq3BYX98P+7OVSnxQzX33Siy8JNO:vSfXqR+9827jxu3K8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752231, "uuid": "a1e8bcd6-ccb8-423f-93f2-390ccc8b5df7", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752231, "uuid": "ca962737-2cd8-421c-98af-d1e1d2bc66dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752231, "uuid": "77e829b6-0366-4b49-91b7-3f883e381da7", "value": "2724243512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97775e8a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752253, "uuid": "f2fc1f11-2413-456b-b09c-14dc7fe01a63", "comment": "Malware payload (RedLineStealer)", "value": "0118220035a974f3d732cc5417141491", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752253, "uuid": "5fb3aa3f-8c1a-4477-9cbd-6e518ad0858f", "comment": "Malware payload (RedLineStealer)", "value": "8b9a6aa3c2148dbbf7ba5004529f76808650b31dee24969e8c6a4b2b08fad37b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752253, "uuid": "66a8fc59-86a7-4a06-8a6e-6945f51c4d31", "comment": "Malware payload (RedLineStealer)", "value": "37f91666248fbebbf08a9c076a1f9c7df4bef23f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752253, "uuid": "954a1279-74d4-49da-a7b7-075aa7ab55cc", "comment": "Malware payload (RedLineStealer)", "value": "f42ff027b6dcbc6746631c9df4a923119393f22bbd9701c5a5fdb7a336128018d3c717cf675f8ddbd5dd68a3d3719b51", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752253, "uuid": "c6601134-182f-4aac-affb-efc6c2172d5c", "value": "T102252386F7CD0472D5B03BB854F612CA0E36BCF65D694B2E3390B85E4CB2594A53236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752253, "uuid": "aaf74719-af2c-49e3-9f64-bedcca380b62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752253, "uuid": "b6107c65-e664-4cbc-b137-f79111d8a293", "value": "24576:lykJmUsdOKwmUUwB7T0e+qIXgW32O5q/EeC55:AksUsdOmUUwFT0e0Qs2mq/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752253, "uuid": "ee53c1bf-7d07-462d-ad70-e2572550ecbc", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752253, "uuid": "a8208420-e133-43df-9215-8a45edc48713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752253, "uuid": "6ccfc072-d6aa-47b8-9050-117d0ee7ae2d", "value": "42345333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701a4f54-f8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684789124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789124, "uuid": "944bc102-af97-45b4-8be0-ac954915de62", "comment": "Malware payload", "value": "8f25a3af05123f6b6a549b4df112d022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789124, "uuid": "dab849ab-55f9-420f-a940-29c1bc0e5aa5", "comment": "Malware payload", "value": "8bd082e00a08eed25b4f5d60eb152c5b252e34c6072cdd5d1ebcb506ff3e386d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789124, "uuid": "ae247b44-62ba-4312-818f-e0fe1929daf2", "comment": "Malware payload", "value": "38e6305507d75169f9c8c238d074fd26d3f1ea9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789124, "uuid": "9e026005-6331-48bc-baac-feaa4ead9e56", "comment": "Malware payload", "value": "20895afb821dd825eb92a09a62fa4f147821ce6e1697a8cb63017479b61f6ad77aa7b4ceaa9b8af04fa207b3d0721692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789124, "uuid": "c381a447-e398-43f0-94cf-d6f02f756ec0", "value": "T1DC656E303AFA601AF273EFA59BD475D6DA6FB7733A0BA45D105103870B22A41DDD243A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789124, "uuid": "eafb3493-e095-475d-a9ec-9d0cc73b17ea", "value": "12288:0Yes8NB+/p5/xea58sIhwGgos81sllSO8Plo/pMOu2gQh8JKuwpKCrOWxtjk/uIu:8aG3q4byF7jVIPtCNV1SiIJhSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684789124, "uuid": "d94228b5-da52-472f-afc4-71e801723cfe", "value": 1447424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684789124, "uuid": "673e62be-59d7-4573-a865-6b2803e695b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789124, "uuid": "6d56b819-ff2b-4ceb-be14-9430055c71a8", "value": "59e8e6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952d1b59-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684752679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752679, "uuid": "4c7506a3-c12e-4815-9ace-4f9a874b1ad8", "comment": "Malware payload (AgentTesla)", "value": "e5930ee33b10f0bb27d4bdf91b8a9d33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752679, "uuid": "ecd2c9a7-a22a-4d8b-b69c-05591b73d1c6", "comment": "Malware payload (AgentTesla)", "value": "8c1790153c723f02f2d6126210a9c205988e79eed8d65d48d884d50fbf80fc12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752679, "uuid": "fba08598-fc8e-4390-9b01-79f1b9ea7201", "comment": "Malware payload (AgentTesla)", "value": "49be697038f44c36d397b5143413ccdfaae37493", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752679, "uuid": "26517ee0-dfb9-4709-baba-b1ec271b226f", "comment": "Malware payload (AgentTesla)", "value": "80214e4e0698bb8989c31a734e8285c7bd75e49c970a7f7009a3d95794d4739be187853a0696fbb9647a93b975d561fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752679, "uuid": "6510bde0-4dd2-4f56-b393-a08f5738bba5", "value": "T105C423B12CD3049928CBBEB93270456E4F8EC759D79FA359339C5AAC218D3B9DC4AC14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752679, "uuid": "90df5c71-3dca-4d5f-b0a2-2204b9957434", "value": "12288:AgZ4gM1p50okuK4K8tueHg8bUuyin0Zwt1y:6vHK80IUgaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752679, "uuid": "7609e846-2cad-483c-93cb-9e101f3e60f4", "value": 560691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752679, "uuid": "8d502361-7913-4e32-9caf-dfd62fedb3b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752679, "uuid": "6243de36-3797-4a62-a22e-75aab651af2b", "value": "PO 4000101479.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b06e89e-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684734918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734918, "uuid": "246a68c5-267b-49e7-abbc-519ce2c0d3db", "comment": "Malware payload (Loki)", "value": "db69a228fbc36b15049108ad142a227c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734918, "uuid": "598a3d8f-2084-40dc-845d-311120970a4b", "comment": "Malware payload (Loki)", "value": "8cf00d2afc13dfb147426c04aa2e0f01185ece5cc6d33f0c24dab812fcb2ddc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734918, "uuid": "abcda924-185f-4ad2-ad84-1b59e9c4e6e9", "comment": "Malware payload (Loki)", "value": "6d5efb8fa0d2f076451d34b50c43fd1d2efd4de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684734918, "uuid": "9143b0ef-5d47-45e8-8ba1-81d0ab4a084d", "comment": "Malware payload (Loki)", "value": "948cd05a940d85fb399f9d8b92e2d46687a8d8ed02f7d697aa283b310626ce2017971683aadcb312a4ba330331684f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734918, "uuid": "c2f11fdc-8f84-4046-9c68-c6d920751231", "value": "T12CD4E1D16A948C19E69B1FB90AA3F23443B46C65EB27C30D25F42C4BBC56E917B01BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734918, "uuid": "5d8d23d5-a9aa-4dfa-8ebf-943b79aec135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734918, "uuid": "e4e813f9-ba4e-405c-8f7b-e4c9c3056dbb", "value": "12288:yT+x0YPX/NqPs+UitwEO7ddULnM5whQOK7WoPMSwR5qbeXBwYa6CPym:yTVHPs1wwjHG+R57WoLwKbeXB+6C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684734918, "uuid": "1f2dea18-cd1c-449a-82a5-3717dad5a969", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684734918, "uuid": "70d4c012-96b8-4a46-a4c0-3bda28063141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684734918, "uuid": "32942967-5370-4229-ba34-60294bce532f", "value": "Supplier Registration Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6472e25-f85b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1684730910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684730910, "uuid": "e7c66922-68f1-43e1-a895-084eb400225b", "comment": "Malware payload (Stealc)", "value": "31bf8b85eabcf532de82e0f84b47c4c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684730910, "uuid": "3736b0f1-319a-4a76-aa28-97e3a604ece5", "comment": "Malware payload (Stealc)", "value": "8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684730910, "uuid": "4355a1f5-90a0-464f-8031-fc64b8f945f3", "comment": "Malware payload (Stealc)", "value": "c11c5d301fd6de129e8f56f36bcd541d4a185a7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684730910, "uuid": "0ed2d880-e432-486e-932c-53e4d0959446", "comment": "Malware payload (Stealc)", "value": "38b185ceb642c0242bd6e853013f1f7323ac3e2b15e4f10f30a48f6b38a202ffdde484e7d688ef308b2a6f16d41541c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684730910, "uuid": "715dfdb1-7588-439e-905b-9b9735d13e95", "value": "T13A34BF227649C076F86B15B944D5DA7599FCB4700BAF01DBEBE04FEE4E50BE1AA30207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684730910, "uuid": "531230b4-5b22-4033-9699-b116f3db431a", "value": "b46b7655f5ed701dbc7075afa681ec5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684730910, "uuid": "25628d7c-00b6-467c-a6a4-451d6c94c874", "value": "6144:oNHR6D0Y0unFQjgnIDLds2cx0CF2dD4HkI:4R6DHnFQsnSBs2W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684730910, "uuid": "daf78828-ea03-48a0-9d68-357ed4408af4", "value": 251664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684730910, "uuid": "1f7ec5d4-19be-4f47-b0c9-5390daaeaf4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684730910, "uuid": "2bcb0ca3-d1b6-4597-9374-847337758fdb", "value": "mixar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec46243-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752346, "uuid": "c7de5538-9242-4553-82f6-976df108fd48", "comment": "Malware payload (RedLineStealer)", "value": "c00d55aad777fe321cdd0449fbfbadf6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752346, "uuid": "b7661c0b-4bd6-45f4-9e69-5142c1704587", "comment": "Malware payload (RedLineStealer)", "value": "8d4d1b45bc02ac2fd4f69911a11c316f84b3b8149d7c7570e48e7cde30bf4023", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752346, "uuid": "f93c79fd-b560-417a-be7d-b5c5c959da6d", "comment": "Malware payload (RedLineStealer)", "value": "70de7be6419845b2b389becfa6973049550eac0c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752346, "uuid": "cd5b52a7-f6e1-4052-a078-15664971a179", "comment": "Malware payload (RedLineStealer)", "value": "e533d4b6304a0d57121db9a1e3728407378f1644203d7e4dc8531233172d6c8fcb682de8c31debe70efb6607790f1e24", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752346, "uuid": "e7085265-ed25-456d-9d61-c0973321a203", "value": "T1F0252352E9D55492EC7227F040F307870B31FDA08965977B22A4D86EAC726C8DA363F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752346, "uuid": "bb67115d-7122-49ba-ad8e-f4069cfcbf25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752346, "uuid": "8522415f-b15b-4c9b-aac5-0217ed0b4c52", "value": "24576:vyQS9Mdb0bLTUuqV+zMYfmJE8+9aD69tRM88Yjgy:6QcpqIzMYvMe9tRM88l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752346, "uuid": "17752fc6-51b1-49f6-9459-e5aabd2fd44a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752346, "uuid": "c6382b8d-c09f-44b4-acad-c34c0340bbce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752346, "uuid": "b58fdc8b-1bd5-49e7-bb2c-ed7fa5a691b7", "value": "builder282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4855491-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752275, "uuid": "66d0783a-3e9c-4583-a973-8df202199b0b", "comment": "Malware payload (RedLineStealer)", "value": "50b0537432d18c17d8eea8646758b4df", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752275, "uuid": "a7864648-4f6e-4f67-be4e-e4ddd4e3a760", "comment": "Malware payload (RedLineStealer)", "value": "8dcd2cf31f7613c7a1c4f66c59c418ead3cf7edc40c84381504f770487b446f4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752275, "uuid": "08865fa2-be40-465f-a451-0acc49bd2028", "comment": "Malware payload (RedLineStealer)", "value": "683e3798536c11de126e3f50e4b975ed76f3da7f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752275, "uuid": "6e8c4df8-17b2-4955-8831-a3472400fbb7", "comment": "Malware payload (RedLineStealer)", "value": "f5568d690f0e2f9f420d7086f476549e9b74a2624f256f5bdb9b28ba9d4fcab20b30e8bb6878d1a4a03396a23f4d89ef", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752275, "uuid": "e5f4362f-b0fa-4f19-a6e9-c71f13c5a8d0", "value": "T134252303DAE0A472DD734F34C4FB03970A357CA18E78D67A6754AC9A29B32D09876763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752275, "uuid": "1b7a45a3-5052-459a-a8ce-44e3d2daf1ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752275, "uuid": "6ba656e5-54f3-4238-bd56-516049b3d88b", "value": "24576:Zy5ZtqlqzVhHs6fq1be7zjsfShSY91Ag/foQkIz5nruCEEkmoc:MPtqlq3Hs6fq1bsSS1H7XEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752275, "uuid": "33d67b30-80ea-4db3-8bcc-d53bb44c65bd", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752275, "uuid": "5acd545b-8dd2-4347-ad8b-e288345fd21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752275, "uuid": "74abdfd4-4b3c-44bc-aa67-5a3e41ccf545", "value": "646745784877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d698b0-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752465, "uuid": "3110b67f-f52b-4c49-8a34-9574327ef105", "comment": "Malware payload (RedLineStealer)", "value": "f368fda2d436e250da0792eb916a19c1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752465, "uuid": "b844797d-c7f4-42fa-ba87-3bd977e1d1e9", "comment": "Malware payload (RedLineStealer)", "value": "8e230a4e2659dea65a151883580ccf514eacbc104deace2bc382a0ad88b68060", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752465, "uuid": "5739c47c-b250-4771-a552-3ac1413c9e9e", "comment": "Malware payload (RedLineStealer)", "value": "7b6eea6467222c09739e4fa9bcc0260a348952af", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752465, "uuid": "270293b7-da56-4cc2-80b2-eb7c6b46641c", "comment": "Malware payload (RedLineStealer)", "value": "639301e9eca4f134d83ed3810df12c180c247be14087e7ae2d35def16175c1273c16b8a941e016fd9f4d46d4348538f9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752465, "uuid": "0cf95ba8-9c36-4754-937c-b1d688f332ef", "value": "T18A252243A6E84032ECA53BB158F216630B3A7CE55534C36B37C9AA199C726C0DD36B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752465, "uuid": "f36f5260-c70c-4a04-a1f6-0756e486e0c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752465, "uuid": "e707f998-79c6-4db6-b77a-8e0933312afd", "value": "24576:AyiRlHeUQqty/z6x2/hq4BgPGUOGJ0QVVB:HQlHMqtm22/YJPGUOGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752465, "uuid": "65644d8c-6b80-4ae3-8877-7afe2fc5cc47", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752465, "uuid": "dd82ecd5-13c6-42d4-9840-1b58a59190a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752465, "uuid": "41ce245a-382f-423b-9e6b-535e680e649b", "value": "interface350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0e0f2b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752212, "uuid": "f10a55a2-8695-4338-80c8-686c1251f016", "comment": "Malware payload (RedLineStealer)", "value": "d7edeb7692a3a1494042de0b1d099087", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752212, "uuid": "169a0670-4069-4fc2-8f6e-bcf5e14e27fa", "comment": "Malware payload (RedLineStealer)", "value": "8e48aa40a2d85e4b1f2863d246ca36c963fbaf647188e50218b7f2d443169161", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752212, "uuid": "5e6d27df-6355-4339-9201-27f5ab0251ef", "comment": "Malware payload (RedLineStealer)", "value": "e66e450fbc049c9c6927b0c79c17dc90f52ac903", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752212, "uuid": "675d7ab7-d5e5-498b-91ab-682d387bfa98", "comment": "Malware payload (RedLineStealer)", "value": "2a21966b9b580377497836cc1f9d70e028e9700d32367039739db69f77d898813f919d3bc4e134f6f02b9c071b580b34", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752212, "uuid": "dc04508f-d4df-4319-be86-f7f5ea09e74f", "value": "T16225230272D901B3EDB257716CFB52830B36FEB1687487D73796444A1CB3B65A630B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752212, "uuid": "e73280c1-4ca4-40d7-b4ab-a080a8a2f74d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752212, "uuid": "fe9cd237-5f78-46bd-8d6c-1bf49bc16387", "value": "24576:syLjOgzhSJiuwv+jjqbuPjA60zDdk2ND5D4liCXqPZpseGBsr4:bnfoouwv8jTPNqBCl388nsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752212, "uuid": "2d973aea-e13d-4fbf-99f4-a95c7b3e4fa8", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752212, "uuid": "e9f98d62-29b2-452a-b66e-7b69fc8fc872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752212, "uuid": "6eba0cb2-6639-4458-9136-5d41b3775d67", "value": "24468252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eea41d7-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684779512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779512, "uuid": "25982b46-288e-40cf-803d-09b73a36304b", "comment": "Malware payload (SnakeKeylogger)", "value": "8eecb7d05b0685f6547d2f527a3256e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779512, "uuid": "8061eb27-6356-44dc-8a8f-b28c33182f68", "comment": "Malware payload (SnakeKeylogger)", "value": "8e697aa7f5271c0c246970f87c2974f29e70b4ba54a2f7ff187ba7bc2e234075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779512, "uuid": "aa07ef19-185e-4b85-9010-3b21d3e655b2", "comment": "Malware payload (SnakeKeylogger)", "value": "e04a91a8cffb045aec3a96612788b5e9c43e3165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779512, "uuid": "8abc6b8b-d816-4390-a75b-2130dc4f89fe", "comment": "Malware payload (SnakeKeylogger)", "value": "844234cfda31e662e93e67561630a3b7ae3f28c5d6d28e01ce4cf852b466db4dceeda85c557dd4b7c917cb9b200d3df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779512, "uuid": "811f28db-fa8c-4e4a-b0b0-00b46beafe13", "value": "T1B835CF553375DF1AD8BD43FF06F0908D0BB8B8467026E2199F9635E27270BA62748B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779512, "uuid": "71b454ae-8cbe-4ec9-a449-26ecda970265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779512, "uuid": "44330ab6-c45b-4166-b857-0d79b777ff3c", "value": "24576:DR1oOfJKY9rrOG8ygWoo89Dhfcjo3PpaXz90G15UbC5JZ:D1b9e7CQhUjo3PpaB0w9JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779512, "uuid": "e05d13bd-4dd5-45d6-8cce-be94a5c0e63b", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779512, "uuid": "c1e9bcb6-08ed-44fd-abc5-ee1491c7a669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779512, "uuid": "0f2f9989-41da-45b2-9f27-83c1daf7d398", "value": "SKM22882023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f171140f-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684738660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738660, "uuid": "dba51b3d-c92c-488f-bb41-3faaeebc6fe2", "comment": "Malware payload (Amadey)", "value": "82106cd5c15f096774bb7251b562d713", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738660, "uuid": "5c3677e2-d11b-4f73-90de-20a098ba1df4", "comment": "Malware payload (Amadey)", "value": "8e7ad3187c7318ade9210b1c1608eb8f3ca9eb109f5d160cb66e6c9d4741856b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738660, "uuid": "ca58fbcd-e3eb-4c20-bb3e-a766e907ace1", "comment": "Malware payload (Amadey)", "value": "27a62adf9c1fde9a030085fc2c8580c21602102e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738660, "uuid": "8a3cad6b-73fc-478c-8969-a3308ccfbca0", "comment": "Malware payload (Amadey)", "value": "1f3efbb4d2826ba7e7de21f0512f196e4874796f936992fcefab8f9ee572b87dc73d51c0e9f11598debc7e3f9a6c9e56", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738660, "uuid": "1a19c18e-f9ea-4e62-a08b-a15dcb5c9d6a", "value": "T1A6252302A3DC5036EDA12770A8F112D35E76FCE2CE74C36B37659C6A1D735186A3272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738660, "uuid": "db259359-91a2-4d2b-b24f-02dcd7dc085a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738660, "uuid": "066c250b-e057-4fa0-83d0-86ce359cf705", "value": "24576:0ygyJJ5gSfW7wvqaAgz6mmWTOInFvJMnCoFTSbvX:Dl9fW7SqmQwXNJgCoFTSbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738660, "uuid": "4d8be01b-efc2-4f8e-a249-0b8102389f2d", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738660, "uuid": "aa7e05c6-3ccb-4bf4-a44c-43002da32cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738660, "uuid": "afb0d949-86a5-4efb-9a74-75fe580bbe65", "value": "8e7ad3187c7318ade9210b1c1608eb8f3ca9eb109f5d160cb66e6c9d4741856b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a29111-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752352, "uuid": "61d11136-7e99-450b-9d28-ef96e853e7ca", "comment": "Malware payload (Amadey)", "value": "f7724b0f35792830011cc6158ba6fcfc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752352, "uuid": "61738b6e-3c87-43ae-9c55-4b2a055cad3d", "comment": "Malware payload (Amadey)", "value": "8e820edc25040995a92875410b7745e0fab22899b51a66421ad53e932b7c87f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752352, "uuid": "eeba8dcd-9370-4111-9ac2-e92d94c38a47", "comment": "Malware payload (Amadey)", "value": "bd607ae4db230775f0d0a934fd522649e3e4d392", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752352, "uuid": "bebd23d2-5aa7-40c0-8c1a-8caf482681e1", "comment": "Malware payload (Amadey)", "value": "6e85e373217dd5064638d755e52bcc8acbffea1595ae8eba2a3df84b07f83c61d4830da45311ba8f4eea1b4463bb3241", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752352, "uuid": "b5c0e8b5-79e4-4868-94d0-db7e45cca2e8", "value": "T155252312EEE45177DDB177B48DF713C30A3BBE946C3482693148698F1D326909AB1BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752352, "uuid": "3d2fb50c-efa7-43a8-b0a7-cda08f3fc576", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752352, "uuid": "3a40553e-2cce-4afa-a82c-2f42750d6664", "value": "24576:Xy0mwzJNNtTOq9FNTi1jtKDwDgBovlyPhIoqrMvm6HF:irwz5tOq9F9i1jcMDSP+oqrMvvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752352, "uuid": "92cd309d-fd4d-4d0b-8a9a-88c0c804dadf", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752352, "uuid": "3dff5af4-9afc-4501-864f-71ecf58212ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752352, "uuid": "1ce24ce4-5eda-4e69-971e-dbe51cc77da1", "value": "calculator460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0637206c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684752009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752009, "uuid": "935e116a-9fb1-4a6c-aabc-85c6afa4153d", "comment": "Malware payload (NanoCore)", "value": "1995af932bb15636f787cc57133caf9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752009, "uuid": "985bddb1-080f-4cc3-b732-2065c736618a", "comment": "Malware payload (NanoCore)", "value": "8f76e7c72e17763b750529f776a68ad05e86a6dd3a06374b2acd8d7e4821374b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752009, "uuid": "c2c0c989-678c-4f73-b725-6783530abdde", "comment": "Malware payload (NanoCore)", "value": "77a91a4c5a0630c877d6d3a45853b3234b7c7c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752009, "uuid": "d3ff44b4-edb6-44d8-862a-691fbcde13ee", "comment": "Malware payload (NanoCore)", "value": "e6857023d06981b15bfb43512411329bce6e1c84905cba9046564e78f13e6a185a7b2105d93ea78e3acc8198c3f0d0e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752009, "uuid": "2b98f682-3a17-4d15-92aa-fefc91802904", "value": "T1E7F49C5633B57621F87D33BE0119638CCB39B04A2122E22A1F5679D146D37EB770A6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752009, "uuid": "db118b3f-99f4-472c-82d5-e8e4c5f1f37e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752009, "uuid": "f811a29c-5b6a-4bcd-b437-e591d2afcb67", "value": "12288:AvV+s1bSQT6tjjdB4gTS5u+idNCaeWUYs6mh6dRVgphiPyfABQ8Dr8h0r0II0bF:AtQEuVNmomEdPyfIzDA9II0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752009, "uuid": "3463d701-a7e7-4dc5-9274-6c60bb4deb45", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752009, "uuid": "cc7d0e28-171e-456a-9df4-73388067a6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752009, "uuid": "8c294734-b064-488d-892b-bf96e030612a", "value": "RFQ GIFT (Tender Closed Date. 25 05 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14989d8b-f887-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1684749456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749456, "uuid": "a24a7c7f-2d4c-498b-a717-0f4717b847c5", "comment": "Malware payload (StrelaStealer)", "value": "f6c5ce4ade5abd9a632da857cf8631b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749456, "uuid": "7b690452-8f8e-45ed-985d-5113bc693a86", "comment": "Malware payload (StrelaStealer)", "value": "8fdfab564afe0253f9cfc92cb83499783b0c1f726b7f6d94fea852e6f7bcdbce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749456, "uuid": "c578bd64-6df4-448d-9251-abe03edde162", "comment": "Malware payload (StrelaStealer)", "value": "ac78f602447a55052d5aff3ea77c9c7d511d810c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684749456, "uuid": "b1c02ecb-8975-4602-a039-db4608404244", "comment": "Malware payload (StrelaStealer)", "value": "495e0a3c58b1fdcac7913e905d5f69cd59a4d6d31e044239bdf2498626564b3e5b39c1fdc772562500369bec8ec32466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749456, "uuid": "8f5105a8-008b-40bc-bf23-cf46b976b29f", "value": "T11BE3395610C5EAD6CF524EF4E69AF3E1B03E202D0B9E49653C3C8ABED8D62195DC091F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749456, "uuid": "497db302-4218-4e31-aad4-26f254ec9d41", "value": "675f7fb22861ff7eb3f7961dd1eeb588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749456, "uuid": "15730911-daa1-4cf7-89de-9ea9dc24a842", "value": "3072:wZbABQkV7iaeSKy8SYRTffY1Z2CHiy6HesRHbk:wZ9ciaeU8Sg85Hd6HFHbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684749456, "uuid": "7846cdf6-7f0c-4132-866d-369982e9e7f1", "value": 148872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684749456, "uuid": "6ccd19d6-f62f-47e1-83d2-d8296234d69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684749456, "uuid": "aecf7486-f00e-40b0-a049-ea40c9baf559", "value": "FATTURA_ (3).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cda84e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752408, "uuid": "88e2a046-d302-47b2-9eeb-5ffae200e01a", "comment": "Malware payload (RedLineStealer)", "value": "ca0fed32ad77a35c6cbf1c59ced65405", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752408, "uuid": "95628ffa-2544-449e-9097-5d0df57ad0e2", "comment": "Malware payload (RedLineStealer)", "value": "902e82e50d085ff6f90c85a8256b3f3e28949e6d0d5bbd6f3caffdb896ce68e4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752408, "uuid": "a363ed3f-b1ca-44d8-a433-dbfb5e977045", "comment": "Malware payload (RedLineStealer)", "value": "7c3ba70a30b3e29a35eff475bce4c5aef30ff625", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752408, "uuid": "b7bffff1-b600-4c46-a788-e0edd02ee3d4", "comment": "Malware payload (RedLineStealer)", "value": "707a49479aa00211af84c4c10514c6340e39cb468fc7e63424d68446a6c5476f462ed370cf22a1504f23f9c784bb2ff0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752408, "uuid": "3e65f415-6d3b-4be6-a631-fce0a7cfda48", "value": "T17925235AAAD0C0B1D17507F48CF703934F7BBD629978A31B3759592A1C32A80B83A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752408, "uuid": "f4d88f79-5a1d-475f-9c8a-3fcfaaf0204f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752408, "uuid": "b8f58fa5-0c24-4595-bea7-4f76aaac314b", "value": "12288:6Mrzy90mXWGZwMmiCPwWOKkdaVRqV4CFhoZrkN+nsxhKnVcOgn4FxfO+FSMul6:ByxXQMnCPwLKq+c4kg+KVQ4Fxm+kP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752408, "uuid": "b82b8d87-1657-4668-8079-adb930965fb0", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752408, "uuid": "dd0fda4a-3e5c-411c-83d5-0c2193618fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752408, "uuid": "1bc21eaa-4c4e-4ebf-a652-5f0154894750", "value": "effects494.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda8061a-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777228, "uuid": "066e34c8-ab47-418d-97ca-de0ac377f891", "comment": "Malware payload", "value": "857055b3630f3615d333360fae4750b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777228, "uuid": "a77e989a-93b2-4c28-9ebc-0fd46e8d4cef", "comment": "Malware payload", "value": "90526dcb197c0cd68fbd680a5c031c61fa8c27630386bfc976399e68fbd74c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777228, "uuid": "d0c8667a-f08e-4aeb-b53f-0410b9672068", "comment": "Malware payload", "value": "5a9501f876205a064d5082fe4f48a17a47c81afc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777228, "uuid": "2847f542-81a6-47e5-ad04-776915570bde", "comment": "Malware payload", "value": "fba7ebcb1110daa7b6c7df12fac2f3107782555cb50874a8584732d46b1429a9a034c73ea40a4335d9c97608cae53b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777228, "uuid": "efcb568d-244c-461f-baae-255e04c121c6", "value": "T12F93E0E1B5D6D40DC6E507709C8BD7992A34FC318D04BE0F7ACD7B5E2B313958922262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777228, "uuid": "c8ce1bd3-693d-4e0b-8601-74cafd6210a5", "value": "3e99e1e9e73f0201b0052c0e8eff945a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777228, "uuid": "00360a9f-c750-4803-933b-51f3dd85d32e", "value": "1536:a2GgAA1rBQBMsSgYmohheIvYdbG1G28+a9k6FAzz0fCCI9NM2i8A7xedj/Mamtzn:a2zAA1dQK8YJeIgdK1GNvlAzADyavudy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777228, "uuid": "65366c99-01d6-4f0a-90b3-4fa5e7b719a7", "value": 89383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777228, "uuid": "1ba7a4b7-7f82-4a64-b05a-26106c621edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777228, "uuid": "9c7a427c-ebde-494b-9634-24b3b59ccc54", "value": "SecuriteInfo.com.HEUR.2772.3336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d810532-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755887, "uuid": "b80b2ea4-d4b2-4076-b7c9-852efe06f2ba", "comment": "Malware payload", "value": "6abb1e93cff746b58ec55cb459227cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755887, "uuid": "0992527b-a1fa-4267-a66e-9dcabb2b6679", "comment": "Malware payload", "value": "90a57a742435f5ce3aa702492a0e4fb6e81cd8186658a953e3dded4aef888784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755887, "uuid": "1fcc3be0-0c3b-4c85-b391-4b89fb784cb3", "comment": "Malware payload", "value": "6420832a955be4af3cbb23839c4cacf994297e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755887, "uuid": "e4fb77d4-dd2f-460f-a066-04067f78a303", "comment": "Malware payload", "value": "c7d138c27c257574efa0023c06b2dfd96f512e9d85708620a1be045b51abec8aac450ba9a7f4e3f18b38bbc8356a2ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755887, "uuid": "85566ffd-8a74-490d-b181-9db37e311715", "value": "T1AB32BF9BF6ACE6E0C453C9B84635C4B46E68F7206E668A2D4CE8C03321CE541463FD75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755887, "uuid": "0f1c7796-8d57-4c1f-900b-bc9e77971841", "value": "ecb3f77ece672b6ec83d550a33d9740c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755887, "uuid": "66218847-83ec-4d49-bf09-b10276527d7b", "value": "192:nmSHqNFqq5pOBf/NqewtRAjIt59dJTxGvNIr8Pco2tuWUkhITlN7Q7cP4l/sd:fK3qRNEtRMcLnuGU2tbUkhITlNnP+/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755887, "uuid": "990457ab-17d8-41e8-9df0-84c9adce7a8f", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755887, "uuid": "deeab0b0-b2d2-4f2c-88cd-8fe0fc861ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755887, "uuid": "c78f5ce7-1b29-4b47-9c0e-1fdd7fb76a97", "value": "SecuriteInfo.com.Program.SkServer.4.11042.5594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c567fcae-f87f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684746317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746317, "uuid": "1ff4dd08-8880-49fa-8ad7-db2e0056cf3a", "comment": "Malware payload (AveMariaRAT)", "value": "4696d80b36ce5d3eb843e99bd1717b81", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746317, "uuid": "43dcfe4b-4a26-406b-be78-ad486c2db296", "comment": "Malware payload (AveMariaRAT)", "value": "90ebeaa9a68ea0c1bf9aff1f7902d545fd5623af7aba90d8cbc53ece47f43f51", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746317, "uuid": "96f56ea8-c80b-4d78-8fc9-c06afd9ebb7c", "comment": "Malware payload (AveMariaRAT)", "value": "bacd3f8cb63f045256163698bf6a469199e7fc5b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746317, "uuid": "7e20876f-a8a7-4ac4-91e5-7deabef741ce", "comment": "Malware payload (AveMariaRAT)", "value": "f1a7b57e62fc7f4d4e082b00d6d789036859a7635eb818e3b19494b488ef1b0fd2945ed5040d8a9fa026f9678c2191b8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746317, "uuid": "4d0f8605-b7e4-44a0-9bc3-8bdd1bc2fa18", "value": "T15A55B7106AA21024FCF11AB4501D74F46A29BDA91B64A0CB2D4D37EFA671AFC1C73F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746317, "uuid": "127d6b7e-93ce-4252-bd39-04ad88a64cdd", "value": "98fa37d1d3e352e1f164779b751f715d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746317, "uuid": "b31bd36e-63d8-4a9e-a376-22f578018fe3", "value": "12288:HzRRGL95MC/Paii8uu1nIT2TZObMtaq0alLq4f3mGKJi7Xja/q5opEc:H8xM2TZMkFlW4f3mJY7Xjrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684746317, "uuid": "63847802-68ad-4759-9f49-c42ecf371ba9", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684746317, "uuid": "d419c73f-61b3-43c3-bde6-4aa1c21043e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746317, "uuid": "a58caf3e-6163-425c-83dd-8f3759738161", "value": "items list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f9f30a-f8f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684798659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798659, "uuid": "34d2e891-cb54-4e7d-a129-86a3215f022d", "comment": "Malware payload", "value": "ec250c6a60a4add9d9660459f25647a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798659, "uuid": "fb57f402-23f3-4872-8a84-36c34dad1974", "comment": "Malware payload", "value": "919a131d5caca0bd1263c64e6a5ec2a6e6ab329cc7719628b6be0886b4635648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798659, "uuid": "6e71e279-205a-465c-ae91-9239e08747a4", "comment": "Malware payload", "value": "e693e19352a3c1e4d45ab50e8d86de57e3b8aa74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798659, "uuid": "618ada53-6327-4fdc-b867-c5db65711cf0", "comment": "Malware payload", "value": "ddca8cae8e7b41a9d14f5437085fbb07e2e0e408636970183e222b2b245901977f8b4d23084b01ac2ecce3642d064f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798659, "uuid": "37ef4344-9b23-442f-ada1-29f6752ceb59", "value": "T17FC35C037EE2E472D5751D3A14749B600B2DEC2109A38E7B339CB67ACE726C04E169F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798659, "uuid": "5766d37a-1502-4398-aeb6-71fa626444c6", "value": "e5d5b002c3fb5658a2157a9831f2c5b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798659, "uuid": "5b0db8ae-9b24-4de1-9e3d-b643a4e7c5a6", "value": "3072:l0uaM5KrDs6szySnc8buL04jG4PJvW6oXAg0FutUNJZvJ:wM6d8brFAOt07vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684798659, "uuid": "6ee827ec-7b3a-4a51-9eb6-2b7e511b1b8e", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684798659, "uuid": "c523e137-5215-48ba-801e-a050bc504061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798659, "uuid": "4de16697-54cb-473f-9b9b-a9add00bce9a", "value": "SecuriteInfo.com.W32.Agent.ADML.tr.17142.14749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884437cc-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684745785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745785, "uuid": "53078baa-a7da-4509-a4b3-c37a4d15801f", "comment": "Malware payload (Fabookie)", "value": "f3063f86f1cc3bfe8736dbdbdb99ae4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745785, "uuid": "f26e0068-ae2f-47bc-b96f-5998f00497ef", "comment": "Malware payload (Fabookie)", "value": "91ca0ec6fb942c1092a948a5c1df7b9fda446cb61c894425e6a706209e7e1a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745785, "uuid": "b6d39843-0fa7-4f90-9d96-a00f491e6707", "comment": "Malware payload (Fabookie)", "value": "496f32361fb1f91028a26965ff79d58a31eaffa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745785, "uuid": "b3d6bad5-0f07-482d-88fd-3b138df6b89f", "comment": "Malware payload (Fabookie)", "value": "d234eff6e835963a4c60c0cf533af42ed818c0f007a6be382cb79c085b5f3f4d429b5d0626d3bad1cff2679c50c43c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745785, "uuid": "39f198e3-34a5-477b-9cad-4ba6659ef6ac", "value": "T1BE647C56F36540B7E1528035C993EBB2F6B27C562B20134F0790FB7A2F336626E29B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745785, "uuid": "d4116b06-9638-4dfd-87a0-ad25ebe06a95", "value": "279b8a26f65ef80b2fab2ffb5009e75b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745785, "uuid": "35287c98-86bb-4ccd-a1fd-bc816eb095e6", "value": "6144:E/ji2H5h8XrWBoWL46Jx6VWxtoloBj5rbx:Mb8XypL9JIVJ6Bj5rbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745785, "uuid": "825e11e5-6bf7-47a5-8860-63f3e5767ce2", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745785, "uuid": "9b36e5f1-480e-488e-b61d-3ac129dea991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745785, "uuid": "ac9b6ad7-fd1b-46ec-8569-db8b04a35820", "value": "f3063f86f1cc3bfe8736dbdbdb99ae4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2df302-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752259, "uuid": "b49494eb-834e-4c2c-acbe-6f68bd2665b4", "comment": "Malware payload (RedLineStealer)", "value": "bef4fdd28c1c44a97e5af4119e69d4a0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752259, "uuid": "6a4f9489-2c6b-4f1a-b058-0473bccd7efa", "comment": "Malware payload (RedLineStealer)", "value": "92615fcf337301b3b5d259db4c77bf38b696f6c49a8e2c5b1067fa851cea2a4b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752259, "uuid": "7be307a1-a768-4cfd-9b25-e877ec227ed5", "comment": "Malware payload (RedLineStealer)", "value": "90e7e56282460850d30a55542677852b683b7c53", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752259, "uuid": "5c06a789-ba99-4d2e-902f-b0ed2fa37ff6", "comment": "Malware payload (RedLineStealer)", "value": "649704a2360bedc6d00cb3ad95d5f207e074175110e538d885f61597dbaf9c3f0fa635d5f1515146c0b5fa729c03cf68", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752259, "uuid": "2143c896-fdeb-49e0-9fac-9dcc32442946", "value": "T136252342B2F89017F9F663B044FB06C79B3AFDB15874534A3609A95E0DF2688D97037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752259, "uuid": "b7f42d32-7431-4ba7-84d6-3ce4bac26018", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752259, "uuid": "fe04479a-222a-428c-94b2-cfffc047d423", "value": "24576:dyWXetRZ8x6mCzpurOUgvJULrjDcknfVCQ:4xrgrUJULrjDckt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752259, "uuid": "bcd8705c-d993-4e38-b087-3f7d623734a0", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752259, "uuid": "e9db0c64-f6be-43be-b61f-9cd7925f87e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752259, "uuid": "44d7dbea-c613-45d0-8793-46f745cfc281", "value": "423927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be42da1e-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777229, "uuid": "07ae55d8-cb6c-47f3-a42e-a654912d3ac8", "comment": "Malware payload", "value": "4a8c498d97a7a18f67168ed7fe7ff73a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777229, "uuid": "31456078-5d13-408e-8af7-da086ca98205", "comment": "Malware payload", "value": "926f856b6e1c1fb6c9c173add74df8c980c46dd3e11c240892b12c95a463e432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777229, "uuid": "41b5d62a-ddaf-47ae-8846-90d187d71fc7", "comment": "Malware payload", "value": "d7205cbce42716f015e47cfdd1bc5627568748c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777229, "uuid": "9feed82c-cd31-4102-b617-b2d9aac326d5", "comment": "Malware payload", "value": "d3c06b48b10f30b5a4e72520df63a0f2512d01698c8deeb7fd5e4446b5c6208ee2bfc42a5b516c2c5216e96964bb44c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777229, "uuid": "8c663a88-0968-4e37-a1e4-a10f4e6d4a34", "value": "T152827C957310C98AC1DC05365913CABCB220EE3A8D195E063AF5D73F3E31756EC07A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777229, "uuid": "522147dd-54d3-428c-be58-f8c1d93b6114", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777229, "uuid": "2f01c5ff-ec05-425c-85c0-200fc7d224c3", "value": "192:nQx8wtwO8qU/LDZJpuuU8hsTJ6jPyztWz8lpZ2vlr8l+Sykth3et24Yvm1PHwlBp:1LDTs8hsF6qtK8lzQ8+Sych3mYvCPHxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777229, "uuid": "59fab653-88c1-4311-be8a-4b39f1fa383a", "value": 18043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777229, "uuid": "21d720cf-eb0d-4b4e-a9f7-55c668d717b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777229, "uuid": "16e839f8-27a9-4564-94cf-43cde37db267", "value": "SecuriteInfo.com.HEUR.20442.29046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a225360-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752204, "uuid": "246c91ef-ec3c-4a6d-92a4-d9b8036641fe", "comment": "Malware payload (RedLineStealer)", "value": "66b34736216dc604b2147e6a417e8fab", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752204, "uuid": "dd768b05-6539-4ea5-a397-c1477991bd45", "comment": "Malware payload (RedLineStealer)", "value": "92958efe0d973722fcc9a139181b2e1df993eff32bac3094cb67dc4fae030132", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752204, "uuid": "2adcdc9f-938b-4781-a547-782afdc027e7", "comment": "Malware payload (RedLineStealer)", "value": "e71098efccd8b8d7cbdd2b4f1cc66c3beedc6cc0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752204, "uuid": "81a073d2-e934-4617-b5fe-a2d4d9547d68", "comment": "Malware payload (RedLineStealer)", "value": "fbe3569686f5ff1689172599f3d3aae5ea31b4490614eefa6b540eef191e0eb18e2fe3356c8e04534bf7bd740a7411b4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752204, "uuid": "a20ca04b-f98f-4ac5-b231-8f54c18c5dc1", "value": "T1B125235356F841B3ECA4273458F343832F39BDA0AAB8571B3301D99519B27D188BAB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752204, "uuid": "ff310abb-1708-4499-967a-e609ad0cad86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752204, "uuid": "208d23ff-1932-4d08-b022-1abcecb6ef49", "value": "24576:NyuXjldVO5wUqzjwx1HGir+DUR6eSldqXK4eDh8NYR5g:ouXRnO5wUqzgHGKz4lduKRhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752204, "uuid": "f4308889-1c79-4ff3-86e9-cd4835f41955", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752204, "uuid": "eb219ebc-44b4-4715-a7ad-9d0c9623f360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752204, "uuid": "a6ca43f0-efd6-4179-801a-d13309210fb8", "value": "2332324730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384d84c9-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684745221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745221, "uuid": "531d6cd8-6fd6-430e-9069-b0a386f72c92", "comment": "Malware payload (GuLoader)", "value": "311f133b23547e285a0501f82a447e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745221, "uuid": "8a15c517-3ec3-4e08-b834-5f877a3a1177", "comment": "Malware payload (GuLoader)", "value": "92dc694406845eb918024282e74f90d0ef40c3b6c48d90692dbda926e978c6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745221, "uuid": "748cd537-8e17-4475-a8fa-f6b59e5e23d9", "comment": "Malware payload (GuLoader)", "value": "b088f5440031f78a31c646b06342e149dab1e90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745221, "uuid": "8b9bd410-9bf9-4e66-a512-84fd403304c2", "comment": "Malware payload (GuLoader)", "value": "d9284f6fd0763a6296bb7e538bab71e16a6fdf5e8b56c25372d03e88a0b4a4d115f5f971dd4285ab890ef3a896c75c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745221, "uuid": "477d06c8-9dbd-408f-bcbf-1aaa8f5354da", "value": "T1ECF3022136E5C493F6A38AB21D3195ABE93BFE092519150B7760AFFD1D321CB4D0B2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745221, "uuid": "f461822a-72c3-4913-a8b9-faccafc1fe5c", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745221, "uuid": "6cd8fc57-d81e-4215-9429-939b1e2e08d1", "value": "3072:1DQkrZoosbIfXJ/ppJCMukHQQRoOy2mm2yIckhHY6T40vLSoRgJr1p:1DpoeJFu23pmm2dSOmoCJrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745221, "uuid": "a0b7ee2d-627b-47c2-9dc0-bbe86c9bedc2", "value": 157883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745221, "uuid": "8629430b-b41d-4561-adec-35e27fbbecf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745221, "uuid": "de1fa354-5cd8-4065-bed7-d7b53545034f", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17729c0-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684745935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745935, "uuid": "3ab5981f-f13b-4c59-ba08-d5c0689f632b", "comment": "Malware payload", "value": "03a173186acb6b13b08da33ef4b9ff80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745935, "uuid": "218dee08-fd0c-4b5b-8a67-a939ef7d0019", "comment": "Malware payload", "value": "93791935b3e26aea6d85d0b6179655b4d5a6535e16af15452a7488afa6283af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745935, "uuid": "ab45cba0-e80c-41a1-b280-4c6421e6497e", "comment": "Malware payload", "value": "a3bcc2c3e00c41f31a8a78a6f7044bb0b483f62c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745935, "uuid": "9b1eddcb-6e2f-432e-9aee-866aaa158868", "comment": "Malware payload", "value": "1e5d956b24f85b58dd94237e11fe24cf0f3bbb2086e536f825734796ac583c4c2c648948fd08f057c8b1914c7eddcefb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745935, "uuid": "a095ba34-cdfb-42ab-a44e-fe699d3fb450", "value": "T1172523433ACA9873CD706B7489F70A970E3A7CE19874433A27A1597F9DB2184E876317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745935, "uuid": "87409690-bcb3-4bf3-b748-ab7fcb0bf9ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745935, "uuid": "115cb584-2d0c-4674-ace8-f02fb03df5c6", "value": "24576:Uy8HE6QK83IZqWjyNtLZjlspRA1Hio+NdqT0p7qXTo:j8H/Q73IZqWytQAVFHTsWXTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745935, "uuid": "e904aa69-0a48-404f-ac0e-4efb16c0ff37", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745935, "uuid": "552707bf-3103-493d-a6b5-1867b8bf0565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745935, "uuid": "00f6d7ce-0cd4-4733-9ed1-eaa1f41a66dd", "value": "03a173186acb6b13b08da33ef4b9ff80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1f8d7e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752205, "uuid": "35fd7e65-c429-4c54-8825-d30e20e1c9d9", "comment": "Malware payload (RedLineStealer)", "value": "3d9990fd97880f520139937e345324b4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752205, "uuid": "02b4fc39-3393-4515-a408-17cbc9b9a267", "comment": "Malware payload (RedLineStealer)", "value": "93832742d0e5b3a693bf797da9edf9d0c0dd35f04678bc0f2b2e0d105fbd14ee", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752205, "uuid": "5aacf92a-28e4-4b43-b22d-490384aac5e7", "comment": "Malware payload (RedLineStealer)", "value": "c339a4cc24d0c7c50b934cac404a1e683b4537d0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752205, "uuid": "d621eef9-b56c-44c0-8456-4cafbbcec743", "comment": "Malware payload (RedLineStealer)", "value": "ef7c572aa53cb6cc2a6f8370c95a7b9ac9e9b62068beb26b1c0b3f2af6bf28acd1bec429edd6730f5069184119ff2942", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752205, "uuid": "8fa9a33a-eb20-4e09-88f0-d72f339b0a04", "value": "T162252353D6D58573E8B027B588F606931A317C706E78966A3F0AAD1E0DB3280F532777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752205, "uuid": "aa505341-5ffc-4941-8f2a-3eef093ae23a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752205, "uuid": "226534ff-201b-4922-b254-ec40eca0f1f5", "value": "24576:6yvQJCniemp/q+khJpMujQfA5TjcRKRGbMCCG:BvQJCnijp/qtAuj8uToRKowCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752205, "uuid": "c0f94d01-45b2-45e9-9c72-589c27567040", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752205, "uuid": "efc5f608-2858-41f5-981c-614ea53aa212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752205, "uuid": "d060ca21-c958-4019-87c1-c400f9fb1308", "value": "234433512203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2aa3e18-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745427, "uuid": "3e07298b-5862-4d5f-aabc-f76781e0fdc7", "comment": "Malware payload (AgentTesla)", "value": "dd664a722cd3194d136e5bbf033e6439", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745427, "uuid": "c7fbf0f5-f47b-45a4-813a-3f3be6422384", "comment": "Malware payload (AgentTesla)", "value": "939dade156478ff0c13348085097b64763aef9007ed30b6f084f01ad9a086ad0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745427, "uuid": "25791d7d-1a05-488e-8ab6-7d122b2858be", "comment": "Malware payload (AgentTesla)", "value": "3bc8fad48c109527a4c84b73adc0749d58b1df12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745427, "uuid": "c97995c1-2193-499b-9d56-99bce9f8ef78", "comment": "Malware payload (AgentTesla)", "value": "66b23645927646acdbee224c5456dd0329006547dfd703c8d76d0be0caff5cb1eded55c9374625cb85b1d2b1177c0540", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745427, "uuid": "43db2ae1-f48e-4c41-b544-bb7081616064", "value": "T18D545E56D2DE00C4F3E22B0557AF62A63767F8E6493C8D4C5488D93E7BEFA008A51772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745427, "uuid": "d5dba96c-9207-40a4-bb42-9481c363fe17", "value": "1536:9Hmd+CKN/SoY+oYFt6C2aKtj5yP6Fbh+mzjvbbUj0ZE5boW2EsE:9Hmxw/kYFCtj546Fj/vPUj0Z2oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745427, "uuid": "6d58293c-7401-426a-8c47-4b481942e843", "value": 291036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745427, "uuid": "cdc66985-89a9-40a0-8ca2-3d7694d7f7cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745427, "uuid": "40dea51c-5ea4-4287-aedd-61f79a254598", "value": "Pharma Partners s.r.o..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccba2d4-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745712, "uuid": "d8b8b576-90d4-4902-a9c6-9eac81c2ebc5", "comment": "Malware payload (Formbook)", "value": "bfcc7c29b09747aaf19d959f3a2840ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745712, "uuid": "d11743e2-caac-42fb-a72a-52cc6a7c1664", "comment": "Malware payload (Formbook)", "value": "93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745712, "uuid": "913e4a3a-1f1e-4b90-8004-d92c9031cd2e", "comment": "Malware payload (Formbook)", "value": "0e8ba089874b1712f080c762e98b9cb6e3a4b1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745712, "uuid": "8d473129-2712-428b-ac13-eb6d6e432e2d", "comment": "Malware payload (Formbook)", "value": "cb18aab0d090f5364a27cbe906a3e6d26b4d8d11689963ea3e1582fc379dca74c44609bf0d59dedbbc98e115cac5161d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745712, "uuid": "54c923f4-c8fa-4e80-86b8-a7b486d4a6ad", "value": "T13EF48B5233B57621F47D33FD0129638DCB39B44A2122E22A1F563AC556E27EB770A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745712, "uuid": "ecd0eab8-c9ad-4652-a9e6-96f4ff17b18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745712, "uuid": "87045ce2-fd9a-4c89-b707-4710362bb11a", "value": "12288:CvV+s1bSQT6tjjdB4SE4uryvTAed4aI6Qt2Pli/LwNEMz8X5HlKtxp5udJF5VOz:CtMLuwTAeeaI6A/LuAXaIJPVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745712, "uuid": "c8face38-ecec-44d7-8599-f4c56a71e435", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745712, "uuid": "36619e75-ed4e-44fe-92da-1f47f6d8a827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745712, "uuid": "9be9d75e-7a8e-4b08-afae-cc0ea8e29c0d", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76025727-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752197, "uuid": "4a0c53e6-412c-4f4e-9bd6-fe1ae3f5e959", "comment": "Malware payload (RedLineStealer)", "value": "39bd46a0dfd436b16cc6f16a2d79f6f9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752197, "uuid": "b30b66c1-5044-46ec-90bd-50b8e8e3935f", "comment": "Malware payload (RedLineStealer)", "value": "94278d33d770674f7df499b5401b603fdc378ebcad77f53faaa83c4e36efb7cf", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752197, "uuid": "33ebe8a7-89a9-414e-a66e-cde33f0114ea", "comment": "Malware payload (RedLineStealer)", "value": "6664239e3c06d29d2b018da943e62752dc038598", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752197, "uuid": "389d7adb-525e-47d7-a15b-eae5ae7f9a9d", "comment": "Malware payload (RedLineStealer)", "value": "2947b2d4a9e7d9bc8a9518b846df0fdcdb4573b77cf9232e85fe5eb4e0fc7d8b439b62f42d545999d03140174ad338d3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752197, "uuid": "22c1e9d4-fa55-4def-80c7-e926bd4dde69", "value": "T1B0252302B7D48076EAE10F74A4F913830F35FDB16A7986673254FE261D7368499B232A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752197, "uuid": "d664bc19-d126-4255-863e-6b5d05a27d1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752197, "uuid": "15e35a22-1a12-4d02-bbb8-13a49a61121c", "value": "24576:vy5HouXuTn5HrbhqGLAt2DNVJHNa9FbAfUlje:6quXuTn5Hrbhq8eaUFEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752197, "uuid": "dd88fbfa-7d23-4ea5-a3f6-414f928dc4f4", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752197, "uuid": "0711ab0e-c332-4559-9a78-9850606d5373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752197, "uuid": "32ffc289-cc55-4053-aed6-bcb96402dfe1", "value": "1212324986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0e6c34-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762599, "uuid": "7dbbee9c-9fba-4057-8cce-ac0788fe543a", "comment": "Malware payload (SnakeKeylogger)", "value": "b1fe1d2afe02628063399b374edfd4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762599, "uuid": "a2f81560-da7a-41be-9d1c-3e2876aeff3f", "comment": "Malware payload (SnakeKeylogger)", "value": "946dd49393625df5156b51438635cb31a56ed40b440a8ccccce7b2c3cfb26a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762599, "uuid": "0f05e24f-881d-4940-9da1-39b3d337a847", "comment": "Malware payload (SnakeKeylogger)", "value": "84df7b6f91468b70c20ce8ec7965fd370b24de2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762599, "uuid": "cd599418-d71d-409c-ab67-a97738934c77", "comment": "Malware payload (SnakeKeylogger)", "value": "730da50300a7c0a61631014a09a6d6e9f6e015d726aa9041f00d2ee102309afa9ad0f8dbd5263b769f0c7edd6a6e23e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762599, "uuid": "0d657655-19ad-4106-81e9-3e3e0c9fefcf", "value": "T1A63412187681D183E4A70671253EA93BCBFAF91230385B0F9B607EA53D537915A3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762599, "uuid": "9c75f5fd-4272-4790-bc40-5270576a8b55", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762599, "uuid": "e68cba78-8b9d-4d8a-a185-25b0f590c4a6", "value": "3072:VfY/TU9fE9PEtuiXfbja7L94YUZ3FFQpZyKooxfIYD7NIteTBWx5Vm1MKsQ0fi+g:ZYa6QXz+nyVFuZyKooxXc6ezmIVP418A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762599, "uuid": "d4a75023-4f9a-43bf-a624-98a834c07435", "value": 238580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762599, "uuid": "edb5a96c-ec74-4aea-a4bc-2dca59b32b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762599, "uuid": "9aafa35b-f631-4aab-828e-80077709fb87", "value": "TR79876544567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f522fc95-f8a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684763577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763577, "uuid": "63324be1-c787-4288-a457-468767c3ccd0", "comment": "Malware payload", "value": "e68e4e5b560677951def37842952e90f", "object_relation": "md5", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763577, "uuid": "bd1061a4-4acd-42fb-b8c2-0de61bac3c4f", "comment": "Malware payload", "value": "94a9409512877b81097e167ed4c439363b7058bf7db869c3fe77d17a17090fd3", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763577, "uuid": "3ebb7d4c-805f-4e9b-bb5c-52913a9478ea", "comment": "Malware payload", "value": "98e2e2bfa0637f7a324fc0a6abd4a9a6e94728c8", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763577, "uuid": "d34ee00f-a972-49a5-ba2d-f92d679244d2", "comment": "Malware payload", "value": "7db9d6bbc058286fcd67745d9f57685ae486383c7fa0d304ea4921b8135870fa56af57b7157de6ee16bf2673ac71c0a0", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763577, "uuid": "d75fa0d0-c100-454c-9232-d50ff2d6301b", "value": "T1192376BC41885DE3E3580DFAB542F5C4573808267387FA9D509680EEA642BFBB8119DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763577, "uuid": "bb4098c9-481f-42e8-99fe-7348ba04f2b6", "value": "768:MtguVNlQ6LZ3elzJDtgMcBseCdGqJtUHkTW/xK3j+jxqPDUaJi2On59FiXEIgwe3:QQkkzJDtgMcBseC0qLY9xK3j+jxqPenF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763577, "uuid": "7c17aacc-410c-49fa-80f0-5b3fb85f5031", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763577, "uuid": "d78366c8-f4a9-4b8e-959b-51c5bb91e086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763577, "uuid": "a2076617-e986-4f82-95d9-d91e294143ba", "value": "purchase_request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f703ab7a-f8a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684763580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763580, "uuid": "7947d2d8-7c41-49f2-a9b0-79cbb0f4eb4b", "comment": "Malware payload", "value": "85ada428831ca1b3b6a3e4e2c70152f3", "object_relation": "md5", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763580, "uuid": "14692d3d-3100-4159-a0ca-8821c989ab6e", "comment": "Malware payload", "value": "9530246506d158a6e3ecd200d850b6c9dab7d696fb6cb252a68705bc780bc90f", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763580, "uuid": "311f11d8-3908-4e8e-8119-dc89d78d4e07", "comment": "Malware payload", "value": "561b81573c3e4fd1a9723454409baa4bc1efbceb", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763580, "uuid": "28abb495-b567-491a-acc0-3a2179d9e4ea", "comment": "Malware payload", "value": "6b365bcdefcd0d4851a4a09f7b1d3912d73c3a429de1c05fa640f27c3995b008929e79f8409e193eb68a07d430d9eed7", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763580, "uuid": "ff38b908-6a2c-4e6e-8d6c-740ddca50e16", "value": "T1A8E3B8A535EC5C23D3A95EF95262E13C4BB41C12E616E3C98CE16CDB3DE2F492A01623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763580, "uuid": "9e3f4275-f010-4b2f-b17e-42e4ae82f7f4", "value": "1536:oNIWd5ZBy205FhuxWY4UcdnI1ExI5OPRvtPMCM/vO2m7JdzW5mvFZxGIaBUN2tiG:o5diUcdnIxLpNa7zI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763580, "uuid": "be1b8c76-922e-4468-8387-079144c3fa0f", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763580, "uuid": "ee0ea641-9209-4b50-b8ea-8e94f7088679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763580, "uuid": "b3634560-7b88-467d-8bb1-3c257efe6260", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f3ad1a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752272, "uuid": "db0ca20b-abba-4770-85af-79c21785e2a5", "comment": "Malware payload (RedLineStealer)", "value": "45bdf0113198b5d38d2863c40dfe3381", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752272, "uuid": "3302f10d-e4a2-4631-8dad-ae48e10d9571", "comment": "Malware payload (RedLineStealer)", "value": "96037facc41f5e564748d19189625998b4990ec951d84f5b4e269f73bfc0c774", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752272, "uuid": "23b8932d-8a52-472a-ab4d-0a9ea7ec1f07", "comment": "Malware payload (RedLineStealer)", "value": "1a0193dcf15317cca0c8b4ff60ee651e9720bd9d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752272, "uuid": "604b44f3-0f8b-4b5c-9fde-35466efb5bbd", "comment": "Malware payload (RedLineStealer)", "value": "8ca8343903f775afe4f88dc415d9d822e8dc331ec9f30c63ec7bea5b23042a5f6ef0dc47f411a5cb62018c58c512ae54", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752272, "uuid": "53fe4e31-0ac7-462d-9278-057b9b2071dd", "value": "T1B2252312A6C900A3C8B523B05CFB47C31A76FCB08DA1925F3707AD1A4DB3895AD757A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752272, "uuid": "e739c47a-84b1-4296-ae0e-aef59a16b812", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752272, "uuid": "8ff8d16f-4df4-48ca-b55f-7b9c60896064", "value": "24576:/yBLvmA45xB4bCHBgiNqrm+jvzbbAVETscuZFzyCXm5Hh5p:Ke5xB4WH+iNqrm+j7bbAVEwDzNyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752272, "uuid": "34c17106-928c-4bfb-8f60-09bd6dca163e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752272, "uuid": "f3d02a56-4c4f-4618-9c30-ccf0e0d9a9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752272, "uuid": "211c5c29-a8b6-4f97-8594-bad642bad8e5", "value": "62263263998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2dc8eb-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684738274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738274, "uuid": "a359278e-33b3-470f-9a63-910c063c391f", "comment": "Malware payload (TeamBot)", "value": "0a8c67293e6240f62ad3a8af9cdf1a7a", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738274, "uuid": "fbd1e429-d75a-4ae4-957b-107de39085e4", "comment": "Malware payload (TeamBot)", "value": "9606cf265daeb6a67b880f23eed78379d2cba791bac7acabe6f2b425937cd499", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738274, "uuid": "ba06b199-6fdb-45f9-9409-0605f6a86ecc", "comment": "Malware payload (TeamBot)", "value": "c5b015d5995d53bf13980b6e7b1c625c68e0cafc", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738274, "uuid": "df435647-7132-4132-a409-133e8a94c297", "comment": "Malware payload (TeamBot)", "value": "c496b7ca59da49f386df9d49c4fbe30b0fa384970d80622eba346ba354b22c8e31749329a08158b52bbdec9ff12065db", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738274, "uuid": "b4718fef-a891-44c7-b30b-ed49419b9df0", "value": "T161547C1392E17C61EBA64A728E2EC6E87A1EF5604F1727DB1B145A2F64701F2D633F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738274, "uuid": "de35fc58-01b5-4aec-a788-91e0a8641254", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738274, "uuid": "5befc9d1-24a2-4350-a219-d0d842c9c309", "value": "3072:wqsautB0kGl2tkTGk3EVZGUerhIwd+0ccUmDYDUykMVr03WYjvF6FXrTY:kTtWlCk3o0ccibybEPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738274, "uuid": "241e7ff6-56ed-43cd-9196-3c84a873ec67", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738274, "uuid": "a15ccb4e-338f-4d0e-aafe-c511c5ca5bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738274, "uuid": "224b1b8e-ff8e-4774-b350-5b04193d26c3", "value": "listener135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876f8c2a-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737623, "uuid": "d51b7406-5133-42fa-b6c8-6c8b2e49f21a", "comment": "Malware payload (RedLineStealer)", "value": "8d76b08a5b6cc736a363681616eb8836", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737623, "uuid": "a57c7c08-b649-4faf-98e1-d2bd12d42e84", "comment": "Malware payload (RedLineStealer)", "value": "9615d71b3324032d22fa07d1ab4c1b0dcc35efb75f48798f98b413eea724a5a3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737623, "uuid": "a18863a2-e86b-400b-8712-3adfbfcd341c", "comment": "Malware payload (RedLineStealer)", "value": "91914721b74e4556d41e117ac98d409844c983b6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737623, "uuid": "7be82bcb-0d09-4f21-860a-09c4c7e871f7", "comment": "Malware payload (RedLineStealer)", "value": "5f91f0342fc7c88b0a388731ca15cd0321fb0440f3a69daca43c4f4de1efab1bb13571e33596fd1c8cad44548ee4d144", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737623, "uuid": "15e4329b-fb24-4f3c-9c4e-7cdf314275fc", "value": "T13C252302E7D82072EE752B7119FB53A31A36BDA08D76232B335BA85D1DB2DC4B470716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737623, "uuid": "0d920278-d213-41ea-b326-ed4f43027341", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737623, "uuid": "b4dd1996-1ef1-4be8-86cb-c37667eb31e9", "value": "24576:gy7ghSR8zUqvUWCWHHDZq4xwge1i9V4P:nZsUqv9DcUD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737623, "uuid": "670d69ad-28aa-43b8-b7f4-01b7c80f74c3", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737623, "uuid": "b44ba3d3-20c4-470c-b8a7-7465ce2c115f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737623, "uuid": "52d30bf6-2d77-4a30-9e5b-35350f6a00cd", "value": "reporter163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca6d96-f847-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684722021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684722021, "uuid": "70856605-299a-4b4c-8cb2-4d57c2e47033", "comment": "Malware payload (AveMariaRAT)", "value": "a8a9173322f8f28e5b806e2d47d17e1a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684722021, "uuid": "c644c4b6-a573-417c-a41f-644a974ed475", "comment": "Malware payload (AveMariaRAT)", "value": "96237eb7f3c5304d26fb06feafab631b64a274eb1037f51b58af586040154572", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684722021, "uuid": "e419d602-8d6f-4a4b-adf3-6c546686756b", "comment": "Malware payload (AveMariaRAT)", "value": "0eb5c89657a4702d1fe7cd38ca5e5926557ec2c7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684722021, "uuid": "4e10a41b-5c68-401a-aaab-8a77c5dadcfc", "comment": "Malware payload (AveMariaRAT)", "value": "c098fe3c7ba05a79fe462edfd956e915134308145ea7c8c10444eb9bbb5e21d54f050dab031dcc6fa1690d0c2be8484f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684722021, "uuid": "b6fe8035-6c78-445a-9bd1-0474c88e3b1a", "value": "T119E37D227BE54039F7B709701EF93E25D7ACBE310E31CA4B5BD4488658B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684722021, "uuid": "432be7b2-9ea9-4b5a-ba31-cc427d0b079e", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684722021, "uuid": "c46f3116-de62-4c0b-88d9-e3687d9d1973", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHmwYzHKG0pIwj:2dx3wqz3ZcDeDpYzqG0+wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684722021, "uuid": "ea6d95f2-328f-43c7-a72e-c26d80e680db", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684722021, "uuid": "1735a11d-e45f-4b70-afab-a6872b3ad8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684722021, "uuid": "06b37490-095f-4125-95ae-cea68212e642", "value": "a8a9173322f8f28e5b806e2d47d17e1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42eb3832-f87f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684746098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746098, "uuid": "5344e24c-aa4c-4eb7-9738-9c68007a6920", "comment": "Malware payload (RedLineStealer)", "value": "58a0c8c9d5ef467fd711316ef897577f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746098, "uuid": "2c78ea6a-ec1f-4840-bfe7-dcb21827b7de", "comment": "Malware payload (RedLineStealer)", "value": "9623b7492e6dd69d8632ce04f55e7ecf6a753b355778752c5fc51a810d7b518a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746098, "uuid": "fc62f017-2f7d-4de6-bdf6-2e6cd67ed4ad", "comment": "Malware payload (RedLineStealer)", "value": "6cd2076735256b76d41bbf6c464b51fe17a5e45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746098, "uuid": "27c92213-d319-48ea-8595-5c7ee808fb09", "comment": "Malware payload (RedLineStealer)", "value": "7b161600c521b959441cb1a844276e8dcd4b4ecd57c897c0cc3682468e4629955438551f37a7f0dc7f15f02d862b07af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746098, "uuid": "0baa9cde-34cb-47e0-9ddc-231db765b27c", "value": "T16D25238369D82532D8B437B06CB213731735FDA28979875B3796580E0D33B88A8B577E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746098, "uuid": "d0f37d66-eced-41f7-9531-c663f8131eda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746098, "uuid": "dfa016dd-40f9-4f18-90c4-ea9aca2411d4", "value": "24576:+yfUEOmFWzqQmdMawneZxHj29kenlu/C/vV:NflOkWzqQm+nebD29Jk+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684746098, "uuid": "82ec282e-744f-4b21-9df4-f1e83ff37f67", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684746098, "uuid": "076aaa7b-4a20-4fba-9952-061c56275114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746098, "uuid": "1df87c61-531e-4d32-9644-8744c27054bb", "value": "58a0c8c9d5ef467fd711316ef897577f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0616e439-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744278, "uuid": "55c40962-55aa-4f2a-acd0-b65d91526412", "comment": "Malware payload (SnakeKeylogger)", "value": "a79e126c71b28a60fdcaa70d968d5257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744278, "uuid": "53bf86c0-c847-4c13-8377-5591befe399d", "comment": "Malware payload (SnakeKeylogger)", "value": "9635e59516ec17777f48a02611e8fe11738a754821c9dff3833cd5a742f1cd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744278, "uuid": "40123798-6152-4b91-be88-11a560793d76", "comment": "Malware payload (SnakeKeylogger)", "value": "e35493c4d400287ed62e38b2e3f226629fd57a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744278, "uuid": "aa96efc9-1e76-4f80-bcba-ed30c2e066b8", "comment": "Malware payload (SnakeKeylogger)", "value": "524e0883a175c721faec166ef3fa414016234a7e281f85f47666ea360dd7b15a897a2b8e3de50a7204ca4a0ec3b5750c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744278, "uuid": "508b45df-5470-4f4f-b584-a77d06bf20a9", "value": "T11164F1057FBE2F5EE1BA1BFA2964690503BA3D1F3561E70D4DC120CE1E66F124760AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744278, "uuid": "cc54f5ed-7ec3-4b1d-bc14-f2568641b814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744278, "uuid": "d6d2f39f-6f6e-410a-943b-e7db3f945b03", "value": "3072:smEL32GhNvN3f+KuiA4CFu2f+kKkPk3AqA9JC+M7XjiExY4Hx7tQQbTgjnIPX3AQ:TEL2GhNlf+KI4sL+O8WC9XOEGdQ+y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744278, "uuid": "f45b526b-5689-4f05-878a-136711fdd390", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744278, "uuid": "5e7bf850-16c7-4920-a030-31ec15ccac39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744278, "uuid": "9531f673-3426-417b-8f89-1064155c8ab0", "value": "EOM_EFT.REMITTANCE_COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfc1759-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744318, "uuid": "0c6acbdb-d412-4d53-8c2a-e861e2216a9c", "comment": "Malware payload (SnakeKeylogger)", "value": "c249e073b2d5a67fbaccb8fd3ac6ae04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744318, "uuid": "696e1c65-55c0-4f29-931e-25604a2419e9", "comment": "Malware payload (SnakeKeylogger)", "value": "964e54faf21fc7ab2cfcac2cd859efc48acfe17cbfc22bf2ca6fcec8741a0402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744318, "uuid": "76b837f5-9ceb-4b19-97a0-7ae7bd4a89a5", "comment": "Malware payload (SnakeKeylogger)", "value": "6f1fc815455ccc4e3de53f5d2004e7753545f614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744318, "uuid": "a8e14406-5a85-4d40-b086-1268624be61e", "comment": "Malware payload (SnakeKeylogger)", "value": "6c952ad7eabc558bd509fcd57a3bb13011a425ef8b0198143cd898317fe14a8419495daebba8a65df02152fbdc5661b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744318, "uuid": "3d6eedb0-0159-45d7-8694-278debe291aa", "value": "T152C4E069B2FA1B66C77D83F5496822410B7471A36C37C53C5EDF34CAEA13B1019A8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744318, "uuid": "f2243e0c-f30e-4eff-ad2c-d5e7b3982fa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744318, "uuid": "f617fefd-aa88-401c-bb95-c343a17b42a5", "value": "12288:FOysSONf8z3TmRyKeLh/IXLOBq9VQeXYG:A18zRTNo2qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744318, "uuid": "fc873083-5623-46aa-b0fd-6589111c642d", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744318, "uuid": "96d7c6ed-1286-4aab-86ec-f0315812a0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744318, "uuid": "19db9c41-34c0-41f2-9bbc-238aabf91547", "value": "c249e073b2d5a67fbaccb8fd3ac6ae04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84776022-f850-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684726022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684726022, "uuid": "f32dbed1-4e15-4f13-ac86-1db5fe1aab1a", "comment": "Malware payload (AgentTesla)", "value": "e4677f03ed463a80ca3db1e532b37ce2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684726022, "uuid": "db208441-bd29-4411-b133-ea31545720f5", "comment": "Malware payload (AgentTesla)", "value": "973c7cf900b8d3fe8f945e15c64e4d786a659ea779196a0bb3fa135f3026c70e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684726022, "uuid": "e045666f-ac10-4686-84b5-e63a97a304a2", "comment": "Malware payload (AgentTesla)", "value": "66aef3418c29f3af54848c5fb4578402436b8951", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684726022, "uuid": "f3628875-2f5f-494c-8d23-f465c073eb0c", "comment": "Malware payload (AgentTesla)", "value": "1cf448c65aba24ffe57cb6290363ff368d8c1dc95d43f06d6ac6e571129a88b3c88dfed4dc7e07f9e9c21e0d608c36b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684726022, "uuid": "870c84a0-17a6-49ef-9617-18abec95c2fb", "value": "T1EF1501C13244AD40E92A4EB196B6E17003757C75EF22931F74E87E5B3CB26826B12BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684726022, "uuid": "0b88c0e3-1ee2-46d9-811d-0642fd811c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684726022, "uuid": "e9d0fe70-e041-416d-bac4-49631c5f656c", "value": "12288:eTpx0YPX/NqPsLjMKwTIXrY5CWV1ytv21H//CtEVkTCAm3gmvVmzyAzIUisULOAJ:eTcHPsEYs5CU8tvztEMKg0Yc+A/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684726022, "uuid": "3e0c4d44-9f76-4009-b8cc-98b84fd233f8", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684726022, "uuid": "04be97cb-1c3d-4888-86ab-e4fcc330cd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684726022, "uuid": "df3b15a0-758f-4fef-aac3-b4eaa05604a5", "value": "SecuriteInfo.com.Win32.PWSX-gen.832.31668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabeb551-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737253, "uuid": "5d733a50-9356-4b59-81d8-ef8c4b5d3df3", "comment": "Malware payload (RedLineStealer)", "value": "5a5444dc3dd838d46dcee51c6081a793", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737253, "uuid": "eafc1097-b64c-4d61-8357-a5d20ee612ba", "comment": "Malware payload (RedLineStealer)", "value": "97acafaf4c76dabd337dcd9c0707c8da0113d9eeb91b8b83ef3fe180a066d523", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737253, "uuid": "ccd0d331-9f64-47f9-b0bc-8cca967a1719", "comment": "Malware payload (RedLineStealer)", "value": "b551c299706bf87274ea437d9548345e81adde00", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737253, "uuid": "48786cd9-c79a-4a7d-9a77-d1d5ff0d0c54", "comment": "Malware payload (RedLineStealer)", "value": "687ace989f5c6492f1b86d5f43e2d255710bf3ed4fd2a967f310b745ecacc2d2e587d2e5eab59ce275cdc5c179bff50f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737253, "uuid": "91674b41-a769-4059-86eb-dbc08178ecfb", "value": "T1A925230AA7D59033D97A13705DFA03830F377CA25938831B7BC6A65A5DB328469713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737253, "uuid": "c263d3b7-00be-4ca2-9c5c-1ae79423f204", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737253, "uuid": "ac5f85b4-4882-4ac7-aa8c-96134db42a7a", "value": "24576:my3Ig5x0HnAmdqRHbBPQf9qjZF53IQn70mBvCWUFVJqF:1D5x0HYRlQlS/70mBFUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737253, "uuid": "6a19b66d-c7ac-458d-9870-39a5f40191a4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737253, "uuid": "39a7af4b-595c-4edd-9a38-8c2ed8298cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737253, "uuid": "1be47dbd-4edc-4dbd-9215-9c9ac70de13a", "value": "99242431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f8988e-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745211, "uuid": "19dc9c4d-a30a-415f-a494-2c65ea8fea8b", "comment": "Malware payload (Formbook)", "value": "9a203cd116939a4670308c35c6682de3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745211, "uuid": "51001532-530c-4e45-aa8c-fae9114e9f51", "comment": "Malware payload (Formbook)", "value": "97afcb0a77ff4e18dea8e6c22f392e67271db8316b112f9086904d7b4ab065ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745211, "uuid": "6a6c76db-948c-4ed6-ab2e-9abb38e5175a", "comment": "Malware payload (Formbook)", "value": "3f70c84e2e287ab018140277c3f91a4e287e2fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745211, "uuid": "6fff1416-adbb-414c-aadf-46504b588eda", "comment": "Malware payload (Formbook)", "value": "a92c651e28d90970c6f661b4bc4a1c2f8f7cdfaf915b6759c579a94dbc543654479ce76ad02759d329cdb111dbec8a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745211, "uuid": "91825a57-f3ca-4ffa-8d16-2ec740053831", "value": "T15EF30202B2EAC113D9620A730973A6BAD976BE050D26274F3B949F7BAC315579E4B0C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745211, "uuid": "bb47c907-07e8-4096-9a85-e00a44cf2e83", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745211, "uuid": "5ae9f220-37a4-417f-873c-1b305442c6bd", "value": "3072:1DQkrZoosbIfXJ/ppJCMqfA4B9khQ25xUhMAZOInhqacTcvsL3m:1DpoeJFMA4B9khQ2oMiO7acTc0LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745211, "uuid": "e2be2bce-e7e0-41d7-bf1c-b8299daaeec7", "value": 161800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745211, "uuid": "ef3bbca1-ca9a-4006-9207-0db0637601cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745211, "uuid": "9247d617-7df0-433f-a34b-2f7fe7c87de8", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb1bcb9-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752448, "uuid": "f8d1d797-da73-4345-ae78-fa253d43625f", "comment": "Malware payload (RedLineStealer)", "value": "167a047040324ecdc61d2a9e92667a45", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752448, "uuid": "f9495257-1512-481e-9048-75bce3c0bbe9", "comment": "Malware payload (RedLineStealer)", "value": "980d7b031cd04c8bd2a5545b10128fa398454f917341e0045de1f563dd67381e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752448, "uuid": "00b6fa5b-6643-44b6-9405-a26536b9f9b0", "comment": "Malware payload (RedLineStealer)", "value": "d73bd33ebb6634f835620e3af336397592b2ed04", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752448, "uuid": "6fbb73bb-84b6-4bd7-a46f-33e16f44e69a", "comment": "Malware payload (RedLineStealer)", "value": "bbbd5de5c4aea056761192ca25545f830c70c5feead1e77d8d8fe02b17cb7cb7f7ca3b7e42aa45a6a3170700602df3b8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752448, "uuid": "c50e7337-34f3-4884-8e67-db73c8d2b0cd", "value": "T167252303B7EA4076E8F43734A8F607832B36BDB55E34861B3756D80B0D726449A7376A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752448, "uuid": "9262a874-c629-47af-ae34-df794ad8bd54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752448, "uuid": "b9e7a73e-4e35-45df-8dc6-c4394e250acf", "value": "24576:ryPlXv2WlkU1fqGdOox4qzm8q158dqiqqwjwzGa:ePlXHlkU1fqO4qzmHVqwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752448, "uuid": "a3224a83-3ff1-4e04-8c8b-123d0b74a056", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752448, "uuid": "e44bac1a-6c80-45b7-80d4-43e6cb124861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752448, "uuid": "3eb5c0e7-cfb8-4e4a-9aeb-e5185971eb14", "value": "handler220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1de14f-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752474, "uuid": "7a9b6681-d5e1-40b9-839a-40a179efeaae", "comment": "Malware payload (RedLineStealer)", "value": "65a5e18f71c3d619e7bf8b78f6fd0ce9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752474, "uuid": "77b45046-b1c5-44c6-b97f-f51569655121", "comment": "Malware payload (RedLineStealer)", "value": "986a1c37256eb0417132ff10cace7d70d877bea5d6b37d5552b0d613ec351276", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752474, "uuid": "56ef6a4e-939c-4daa-94bb-4233ac898744", "comment": "Malware payload (RedLineStealer)", "value": "ca1601edccdcc661a21f05ce620e261828c459b2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752474, "uuid": "0314c18a-38c6-46ed-a302-7f422efcf182", "comment": "Malware payload (RedLineStealer)", "value": "995aaf2e519ce9b19b1846839b6015c00e20218ce8a525acc18aaf0b303bce88ec7bb521808101678b018fa4c9b7b34f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752474, "uuid": "83fe87f9-4edb-4b1d-add2-6499ce2f5a32", "value": "T13C252316A3F881B1C8B5337144F753532B3AFD215E3C8657269AAA1B0C73AC87873399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752474, "uuid": "804759f0-06fc-453c-9517-e726d613ea75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752474, "uuid": "5ea845f4-1954-42f5-b5ba-67caf62e7d8a", "value": "24576:QyvnwOovOS1YWPNrT+sjhQYgjiSmXW92IoydVwQZA2YQ:XYnO0VV6sKjLOWH/r5ZA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752474, "uuid": "13ad0cdf-aa82-420e-8f48-f4d1751b793b", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752474, "uuid": "3d7f705f-043c-45eb-b1cc-fce4f7b3f17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752474, "uuid": "ee19b6e1-4b72-44b0-b729-d9677b94547f", "value": "launcher652.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2989afd3-f8bb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684771825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684771825, "uuid": "26c880dd-bcfe-4ef4-a5d3-504f48398244", "comment": "Malware payload", "value": "0fff37e2774cb249ae85792b999f713e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684771825, "uuid": "dbacfd97-9b84-4c8d-8c18-51d662b7dd1f", "comment": "Malware payload", "value": "98890a8fea6d7bd674b2e84bed797a2f08a071e157bd4b0de25c1a7f814a82e3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684771825, "uuid": "0144e0f1-6b78-467f-8243-8ae33e35891e", "comment": "Malware payload", "value": "784dd4b7fe26c1b89fd046e79b94188bd8860316", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684771825, "uuid": "f0898bb9-1913-48a2-8db8-8b38bcdc91a2", "comment": "Malware payload", "value": "629435e68b2ab3e64c0af015589abced26295e7f8e2d72005c6f33c2635dde0809d00ebdf629998989b99e82fa30969a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684771825, "uuid": "8870d1f5-ca2a-49d6-973c-3ed36c7ae677", "value": "T1DE84935AFBF610E4E5BAC13895A2322AFC7138A44738E7D79685460A1B30FE4ED3D750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684771825, "uuid": "248e024a-85e9-42e2-9e25-6e08934149d6", "value": "ec418020fe134cd7242b006e295c047b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684771825, "uuid": "29f527e0-1341-41cd-ab34-652c276410b5", "value": "6144:lrZz7xM2lxiXhIiYfsITWdTsoHjcw3wFplqn4:ZZnxMKxiXhI3fs+xFi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684771825, "uuid": "6f20a32a-4835-49ef-9a35-458b613b4c41", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684771825, "uuid": "32bfd024-4ffa-4b0d-b8db-0e5015ba9a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684771825, "uuid": "f9a3097d-a355-4c15-8755-ca80bdb95da5", "value": "0fff37e2774cb249ae85792b999f713e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347d2cb1-f83b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684716868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716868, "uuid": "2eb2cc36-fd1f-452b-b4f6-183e4ea2e960", "comment": "Malware payload (RemcosRAT)", "value": "0cf0d018debfce1695e34759289e31db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716868, "uuid": "53247549-e52d-44da-92e3-2a83c71c2f2e", "comment": "Malware payload (RemcosRAT)", "value": "98e8a76487a5811e1dd8574c08a8b66dc39506044045fc8c994e5d0e533a663c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716868, "uuid": "159d64e2-b564-4fa1-a318-226953950d3c", "comment": "Malware payload (RemcosRAT)", "value": "addc939a067d02b2fe541a3a3116675e1295f698", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716868, "uuid": "c26de95a-76ae-4ff6-8992-6270e000167d", "comment": "Malware payload (RemcosRAT)", "value": "3c54111748a98149696e6c33ad73b3834f5ef2fe85ee12c624d379c287d05b8ff4a942d4920d5e79bf0c80cb361d96fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716868, "uuid": "9c57b8a0-e733-41ed-8ee8-be54f72f7c9b", "value": "T17335D02062AC9F1AE03A93F94091D5B047F95EAA647FD7478ED2BCCB3A65F110A51F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716868, "uuid": "2418eda4-c086-43fa-a02d-efdc7394ff54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716868, "uuid": "a4e652c9-893b-4101-bd52-c9ffcb0be8a4", "value": "12288:oS8hue/3H1xrIqn1F50eqdnO32TF2EqViwr7znqm0QIZZAEJXZ7PU45/Hr7scMFO:oBxrIsPPY3F5qokXnqFrJXdPD/Xqm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684716868, "uuid": "a1fd0fcb-59da-43d9-8556-9b8827936ee0", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684716868, "uuid": "3b5d1b73-b4e0-4e5e-8b80-031ca200d05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716868, "uuid": "d72fcf67-5750-49c2-949c-cca8ef2c62e2", "value": "0cf0d018debfce1695e34759289e31db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2119ca42-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752484, "uuid": "cb4e1fb6-2663-4318-b0dc-db8485fa5ca2", "comment": "Malware payload (RedLineStealer)", "value": "d66f0b5b8addb09ddb645945189091f9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752484, "uuid": "290a840e-f570-481c-9976-898a9ce5f682", "comment": "Malware payload (RedLineStealer)", "value": "98fc22a5f851142421bcec6c3ef6a7004a9994a23e1401ce6f75e6c0755bc058", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752484, "uuid": "676bf882-8a51-47d9-b459-0df83a00c789", "comment": "Malware payload (RedLineStealer)", "value": "34fc4fe382a38652e33a397ef5162a109cf1f0cf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752484, "uuid": "b6a022fb-155f-4c33-add6-d00ff4444b49", "comment": "Malware payload (RedLineStealer)", "value": "25e65502c76736dac19c6e726da90549ad943dfe4398741828bcb85d2dfa59cbcc2ac0add98eef56b8075112e8e1c279", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752484, "uuid": "ed55f0ca-7fde-413d-8f5a-5fbb0c5bb2dc", "value": "T1B625221366EC9036FCB62F7014F212930B357DA05A34C3EB37A2796A2DB2591953A737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752484, "uuid": "afe3f913-60aa-4da0-87f5-2c0be4108357", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752484, "uuid": "8734759f-76e3-4b4c-ac90-505b7d3f7256", "value": "24576:Oy6BDxCwPCP5qsCAlE56LBNDY9Yb3zWWGPvJ:dyCBP5q3W7LnDrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752484, "uuid": "88c54fef-35de-4b40-b06a-b194aa49a237", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752484, "uuid": "7e635ad4-6875-4380-85e9-84ab1644e4e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752484, "uuid": "7344a622-1be7-4616-87b8-7f5441eb55e0", "value": "localization119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165bb2b7-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755902, "uuid": "de38a04b-c192-44f8-abb0-1bdeb97f7512", "comment": "Malware payload", "value": "76e2589f38bb16676e00bb88e612634c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755902, "uuid": "41e7a702-7b15-4864-acc8-636854eab945", "comment": "Malware payload", "value": "991423212ca8d7e80497bad3a159720b03de528a052cadd51e5641a0202aaf7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755902, "uuid": "52069d61-0203-4dd1-94e9-1cb808e6e93d", "comment": "Malware payload", "value": "aa0ea35dc29d69dec112b0c3bbae4a7aa3a72178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755902, "uuid": "75ab5691-edee-47dd-9236-a739fb13dd65", "comment": "Malware payload", "value": "47740b79f5b6f1e75ded71d72a9b56a7bd85440cd4c8b21d25bbfa3a0668303959bbd2cd8e823486c4931264dc9ce831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755902, "uuid": "2e097cc5-a78c-4a2f-9e54-3bd3dc279db4", "value": "T168D3BE477351C7E0E882A7701A7EA7554B9B9F7122364777B4B82C2D1F3A80E8E06B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755902, "uuid": "06677fa9-f1fb-434b-8ba2-3d68ca2afc0b", "value": "1536:9W3G0GBDBLZHwXCbJk2gYShphwkNl+V1X0aCO9PXFIm8lZOwjt4TkdWK9:6Gz0wJsYShD3l+VWCPV58lZOKeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755902, "uuid": "14dfcaff-6ca7-4d2d-afa2-97c7463ac17d", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755902, "uuid": "d23960db-7d66-449c-ba71-519156aefb9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755902, "uuid": "83453cb9-0d59-4027-843f-78071e17636f", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen2.23129.30084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4507ea2-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752301, "uuid": "2c26d655-713c-49c3-86ef-f6e4cd1c0e02", "comment": "Malware payload (RedLineStealer)", "value": "b3cb0809331c5f0d985a1b1c7824a1db", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752301, "uuid": "b1d6c84a-0290-4d63-a29f-998cda8dd92e", "comment": "Malware payload (RedLineStealer)", "value": "9944cc73c1edd365a8507a61392f7b873d9132793455680dd660765f19e6a9de", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752301, "uuid": "d483e974-2b62-46dc-82c5-d5a800dbc764", "comment": "Malware payload (RedLineStealer)", "value": "92ac454202b69eea13a705d16528375ea3e7d35e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752301, "uuid": "0064396d-2ad5-4c16-a014-757454d11b87", "comment": "Malware payload (RedLineStealer)", "value": "19b8889b805d1b431d5dfa88d5d3355669678a5b0b76f13a3ef5c8b55af177acc0b241329e4491d35673189efce03c8b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752301, "uuid": "86a9c2b8-c18e-49d8-bd60-1c75b11d7d94", "value": "T14025230E97D580B2DDB43370A8F712830F36FD616978536B36406B165D72A88FA74B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752301, "uuid": "bdc245b2-4bd5-4d3e-a44a-a47446b66070", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752301, "uuid": "85eb2482-c9ec-4220-bc2f-524267d6eadc", "value": "12288:6MrNy90sjEW9qtGJIWKCS7AuL2Rqik935kjdsfzugy19PM+K+BombLMV2d/uxTKa:fySBloRRqx5Usf5WS+aqg2d2xTKO+K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752301, "uuid": "7dffc80e-6f08-4cf5-9b7c-c43d9c4944d1", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752301, "uuid": "39a42baf-c8d2-4127-be8b-0762438b7f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752301, "uuid": "ac598745-3b31-4d3e-9dd1-1a5e19966843", "value": "DiscoSetup808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd68951-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752421, "uuid": "7379b309-8fbe-45ec-9d01-dcbd650de338", "comment": "Malware payload (RedLineStealer)", "value": "70f244fa2ab21c3f4305cf0a1369ed54", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752421, "uuid": "a2048bd7-bb9f-4767-aba1-0fc1cec1ab4b", "comment": "Malware payload (RedLineStealer)", "value": "996d4e0a67dcad433fa2049dca1defdd984d776fbb5bc5990c0114932be25066", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752421, "uuid": "60712597-ff50-4f9f-919e-ec0d9c20a1e8", "comment": "Malware payload (RedLineStealer)", "value": "c235008bcc7eb75f083aa14d1b872f531832cb6d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752421, "uuid": "e76e923d-394c-4b1a-9563-5f178ce8ad1d", "comment": "Malware payload (RedLineStealer)", "value": "4d3826d451b4f6eaa4de265957afd2f6e4116f7cd86aea59ad55053786c93d6392a719451a797bba3b8beb3a54775321", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752421, "uuid": "5fda31cc-78dd-4c66-8078-bca98f50e0bd", "value": "T1FC252307BBE891A3D9B9137008F710C72D36BDF55F60925F33E1AA692C72694913236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752421, "uuid": "d9a92242-747b-487e-b639-75b0cd4aa81a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752421, "uuid": "6e3b76a4-835b-46a6-8b75-de761714b47d", "value": "24576:LyED3eysTd6ds9FvgENmrD3dFGkZ2O68paNDiu:+s3xsTWsAeUDtkshahi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752421, "uuid": "abe2119f-e741-4c4f-9fd2-590eb36049b7", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752421, "uuid": "e6d309be-728b-4de3-a7f3-bc77de0d0449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752421, "uuid": "3f33949b-a954-4e89-9d34-153bd79dbe4b", "value": "file607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc47c3-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752321, "uuid": "81a52151-dd6b-44af-8545-f4482e201b82", "comment": "Malware payload (RedLineStealer)", "value": "d054cdc324b594f3d56aaa1009858d1a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752321, "uuid": "9ecd9252-2632-4d7e-8822-f8c4ba4b727a", "comment": "Malware payload (RedLineStealer)", "value": "99dbe742b245dee78ab4c969b605a486201940815f56faed3c77966736e000e5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752321, "uuid": "0ab5a2f1-caa9-4636-9ad6-171804f5b58a", "comment": "Malware payload (RedLineStealer)", "value": "d55d8fcc21661409fe328cf6cd53379001ec4839", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752321, "uuid": "ad7bc998-045b-4399-bb56-a86d965a8595", "comment": "Malware payload (RedLineStealer)", "value": "e0c046cd0363af8275fbd2f80ecbe95b8defc1b77501d4e40da9181a73ba11352cce997b6970639105a7fbaea81c3828", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752321, "uuid": "61283999-d09b-478e-a189-d7898e288dd7", "value": "T140252347A6EC2021DEB22B3058FB07D31F36FEB14D7853672702995908B2AD5A5317AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752321, "uuid": "17e4c80f-a6a7-4801-a0a0-0743f48eb3a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752321, "uuid": "9451d448-0262-477d-8f0e-d64eb793687f", "value": "24576:cy4DDSMyxhbQrKpiEXabS4lHlrlIqYLQ9wf5Ugs7y6sJw:LOAbpiu4lHlrIs9S5Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752321, "uuid": "df09a0a5-b6b0-42e2-a72c-5ecd36ce269e", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752321, "uuid": "895e12c8-c9af-4cc6-bedd-90df8a42d9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752321, "uuid": "ca4c237d-b975-4689-86c4-eb4a9a41a43c", "value": "achievements486.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6539f91-f860-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684733031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733031, "uuid": "089e035c-65ca-43df-a420-3e6fe9f762f5", "comment": "Malware payload (Formbook)", "value": "16603cce47d665f761e1277bc1d7d971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733031, "uuid": "982d01fb-7daa-412e-bf84-670bc71d8a27", "comment": "Malware payload (Formbook)", "value": "9a4f1c702c95182b263a0cdb0e0b89884d7574fe98bccb55ff1ad1ddf714bf38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733031, "uuid": "4e6dd627-dc41-4014-b719-d80ded3bc6fa", "comment": "Malware payload (Formbook)", "value": "ba805d651469c745faea0661ba3ad9e5efaa50ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733031, "uuid": "571d7521-db01-497b-8a6e-d1f4a1a0817d", "comment": "Malware payload (Formbook)", "value": "790fbc143dc6015489db9c372b2bc368ef8df7dd83058ff6ed35ce76b2a99e831280f4eb95a663a4c0c2ba1d5df6bab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733031, "uuid": "936d7994-aed0-4eda-8e6e-4ddd29971790", "value": "T170F3023272E6C8A7D55345B10A769B67C83BBE121224CACF7B817F7E2C3234BE545252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733031, "uuid": "7b3e36a6-a090-4ed4-ba05-2972ca0e3055", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733031, "uuid": "96628fd5-29da-4cb8-a1d9-e3e48b5cca07", "value": "3072:1DQkrZoosbIfXJ/ppJCMSVgjpDljCj7LCdpw8wkMhaBuG0Mv48GL8oNx:1DpoeJFkKpDljgHntkcaBdv48C8oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684733031, "uuid": "42951ae2-688b-4bd5-b4ab-d2965c08ac08", "value": 159326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684733031, "uuid": "9b15860a-324f-4847-a9c1-03956e25d418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733031, "uuid": "474d25ee-5fab-450b-8584-df27f44f5100", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efedd57b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752401, "uuid": "0f30b0d3-9905-4815-94e1-b150cdc0a486", "comment": "Malware payload (RedLineStealer)", "value": "a50a80bec3f10bf1cd44c226c0a0cd0c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752401, "uuid": "da489fba-ded5-489e-a3c5-1c92ff8f056b", "comment": "Malware payload (RedLineStealer)", "value": "9a5ad30d36f221b2bb6d04b95b6f8a3c092d9133e0874c572118db76ddfe09fb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752401, "uuid": "d95737fe-5ed4-44cc-a31e-0da01978fdc3", "comment": "Malware payload (RedLineStealer)", "value": "5024aa01a5018d43b5321346c78e4aa87826a6c4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752401, "uuid": "d2bcd3af-1270-4eec-990f-d33b4a9d37b4", "comment": "Malware payload (RedLineStealer)", "value": "53520fe2845d598aae47b719c50587f5409cb8e87701a386c939dfcbe18b8f901848ad87a914184b5860c64c9c9d9625", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752401, "uuid": "7085e85e-5b09-49f8-a1ee-6e0f1fc27cfd", "value": "T166252353F6E4A03AD9B527701CFA0B930A31FCA0AA70D21727426E6A1CB35512D76B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752401, "uuid": "94699881-7bfe-44aa-9f65-1989f103d46e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752401, "uuid": "41fff3cf-99c4-4308-b039-d7e468cb52e0", "value": "24576:jyA4b1abq077mtAGqigA6bc7gRFK4FiKg83xx:2A4kbqO7mmGqigA6IEqD383x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752401, "uuid": "0d593952-1e8d-45e1-8be7-b4d320048076", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752401, "uuid": "4f245f33-2dad-4ead-9006-50bcda7fb8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752401, "uuid": "a3330fb9-7fd9-4d91-861b-93dca2fc728a", "value": "download407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9328ee-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684737315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737315, "uuid": "d04c1ca1-9eca-47de-9639-da803578cc47", "comment": "Malware payload", "value": "3d3b2a66ae3a8a8cf21e2cde12f5387f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737315, "uuid": "37ff2276-49fc-4bb5-a32c-38d681ca108d", "comment": "Malware payload", "value": "9af5c084b7203741bc26debb6212bf138f3c7a41e04d96948a332be4a842882e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737315, "uuid": "3b6aacf4-6d5d-423a-a76a-21f4e460c68b", "comment": "Malware payload", "value": "a6c8e87367f8168ece54c8f27ba182df406a41c3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737315, "uuid": "d0bf9fa4-3cbc-4315-b296-3f03aa83c774", "comment": "Malware payload", "value": "0f321f1f8aef6db2606e75b8303cbaf3b22b8e3a8188fcb8f79118dc75a925b15356c5166c916aecf037a86f671d123e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737315, "uuid": "7a91d728-5964-4984-9866-ea65c9e7d253", "value": "T1FA5402D7B736E185EAD7D331892742E3163B2E688E4329932E45B72C58F7AC0C71B644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737315, "uuid": "13fcc825-b489-405f-ae3e-ee0422f1713c", "value": "6144:ZbkPe2DpLKXsb1ULz9Qg7KZdyuKI0mYkMdfO:QtDpbmLBSGuK2YJJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737315, "uuid": "d4103219-c79e-48ca-b81f-105fb71339b6", "value": 300055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737315, "uuid": "3444d5ee-ecd6-46b2-94d5-ebd3128e1ca5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737315, "uuid": "6a5cee87-840c-40a0-b237-244be40d0788", "value": "AndroRAt.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a3d6eb-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755901, "uuid": "575b1f5d-c0dd-4d98-ab41-d97cc1bd2d34", "comment": "Malware payload", "value": "9fbe18864d4021dbbe7e41e964d8796d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755901, "uuid": "bd34000a-78b5-404f-ba76-c8064e107f8d", "comment": "Malware payload", "value": "9b9bfe5b676e71e3a74448a5a11fd65339fc1c310c57ab891b08ff98e7b007fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755901, "uuid": "b65c1d8e-e1e6-4eb3-ac2a-7f977480864c", "comment": "Malware payload", "value": "75218f82f85dfe96a5db5ce6105105d62198c66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755901, "uuid": "4dd16589-0f57-4b31-b521-2f58bc5098ab", "comment": "Malware payload", "value": "065504ec45829c11dd08e5716b2912a49d31f64ec74e4f39335655dd2880b5cc82f515f3fc58a7bf550196718feb339e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755901, "uuid": "6ee9ebc3-8505-47b6-92c7-5485a502f56c", "value": "T15C052AD3AC1042F5E9260DB0682EDD491A1F3C3EFEB0399D3F8AB56626B35C71426917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755901, "uuid": "85931a29-5267-4d1a-86d5-3b008133c85c", "value": "12288:rH5m/9K1piAKEowPYTCNzmCwBIKC95R63TDLBVF:I/s1gBwPYTCN8j9VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755901, "uuid": "7a3174dc-4678-4ea2-88e7-981126016c4e", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755901, "uuid": "64fe3422-e665-4174-9b1b-af8ce2671540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755901, "uuid": "c45e5148-efcb-4b4f-9b71-293e77f4dbee", "value": "SecuriteInfo.com.Win32.PUP-gen.850.24974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7929dc6-f8e7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684790935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684790935, "uuid": "cdbdd6ad-9dbe-4f97-a2ed-48da9b4ac9a0", "comment": "Malware payload", "value": "ef2bfce32ca9a69c4a57eecf2d7c7863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684790935, "uuid": "eef0f613-8b52-4043-b202-adfe5792063b", "comment": "Malware payload", "value": "9bf011788466d21b1da215ee2c1b4d1bb3c476a9fb3091dea8de8461477e4e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684790935, "uuid": "1a9e1169-a11b-4cbb-8b8d-7514d088956a", "comment": "Malware payload", "value": "5caeb9b826d0c5428df8d0415c1d14f00b67bfc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684790935, "uuid": "a879b93c-11c3-4c4f-a62a-2ce2b776809f", "comment": "Malware payload", "value": "43baba48beb2724bc8cd5401ca92808562b6a0e81f0ce63e8d49b312fdb90ccda2b3a9792d9e508aa0c45fd0443c37ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684790935, "uuid": "1a7f3816-47a4-4ccf-ad86-ac0e44e2632a", "value": "T1A1E53334CDA8CF57C68CDC35A052B5EB1DAD1F1948FB1E3BDE9D482C2C52E42A58907A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684790935, "uuid": "f06c7027-6211-4115-8352-013ccf5fe767", "value": "d9c379590161765025ca25c5118e163f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684790935, "uuid": "dfcff4be-5fcf-4802-95a4-3062b1390a3b", "value": "49152:qMFuHK+nCyq22UTsZQT7EEdc7CMzGhjV2wMNoDLThDWJvrptCL:qO+Cl/UTsC7EZ7Cqk2wMNoDLtDWNptG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684790935, "uuid": "7e723aa6-0d0a-45c7-ba72-0cf6feaba3e6", "value": 3067408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684790935, "uuid": "b1d2cd21-ff88-4e91-af03-2662dfd677c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684790935, "uuid": "4a43f1ee-310e-4d8a-9699-43521d6fec90", "value": "SerenityCheats_IW4X_TOOL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34226991-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745214, "uuid": "467ee200-a168-45af-a130-1cc4ce75b6cf", "comment": "Malware payload (AgentTesla)", "value": "4abc860df01b709d6ff4163fe20dc003", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745214, "uuid": "9339ad8d-f59a-4d42-9412-4736191b49cf", "comment": "Malware payload (AgentTesla)", "value": "9bfcddc5558b99ca104647f9f65f6eeb585d7eada6a786e841ff71d9a7a4c682", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745214, "uuid": "9b0355a8-c1ea-44d2-9494-dbfe89548693", "comment": "Malware payload (AgentTesla)", "value": "d61fd22e5effb2cf6baa31d9ed98b6eaeed8240c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745214, "uuid": "39b00bab-13ea-4bfe-88ec-b25165cff3d4", "comment": "Malware payload (AgentTesla)", "value": "d9724954db2d21211f44c72b6332d2e3345d24dc869eaebd45f5f24ccdb8123800fb0cf9b82d9b17a10be2b7472d8d53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745214, "uuid": "04167aa1-e0d8-4bfc-a738-c8465cd6b052", "value": "T1B9357B5233B57E1DF4ED32BD0C15D388CB39BC4A2012E13A2B5636D546F27AA770A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745214, "uuid": "614447c3-e008-4df3-a941-8477f113246e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745214, "uuid": "8438a59d-007a-4368-979b-f7919007b088", "value": "12288:lvV+s1bSQT6tjjdB4CoiuDZLySi6SXu1/UuoAzKh+R1Xa/ruB35Y0AbfnYw+AtdM:ltUNu1+Si21nLOQE235Y7f1FMIpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745214, "uuid": "08a60dc2-67ff-4d04-968e-38a12d3ebfd0", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745214, "uuid": "64da8220-8609-48c8-939f-87e7b2c7b17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745214, "uuid": "20656a8a-da65-4398-8260-5f582ce9a7c6", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e55103-f870-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684739657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739657, "uuid": "3fc16848-0eaa-4372-80bb-90b1cf86fa96", "comment": "Malware payload (RedLineStealer)", "value": "b64e38d1a5a3bf046093d96fe2bf893a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739657, "uuid": "62313d04-d4f2-4745-a61c-e6e547822ff8", "comment": "Malware payload (RedLineStealer)", "value": "9c578140205c94ce1f94fb18b2a08bea1d1ef0323252fa81f2acce185c8e1036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739657, "uuid": "d24d2fad-6164-4bb7-a852-e046998f9346", "comment": "Malware payload (RedLineStealer)", "value": "64737bf7ad86af186fa83c79d8de2b2f77bd10e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684739657, "uuid": "31b3215f-21e9-4b4f-9d3c-ac46a5f23327", "comment": "Malware payload (RedLineStealer)", "value": "cc5e7f9657a9fbe2b3a8faf799e38968f6e179432b6264d6ff03b8acf6f453f6981b3f1961e7108fdcec4e564125def6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739657, "uuid": "d7e96522-83f2-4ab9-acdb-f36caca7726e", "value": "T10B54E02136D1C872F16605344AB2C9FA4A2BBCB257B169CB2B81477E0F307D19E7A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739657, "uuid": "31687703-bc9c-4ffb-9359-9111d4e49119", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739657, "uuid": "6d02bcdb-51de-42c8-a07d-1973bd4629e2", "value": "6144:COEDYcUxxakKeKzIOPKiJIcCvQAF2Pzuvw:C1DYcyAeFOPK8nAFaSvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684739657, "uuid": "77453fe0-70dd-4ec6-96f9-41110afae75a", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684739657, "uuid": "25cf4392-6b36-47fd-a905-825a4be60da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684739657, "uuid": "6d7e5e20-0feb-4ec0-b361-c7ff84cdee50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fe1ca3-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752255, "uuid": "82468155-fcdb-421f-8ca8-22eeb916c7fa", "comment": "Malware payload (RedLineStealer)", "value": "28d1bf8b832b8d3034a26ac620962361", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752255, "uuid": "4154922a-0d17-4981-b0af-73e9da066f9e", "comment": "Malware payload (RedLineStealer)", "value": "9c8675f3393a4af7c56d3ccb321064aef44d34e96e9ae09365146e67abc0d0a5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752255, "uuid": "8f885078-01dc-45e5-9ec5-e5282b178bfb", "comment": "Malware payload (RedLineStealer)", "value": "fde12cde01333b854055d616bd6f5e829c7820c0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752255, "uuid": "189f786d-b54f-4ddf-aff4-aa10196e1379", "comment": "Malware payload (RedLineStealer)", "value": "aa507a09b8392b6c977a646ecfb85be3a75c316abd439b9f60ac7a452adbe3e22995b22537f2d69b87663fa3fae50740", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752255, "uuid": "04c832d6-f564-49eb-8ab2-e1d3be911ac6", "value": "T166252307AAEE546BCDF11B708CFA07930B327D62DC7466573B86989B4873984A17132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752255, "uuid": "afb3c0a2-1563-48de-9506-fd431c199c7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752255, "uuid": "25361b65-6539-43d9-a9d1-f4ed9e697ff3", "value": "24576:zydN/xeq/RuXaHrth16fMKBiP9y1GDkj/3+s:GrYWuXaHrqlBiyGDkjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752255, "uuid": "cd8f8a3f-f9fe-4b81-a4e7-3d5a4e59cc5b", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752255, "uuid": "8d778baf-79f1-40a3-b1cb-d3df85db2c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752255, "uuid": "d0018f32-72dc-4fdc-989f-410b442c17b1", "value": "42345955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9178c7-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737603, "uuid": "9a0c0774-323f-45e0-848f-962a180d3169", "comment": "Malware payload (RedLineStealer)", "value": "59b399259f5e4bc381fbe36bdb8b03e7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737603, "uuid": "0f640ab9-2e57-4e83-b5a9-fe7b65651ac8", "comment": "Malware payload (RedLineStealer)", "value": "9d1a3679c817c44110eb9a09dfa64bfd20cdb7423aa5c4013933a1c188e5b373", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737603, "uuid": "0110d84e-d26d-49de-8305-d90607080a2c", "comment": "Malware payload (RedLineStealer)", "value": "bf0cc770d792fa325acd2c7ddee017cfa7739295", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737603, "uuid": "6e8607c2-11c1-40be-b71b-91319dcf5bf6", "comment": "Malware payload (RedLineStealer)", "value": "b823bbc87fc01ddf75610945caf75c066a6f5758cd541b04c5ee9d7d293a0c3dc8d68073b5bed561998c62f5cef5502a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737603, "uuid": "8c1dcdfa-a449-4605-ba06-50fb84a6593f", "value": "T1F9252313AFEC4576DCA1237005FA07870736BDF15E14526B378AAE8E5872A84A433B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737603, "uuid": "85589ba6-9bd7-464a-ad2c-9e593d0efc31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737603, "uuid": "26879457-95fd-424b-8c20-32045dfcba31", "value": "24576:NyKvPYjME5d/K+yknqopFn1TxFNbtQSU/FKfj:okEdS+yknquxFNbKSUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737603, "uuid": "53009554-572a-4a22-adda-9286e595fca1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737603, "uuid": "e7830f06-db5d-426a-9421-f5e1591a2c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737603, "uuid": "bfe10980-1b05-48d4-b2ab-a4d085a8b791", "value": "publisher651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5792fb-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684745201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745201, "uuid": "128bc04a-87d1-4532-9543-0b815c4c65c1", "comment": "Malware payload (SnakeKeylogger)", "value": "9c1397ec28f4b84e4776d22cb99305ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745201, "uuid": "ee2d842d-28bf-4e94-8dc6-044f42d372b4", "comment": "Malware payload (SnakeKeylogger)", "value": "9d2fe317d804de453747ca99b16054d206513ad14a7f4ce8a2507db982fcb533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745201, "uuid": "6e18eaae-0d31-42f5-bfe7-bf6b4f30ce89", "comment": "Malware payload (SnakeKeylogger)", "value": "e4557e1585d574957f6750b4eca2377bbd37ef3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745201, "uuid": "eebeb6a4-2b68-4f44-8707-d0654c421d1e", "comment": "Malware payload (SnakeKeylogger)", "value": "40c761c3298d37689f827192bfc9e53384d8e5786212349d0b1532e37198d47113ae31f091fa07cde5e833e75449c18b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745201, "uuid": "dc92eb5c-a36d-4819-8c24-76222bcf3865", "value": "T10AE47A6233B57621F47D33FD4019638DCB39B04A2062E11A2F563AD556E27EB7B0A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745201, "uuid": "32c1c921-4ed0-493a-b53e-c0280c167976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745201, "uuid": "2bd09142-6fbb-4ef2-b889-f52f7e7d240b", "value": "12288:bvV+s1bSQT6tjjdB4Kd2DuSEOt0PR/3EezrauWJWXmh/1JAVwI8Z4Y:btgyuS70PRseTXmieIw4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745201, "uuid": "83be1262-463a-49d0-898a-c0ccffe2625d", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745201, "uuid": "311b50b0-ec69-4ec4-9035-6f4add5fd35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745201, "uuid": "aaf12922-cd1d-4e57-b036-81c3103776ad", "value": "53060033570_20230522_08055750_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024aeb31-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752432, "uuid": "6f4b5e33-f666-4ac2-b389-b147097003a1", "comment": "Malware payload (RedLineStealer)", "value": "8d3134cc5ba7f2d2b9df2cc4abb26191", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752432, "uuid": "39c81e7d-63ce-48b7-89cd-66e078cc071b", "comment": "Malware payload (RedLineStealer)", "value": "9f1d7732152a5a412a91a2601d27f22ba1e301863962eb8f14900a3c01afac84", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752432, "uuid": "de811c96-17b2-43f7-9c40-2b89edd48056", "comment": "Malware payload (RedLineStealer)", "value": "bbc8978eda2f0e4d9ae0389cdc711692c2cc1ff3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752432, "uuid": "39066c2b-2ad6-45e9-b9a6-9cf8aa99f65d", "comment": "Malware payload (RedLineStealer)", "value": "1ee8266f697704111365bf27c8e29b57bfc3e7ace598f4c924d6b2be9cc0e27961e52a115643392a904b408af51d5981", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752432, "uuid": "856df721-348f-4a91-8643-114a8ede7e77", "value": "T1F5252343B6E84072DCFA2B7458F603D31A36BDB249B0576A3706DD1A0D325D0A93A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752432, "uuid": "9a45c99e-a800-48af-93cf-08cc805aa12d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752432, "uuid": "980c0981-63bc-4254-87e7-9d2e39805ec8", "value": "12288:0Mrly90nMfJoZiauVYE4TyUSRqbVxxYvTtEbyqMyBMeV0HylHZ9d7A0HaFPygWHb:RycSoZiaPiqOLP0M/HUHThA0HaR0L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752432, "uuid": "b14e0015-5058-4e28-a9aa-655e3d7ca7a8", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752432, "uuid": "013e0193-5ead-49aa-92c1-a174e7cdb8cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752432, "uuid": "854f7c7c-4cfc-4e0b-b663-7960f8ea5cc0", "value": "formatter213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d43915-f879-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1684743491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743491, "uuid": "aa7722ee-cca8-4be1-9487-585c21acc9d9", "comment": "Malware payload (QuasarRAT)", "value": "415109dfdbabe14f33006a965311095d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743491, "uuid": "0ae1daeb-2e54-46a6-ad71-e56d08b57089", "comment": "Malware payload (QuasarRAT)", "value": "9f788e07cb6b288c2650fa817d823425dbdfec3476a4683718ba2f351e9fa8b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743491, "uuid": "f3731435-b418-4c24-a51f-36ef1129ebab", "comment": "Malware payload (QuasarRAT)", "value": "72f34daee6c6698b0b9114606a0a655bbd67b7f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743491, "uuid": "dbccb26f-b24b-4842-b2f4-b75a31a92ff4", "comment": "Malware payload (QuasarRAT)", "value": "7e270478296fca26d3b6eca4c4c9410062380b22b4dcfdaf165982ef24dbdffa51cc14df7bf3cfa83a44879693b38896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743491, "uuid": "3b7ec03a-387d-4ce9-bb98-5b8064cb788b", "value": "T18426338DA0247BE4C7206A3EE083B7F753195DED6D43DBCBA28D31945FA0FA71254286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743491, "uuid": "3e2d6f31-4732-4446-8d75-2430451743c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743491, "uuid": "d1274ebf-c8f1-480b-a98c-a1509acc933a", "value": "98304:7mWIu/4ALu2Cy2n5D4vqwfuEgjl4tMVrXDcUGPF9L0IU6:KWiAL+nK9gjl4tMJIUGdGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684743491, "uuid": "16a3a6c3-08c4-493f-8bd2-f856407f7e5d", "value": 4521472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684743491, "uuid": "b3edf2fb-51fa-4f5a-926c-62c0390c0b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743491, "uuid": "1f016415-a95c-4bf5-8e92-a49e30950365", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0420fe51-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684736973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736973, "uuid": "d5a8be80-71e1-418c-a045-403edb1b6cbb", "comment": "Malware payload (Loki)", "value": "05e82dfcde63a55446cf855bc4639218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736973, "uuid": "5b5209bd-9f0d-4976-be7c-963e20fcd570", "comment": "Malware payload (Loki)", "value": "9fb34ea7f261881a74fc5e2b25f1ecf329c16430c9fe5942738d71d0223ae046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736973, "uuid": "777c0e14-ab60-4a23-b814-eb00737967fd", "comment": "Malware payload (Loki)", "value": "9c7e8954695879bf723eae098f8dc7b29c8cd4ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736973, "uuid": "cb0fa57d-6f86-4bcf-8a11-2ba4b0891913", "comment": "Malware payload (Loki)", "value": "d4d8b5904cae485e66c1ec63f8ee4b7b53f6ff76709b58c0440a4245c147e0749284b3106a792df4ccd1f937e8763ed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736973, "uuid": "2055eaa4-354e-467b-91da-2e1ca75134da", "value": "T1B8D4E0D126889C55F59B5FB919B3E63442B96D61EF27C30E24F82C9B7C62A813B007C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736973, "uuid": "ed249e42-cf4a-49dd-8cd1-dd8c26e66f3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736973, "uuid": "0c126293-05c1-4649-aaf1-cb6285265830", "value": "12288:tThx0YPX/NqPsx6ALbemViUlS30mCu1Qn16gMBIB95A7tMi9BD7PIj9:tTkHPsc8FwUli0mCZ6zBKSza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684736973, "uuid": "37e9d555-d08d-4b17-a9ca-e6dec50a6b56", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684736973, "uuid": "56d0c4cc-6d5d-4f1a-979c-3801be329f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736973, "uuid": "1a8f904b-c634-4581-8124-551a557c802e", "value": "SecuriteInfo.com.Win32.PWSX-gen.7319.23355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cfc909-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752458, "uuid": "8dd90957-63a8-4a0f-b128-913aa36d29a6", "comment": "Malware payload (RedLineStealer)", "value": "38b6b8f24ec3056ff817b7bd02996b61", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752458, "uuid": "ac34d7f8-6210-4b13-a661-08ce51233bbe", "comment": "Malware payload (RedLineStealer)", "value": "a0735c5503d93f43f7df783896453c3258df49dbf00299ca40b5d5b4c2d3bd00", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752458, "uuid": "1ceff3d4-276e-49e9-87d7-b2d1b59f0d84", "comment": "Malware payload (RedLineStealer)", "value": "e83e5b156f9535c91bbb3b10d904fc49924f3f86", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752458, "uuid": "8a48a946-7f7a-41fc-ad4b-390b3f31f654", "comment": "Malware payload (RedLineStealer)", "value": "c71126aa43027fb1d12b835b4409994cbe6800372deadfe767183bdcfeb1313ed2f7bfc184d937b8f4d0cfe0ea4e48b0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752458, "uuid": "cf7c8fff-b95b-4d49-aa6c-56fc6729a61a", "value": "T1E6252253AAD88033D9743B746DF706C30A36FDA08C39C32B375A466A9C6798265B5733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752458, "uuid": "8d4444ff-ea51-47af-9c23-653cef92a067", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752458, "uuid": "d5cea961-176d-4701-ac02-8405f1e3454f", "value": "24576:ay+pq14eqUXQlrNGlBgZqdVPWU1Q+1TTimMQ6A:h+g14eqU2OBgZqdVPW/+1TTiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752458, "uuid": "fc34a56d-50a9-4be9-bc86-8dc086e921c3", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752458, "uuid": "e7163ebf-96ff-4a2c-b9b2-03f64e47a9a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752458, "uuid": "2e711d4d-bce2-474b-aae8-e3504992c0bd", "value": "input998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2bd477-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752291, "uuid": "ccef7d53-42fb-48ea-92a3-9df56340f9d6", "comment": "Malware payload (RedLineStealer)", "value": "553f91585150c6746b70e41d4f13e202", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752291, "uuid": "8edf5c98-a45c-42f2-9fae-a735cf12bbaa", "comment": "Malware payload (RedLineStealer)", "value": "a13897312882ce1a42e66e36cb958f51419f95eca7f9d91329b4700654e29d8e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752291, "uuid": "de72f359-e474-42cf-bb02-492703a9a103", "comment": "Malware payload (RedLineStealer)", "value": "2e9bda05e8e994584ca2710141fe533faea55563", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752291, "uuid": "1cb59d8e-f3a5-4117-b623-6ab0d3c4c69a", "comment": "Malware payload (RedLineStealer)", "value": "e8bdf46981c368223344b30a080a8dc2efde564c7b1cfa7b040a0160ba3de2eeb5d017592e6ed276dc8b0a6fe2d4c42b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752291, "uuid": "786a5a4f-f5f4-4eb8-b34a-4824dbbc5f54", "value": "T1C2252313A3D84463EAB45371A8F7439303347CB2DB6586AF3306AC6A5CB35806D7677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752291, "uuid": "969273f7-143b-4674-a9ff-5acb28e91a2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752291, "uuid": "5f2953cc-aceb-4950-a4d6-1b4ce6a77df1", "value": "24576:Xyqk0YrClq9qumJlfj9lqD6WrhyM19mBX8j20JzcXJ:ir0Yr4q9qumJNj9zWr9UBZ0JwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752291, "uuid": "cb6c9b68-37f3-4c90-a95f-b8ea0b74b44a", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752291, "uuid": "a28cc22a-d23b-4715-bc2c-425d096b3ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752291, "uuid": "de14cfb7-3353-416c-b857-33bfafc71ba2", "value": "AdminCrack157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190ad26a-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752470, "uuid": "354d224e-7ecc-4f6e-9734-a1363523dda7", "comment": "Malware payload (RedLineStealer)", "value": "1d29fbb38c605790e6c188fd9b0ada0c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752470, "uuid": "e55cd6fa-9fd9-4f46-85a3-14c0e3f80711", "comment": "Malware payload (RedLineStealer)", "value": "a198015aecb39a2269225bca085682ceadf89622db4aa0714454cbafebb417c5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752470, "uuid": "0b18a1b5-dd2b-4df9-9668-0542f9d18777", "comment": "Malware payload (RedLineStealer)", "value": "81f72adcfbca97812dc1845609cc4a775a36a100", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752470, "uuid": "5403eba6-cd62-4e6f-826c-b4a12f97f930", "comment": "Malware payload (RedLineStealer)", "value": "f6b1939c6c5ea1e2a2e64cd88d071b3f68e49341156c9e2046a933a498ca93c0324dbe26c6d983829b4e89b2dbd3dabc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752470, "uuid": "5f62ba6e-3b74-492b-83d8-bf5c0eba57f7", "value": "T1CD252282A7DC98B2EEB03B341CF212531A35BDE15D38C26F6759986E0C72680E5B1777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752470, "uuid": "a1a2851b-ba44-40e5-a084-5de24572bee1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752470, "uuid": "36f0cc79-83e2-4200-a974-0b0b823d45d2", "value": "24576:9yMj5poxufcPlEdqCZUxYcwHeNcKiuVWc59yUGTtcTo5Z:Y0pgjjC6YcAubGTKc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752470, "uuid": "3bdecf0a-3976-4ea5-9b21-c62fbd54c58f", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752470, "uuid": "dacac7bf-cdf8-429c-834c-e30f9105a00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752470, "uuid": "99118ef9-a0ed-4c9a-861c-6650eef71071", "value": "islauncher955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49c965f-f8f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684798661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798661, "uuid": "61351228-dbca-4e76-9a38-c690d8fb7f81", "comment": "Malware payload (RedLineStealer)", "value": "0ff53a7a19c5a066ba3d15fb42a3a323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798661, "uuid": "632a94c8-509a-453d-8765-2bbf9b10a245", "comment": "Malware payload (RedLineStealer)", "value": "a1f32abcbe5dd6841a620ea0fcbd1fe03cb94fbb129098657fec6e1ebd1abf9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798661, "uuid": "85385c06-3d21-40b0-a8c7-f744b97a095f", "comment": "Malware payload (RedLineStealer)", "value": "5065603fa35d32bd68f927cc524f831097426e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684798661, "uuid": "f6b00844-1396-4f4e-b15f-8b1bc84ca60d", "comment": "Malware payload (RedLineStealer)", "value": "99ae35351d074c36b939c81d1ccfd4ee5e409fb4fd02e353b9ec21baf2e7807658c15eecb67ac72984591bedef3202e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798661, "uuid": "82e38ecd-e2f7-4678-a177-e5ff2133364f", "value": "T10D94025825BC5B63C9EF4BBCB491948107B4D3BBF023EB590EA935D61C077A08A153EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798661, "uuid": "60e80b72-9938-4de5-8409-972a79a5e8d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798661, "uuid": "9ee4e6bf-9df3-4a7c-a94f-d31c2a23ac15", "value": "12288:Th6wGbvuvkxWs4LF+JPK5IjFBAQat0IpG:kju24Lo5qIZGQS0IpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684798661, "uuid": "4557dbc2-c53d-41d4-ae50-456ef7b84a0c", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684798661, "uuid": "43826a4f-49d2-4369-9a19-045c38458037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684798661, "uuid": "401f52fa-fabe-43df-af02-a6d4aa2609a7", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.2919.7.17251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31387e9a-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737478, "uuid": "3498e5db-2c9f-4d60-9e9b-5098b57c88b5", "comment": "Malware payload (Amadey)", "value": "6e3daf772a505ed863edc4457a4d47f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737478, "uuid": "8872326a-722e-45b1-8e4e-a5ff6364c0e9", "comment": "Malware payload (Amadey)", "value": "a202914c969c3cf2f219c5b095669d6f3099ce22e91cd29dcdc5b899895dd14e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737478, "uuid": "b2838eeb-f93e-40d3-967e-84b535e1cac9", "comment": "Malware payload (Amadey)", "value": "69552717cc93cff9d0533ad6a6cfb20aafd79557", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737478, "uuid": "8e10ada8-58f6-49ed-a815-ccf2ff6cb466", "comment": "Malware payload (Amadey)", "value": "6d264e233968b76df93effdcaadf01f16b6a3b9e09cef037f21f7434371721ff360bfa7b3c6450982a5333b428249fd2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737478, "uuid": "c23aca22-c2e7-4d75-ad16-587d85b6280f", "value": "T1C6252313A1C45163EEB0673466F646831B357DA18E7887AB378AFD6D1C32994A833337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737478, "uuid": "21902bfa-346b-4ab5-9e46-be1e3fc88ce2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737478, "uuid": "0249a824-8ac6-44de-b759-c6fcee30cb4e", "value": "24576:Iyzg7k5T5aWGq4OOnEMm7kprnFI5fECtqWt5VPIrRyBhCg:PZT1GqKE17CFsfECqW5I4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737478, "uuid": "1b812b27-d0be-48d7-8458-c5958618f474", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737478, "uuid": "306abe51-ffc9-423c-9da0-32d87984568d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737478, "uuid": "79b42b66-ee86-40f8-bb81-9ca381e51501", "value": "installer351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e451f092-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752382, "uuid": "f4242773-d93e-42c8-952b-71c56928acfd", "comment": "Malware payload (RedLineStealer)", "value": "4be9e77115a4a95df8863aa2138785e3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752382, "uuid": "ca83cc1d-5381-4cd5-9309-b10afbe28125", "comment": "Malware payload (RedLineStealer)", "value": "a252c67cc6e35b18f72a1bc3e79e9d5517c670486604f0dee82ee21b84971fce", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752382, "uuid": "b92e363e-c0b6-4432-9018-46640bb29ee7", "comment": "Malware payload (RedLineStealer)", "value": "e7c4a71c4fb6b3ad6690f45dd7904940c4526d17", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752382, "uuid": "f3dc6d09-4458-49d6-bceb-8573e6730c4e", "comment": "Malware payload (RedLineStealer)", "value": "ef8d499cd45ce50bd72322d68d3d6d24007eaae5103e293d9cb8ebbcf58cd4ceaa46c86f2eb773a1f2809d9a773aec8d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752382, "uuid": "6a962055-889c-46c6-804b-7a5bb9dc9b66", "value": "T100252313BAD9A471DCB91330A4F302431B35B871DDB4A37F36889C695972A84B472B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752382, "uuid": "fc7e3cc6-d418-4a98-b98c-6b66d12076f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752382, "uuid": "38ecd339-1d7f-42b2-8ac1-c3406fec85fa", "value": "24576:tyXLEnrHPq7/sxg4EEUP3z0Hijovhw9wU5pW9l4+KIiH8r:IbETPq7Y343wHiohwOULai+KIQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752382, "uuid": "041d5b60-6e70-4250-9bbe-fce6e26bb61a", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752382, "uuid": "76d707aa-d191-40a1-b4dc-4ded77892303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752382, "uuid": "78b67802-3cc8-40b1-855b-abca04729dfa", "value": "controls970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f10751-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684762590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762590, "uuid": "6685e28b-11ed-4a7e-9571-3536d2cc3705", "comment": "Malware payload (AgentTesla)", "value": "7464e1a2bbdcee9d1324562febd8f59a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762590, "uuid": "4bba4288-e80e-4377-a536-47b7854e0304", "comment": "Malware payload (AgentTesla)", "value": "a357b85560b1159abbca744e8226315663cfa2d3778046eaedfe82dc293446e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762590, "uuid": "18d83f1a-12c8-4ffc-96e4-9e635253cdc0", "comment": "Malware payload (AgentTesla)", "value": "6bb7ffa801ed400229ca2f61716add7cb4c4fd25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762590, "uuid": "0f610cc7-30bc-4558-b4e3-143fa877520e", "comment": "Malware payload (AgentTesla)", "value": "bf7bf8c1a74b2dfbba42eb02e0b2f6bcbc6dec5cae5c071381706af8139214e72e3b00034b85abb44658f92b423b2add", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762590, "uuid": "22c6f87e-6a37-4b26-84e0-5db10ece1752", "value": "T108E48C5633B47621F47E73FD01156388CB39B04A2022E26A1F963AD552E37EB770A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762590, "uuid": "6fcbd489-7532-439d-9de1-ab12b83de28d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762590, "uuid": "a6db3ecb-a7b8-430b-ace8-63716ceef62d", "value": "12288:5vV+s1bSQT6tjjdB4zM1uPeh+OjJHmmDn47+8ROm83CCOX/+8qcCaur+KvQ:5thOuPefFHmmT4754e+2Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762590, "uuid": "6a1fe70a-9c85-474a-937a-a940059cf509", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762590, "uuid": "cba2928c-db04-4070-aed6-4c540ce51706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762590, "uuid": "30d2a4a9-0513-48a6-b055-ebb6d7dc2f82", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6749083-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752278, "uuid": "02d83baa-a1c3-4f77-b371-ea20b12c914f", "comment": "Malware payload (RedLineStealer)", "value": "2e12885c16dae4e487efb1ca8fbcb2b4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752278, "uuid": "97b1557d-2366-4bf5-a61a-66b35784e2b5", "comment": "Malware payload (RedLineStealer)", "value": "a35e6f8dedc471d6686eda7379cba590dec5fc82cc1ba26ae9ade90871f3088d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752278, "uuid": "8cc5c5a9-77fc-4abd-b9f4-b633fb6e475a", "comment": "Malware payload (RedLineStealer)", "value": "6d569df1992a4c54c2416ba23d1b5c02cf0297b9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752278, "uuid": "fc379576-4dcc-4d63-bd3d-80363ccf5928", "comment": "Malware payload (RedLineStealer)", "value": "46d4f032ec30f4312dc29420d0cf171b2cb2f9fef43cd98b565db91ff341974c6f655e1aa7edc92105f77b9b5272f1ae", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752278, "uuid": "1f7bc588-50d7-4a5a-9a5e-8bf9a617fd6e", "value": "T17525230766E81493D8B437F1ACF24BD70E39BC945D2482263746A19F4A73AC8E8717B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752278, "uuid": "3dd08260-2c6c-49fa-84b9-287c679eeed6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752278, "uuid": "c76e82c1-3594-40f6-b678-8a8132342a23", "value": "24576:HyxasenovhxIDB+GGq1KzpCZa1MZPkhmbrpuV0U:SxafnovUDB+GGq6YZa1MZPembM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752278, "uuid": "9990ff8b-5082-4e3e-b75c-07ca62ad7eaf", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752278, "uuid": "1af2c0d0-7951-420d-9519-5124342cc073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752278, "uuid": "592ec5bf-2cea-4a9a-86a2-3fba39dd07d0", "value": "66234483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd8c8cb-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752072, "uuid": "b81d3010-1e64-48d1-85eb-829b2b83ea70", "comment": "Malware payload (RedLineStealer)", "value": "b7fab01f12a9185c1a93ee9c99fa8617", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752072, "uuid": "464a819b-49eb-433d-8ff3-8201ba264956", "comment": "Malware payload (RedLineStealer)", "value": "a41801e10b9f65a3ca36344133f57290e1f8242b173ccaf25c8912cae804efa8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752072, "uuid": "64df5386-9fbb-4937-b3fa-7df197539dda", "comment": "Malware payload (RedLineStealer)", "value": "f229bcdd3190b72826921ae820845ad8d1f2f367", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752072, "uuid": "bdacb1a0-68bc-4673-8ff8-a1a4192e795d", "comment": "Malware payload (RedLineStealer)", "value": "6ecaaf89e1a8a094805449983d4d46833083485474576f43a6c4af8b7d878275be3c5bfe2155fa669edc151418085b8e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752072, "uuid": "5d79ec50-2709-43f2-a371-4d022c4a87fe", "value": "T1B4252351ABEE3072D13437B069F501432B36BDD28938E3AB161596FF5D726C8A131B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752072, "uuid": "d90e3459-d71f-4eac-a1fd-a20039054e44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752072, "uuid": "5abd329f-e52f-4ddd-9f2e-6ff84d53c347", "value": "24576:RyMWCRMmqLYLvJkOz6W4TPZuP3374glUztvM:EtmWuHzNP3rPUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752072, "uuid": "9f9e9619-4aa3-4482-b794-470262bd5694", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752072, "uuid": "bf110345-d4e5-4cfb-9dd2-dedd2902440f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752072, "uuid": "5dd921e3-71d8-4ae9-974c-772cb76f9d0e", "value": "viewer730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283dd08b-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752496, "uuid": "56ec1f05-a600-4bc6-b305-8c5d7320feac", "comment": "Malware payload (RedLineStealer)", "value": "1df1ec960eed2823844a67e16f7d7f74", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752496, "uuid": "64b52517-8f96-4e60-9bcc-267c24d9f62e", "comment": "Malware payload (RedLineStealer)", "value": "a41fcda8b58378176bce968f0132c674fbe347db556838e62f96a6490937f7f1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752496, "uuid": "7fda331c-1413-4e66-8ab3-0db5254029b9", "comment": "Malware payload (RedLineStealer)", "value": "2613426b7159b5d0931290f8702282e392b870cc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752496, "uuid": "b9c1422b-bb63-44d4-b156-0faec459d658", "comment": "Malware payload (RedLineStealer)", "value": "77e93bf1b51faa122442b99bd5696a5fbd9e8ee8742ecd016884d4245c0e86668c239099addc23e0d515e3a3eeb0dc74", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752496, "uuid": "b060e01d-7434-4f52-bb44-49c75baa837c", "value": "T18C252313F9E86161E6B83B7098F311930B36BD909578873A37567E5A4CB3580B4B27B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752496, "uuid": "cf257f54-c322-4348-b670-5f37ee7f676c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752496, "uuid": "d68442df-1d66-4b0a-a38c-7399a4339009", "value": "24576:uyMzuYPkrYkZn/7qEli91/w2w6atbIi3Z03H1:9y2Y+n/7qH/BwpIi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752496, "uuid": "06caf75c-ecaf-4b82-9b06-9e21ddf0b2e5", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752496, "uuid": "cd4c8a98-f0bf-4cf2-8b59-d9bba24b4cc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752496, "uuid": "56eed31b-94bc-401d-b6a2-bd39dd2f84b2", "value": "multiplayer620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac79b514-f869-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684736826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736826, "uuid": "cbe790f9-7319-4c67-ace0-6a5bb8206533", "comment": "Malware payload (RedLineStealer)", "value": "2bb40aa5ed7f4f917e25ab0e8b926323", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736826, "uuid": "56035b43-d6fa-4c72-879f-0174e5d82ec1", "comment": "Malware payload (RedLineStealer)", "value": "a4393ba12cfa039c7515e7ae13aeeb8ff87972a9e5d8ad63f9290a388ac5dd26", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736826, "uuid": "7e8e3f83-43d6-49e2-a39f-5e715c67f72d", "comment": "Malware payload (RedLineStealer)", "value": "223336f8f29825d2de61d35f21c9aa4dcc8b67e8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736826, "uuid": "5d13b518-9a02-4df7-9c5c-12b04dcc11e7", "comment": "Malware payload (RedLineStealer)", "value": "72e3482f84de4851a3e051fc592649b5e7cbc206ad7994c04e177f544731d44c4da3901064f8767a7e6c6dd347eedcb6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736826, "uuid": "29938cef-7467-4bb9-8d29-2d5b2f3af8b0", "value": "T12F25220356D801B2C97423741DF226931735FDA29E79673F3359568AAE32AC4A832377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736826, "uuid": "64fdc341-da93-46b0-9123-a6218af59c3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736826, "uuid": "752039ba-876b-4ee0-9e6c-f8368f71c188", "value": "24576:Hqy2cZwIrzvYuWNPsckqfqAbdbnLZ6PuDY6gLzJj/Hng:HxnZwyTYn1kqfhbdn9YuOjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684736826, "uuid": "a8aaf0fa-85c2-4a36-b099-42afb6d1446d", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684736826, "uuid": "0e0d0540-4d06-4a90-90a1-1e335eb834ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736826, "uuid": "9ac370ff-c3b5-4c07-aa28-d4c8a15c7548", "value": "234563230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52f7c10-f839-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1684716198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716198, "uuid": "e6e27f26-3464-4576-a96e-f1c46e635de1", "comment": "Malware payload (LummaStealer)", "value": "6355c5f8f98ffd7042a07ed616a2bb34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716198, "uuid": "c0fcd96d-38c3-4e9e-8b6a-dacef805fd73", "comment": "Malware payload (LummaStealer)", "value": "a4812a7dd2dd31471e590d7a45ddc945dfbd646512a048a39383427e8ea885cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716198, "uuid": "2f6c6db9-c878-4dc5-95fb-4ff3d60eb8a0", "comment": "Malware payload (LummaStealer)", "value": "c10c4de037d7c0aacce0acfdd02f012bff7233da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716198, "uuid": "ebf97bb6-25f4-43dd-ab8d-ddceb0edfa3c", "comment": "Malware payload (LummaStealer)", "value": "923cdf41beba863bf41529aab1e7cb4f04c47b680e1e39ccbfe3c2039578d653dfe1adbea303953208d2cad312745f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716198, "uuid": "ed6b9dd8-b696-4998-b807-146ae3187824", "value": "T10026338365E5D8B2EA291D38A859FBB43A7DBC101F21E52BF3E408788535190F925F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716198, "uuid": "f5381694-871f-4bae-8a63-df9ab8f4cf98", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716198, "uuid": "0b9d8042-d928-4ee5-9fab-14922309922f", "value": "98304:V5OVT7lWSbmaQ2MRiRJsXmFb55E9SRoy6biRmUgCOjzO8Hoh8AqZ0:VQTzmaQ2MaVFbZyHbWWvO8HoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684716198, "uuid": "dc31640e-cdd4-4047-a8c3-8ef6b3107035", "value": 4653585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684716198, "uuid": "449f1362-ed35-4602-a939-49c767bc6d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716198, "uuid": "62bb97f2-2e5c-4bf4-9912-bcaf05058177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e56e2f-f89a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684757723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757723, "uuid": "91d94fc1-df44-4eaa-9279-81f6e51feabe", "comment": "Malware payload (Amadey)", "value": "4174ea5ecc6d8fe446ce6eaf02c08ebf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757723, "uuid": "ebabde26-5d0b-4e18-b013-1b88e60921a2", "comment": "Malware payload (Amadey)", "value": "a48f450ebbc653762f03936bd10d3398e88c3fd7809dbb5fe13aadf21c105ad8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757723, "uuid": "4c844dc9-1764-4947-af4a-07633321a566", "comment": "Malware payload (Amadey)", "value": "ed5e7531d5264bbf193e52410421961c6631c317", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684757723, "uuid": "143ca1c0-0424-4935-9adc-d108e82fcf1e", "comment": "Malware payload (Amadey)", "value": "62059a35aec16278d17455c3071ffeda27a18cb2d88c189327b8069b8935ff8298d3a5d99eaa1ecd139317271b78fb79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757723, "uuid": "9399dfde-c87a-4648-80ec-96b18cc148ae", "value": "T1852523077BE44627D9752B7428EF03D30B32BDF1A960825E2A8A9C5F0D727D1643672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757723, "uuid": "dc0cc310-a877-475f-9bbb-ec5f01862487", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757723, "uuid": "f13a6837-1b33-41a9-b842-b39b325352f4", "value": "24576:DyVibxeT8xB1mGIIuvjHsN6sdEetE21ecns4PYS70jF:WsYT8Lk6fEGgSgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684757723, "uuid": "349e4eba-8455-4d80-bac1-b7af0e964b41", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684757723, "uuid": "e92a869b-04fa-4e44-9c90-f60eaa71e1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684757723, "uuid": "86f0c281-6065-4bc0-84e7-290ffdbf7a0b", "value": "4174ea5ecc6d8fe446ce6eaf02c08ebf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bb4446-f861-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684733139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733139, "uuid": "9dff1295-3c63-4dd6-9e24-8450e690698f", "comment": "Malware payload (SnakeKeylogger)", "value": "cae8e8b3431af81b67b15cddf00d5f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733139, "uuid": "094eb73f-38ab-45e9-8183-78b72c9a56f8", "comment": "Malware payload (SnakeKeylogger)", "value": "a4dffafe8e9d8505fb3090abd8f1d7866b8cae7e7b572b569ace6fe5cafe398b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733139, "uuid": "efe3b3f8-9f6a-4a12-a994-615837b15b19", "comment": "Malware payload (SnakeKeylogger)", "value": "a7d038b64330f0a54d42bee4ce87c4e4a3783a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733139, "uuid": "bc792c99-0e5d-4c59-afd5-2e1a518b63aa", "comment": "Malware payload (SnakeKeylogger)", "value": "ab326e70d57ab4323a68da1a718bbe197b1969a9018d2360f1b16a1c6188b87416b783e6658f306ac01d9ebedfec1398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733139, "uuid": "b900a787-74f2-42a4-a76b-ff7c8de70d81", "value": "T1CEF2C7213310C2B3CA684E76D84B4AF00975DD52EB14963B65C17F9EBD723B05E329BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733139, "uuid": "a7021e0f-f99d-4e7a-818c-a06e6e011ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733139, "uuid": "8a037e97-4530-46aa-9ce1-e4cb150c1ae9", "value": "768:2J6T2ty3HnXAGD0AO77QlFECqpixGz9ve4:w6T2ty3HJDlCG+/paGzg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684733139, "uuid": "c8cbc966-1fdd-464d-8b8d-80d8ca3f7277", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684733139, "uuid": "bac383e7-9f7d-4cd5-a824-286d97060e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733139, "uuid": "01e0d2fb-fb90-42eb-8434-759f7d7ccbe7", "value": "Sevfxxjil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96044756-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752250, "uuid": "f5ecedd5-8eff-4618-8056-027c245afd5e", "comment": "Malware payload (RedLineStealer)", "value": "38ddaf5d90615a3cf386d157cfc064d1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752250, "uuid": "f24a9254-a0fc-4969-b30b-b8bbd2d53390", "comment": "Malware payload (RedLineStealer)", "value": "a56a7c5b8208e8b37d6143b4122ffb18e052afda33b7c04e1cd2f45e90d43fe5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752250, "uuid": "6a4eb4fe-cb91-40c1-ab9f-2f6623596376", "comment": "Malware payload (RedLineStealer)", "value": "4ccf2ed1d6fed75eb8e34d9cbf22d41d0a06d3f1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752250, "uuid": "face0081-9f46-45be-9104-f07009194974", "comment": "Malware payload (RedLineStealer)", "value": "c51a7465959e2b393468e1de8d72004bcada719b644a1798bc100d66574517f8c01fbc7a3280b0489244683eb6187292", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752250, "uuid": "27cd65a9-acc2-459a-8873-b95c7e5d04f6", "value": "T101252256F7DD9833D8F467F42CF602931E76BCA24A6483AA3B05889F1DA16803974377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752250, "uuid": "8c97b044-2783-4a07-89fa-cb1c29ede2b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752250, "uuid": "d4fbe75a-346d-4697-aa64-dde4754d666b", "value": "24576:Cycjh2Hl7V6KdpBTRp7ObMA3zSdfCUbawa7Lkn79Dyz4oOApasiCdjSg:pcAl7IKdSAA3JQa1kn7ZBAE3Cdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752250, "uuid": "2e4b349c-0e22-4475-b81a-2bae2d6f7ec0", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752250, "uuid": "aa452569-f020-4a71-91f1-8146a08a6332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752250, "uuid": "8ab743ff-b02f-4cf6-b669-35c2a03cf793", "value": "35677418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f52d4f-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755899, "uuid": "ffafe508-1200-421e-9f98-9ef9f2e6774b", "comment": "Malware payload", "value": "d041550aca82d6ec78ed1932d692c9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755899, "uuid": "b514e146-c172-4360-9225-0f51a42e7a8f", "comment": "Malware payload", "value": "a5e5deb43880a6aba41d55f29cad3b77814ede081201ccdca424beb1387de127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755899, "uuid": "0048dcf9-934e-46b5-a3ed-6af8e8b38161", "comment": "Malware payload", "value": "f9577918855baa3cefb9bd496df78f1c72508a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755899, "uuid": "97d982f7-cd57-4073-af29-5b387f791bff", "comment": "Malware payload", "value": "c1250148515f2ab650e7c59c2119049bb7f1331738d6699e490da0fd93cbd4bc69d7efd684ffa8f582edbe6fbe22ff40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755899, "uuid": "70dbd5ac-c2c3-45d1-90da-b01b3d6f67c5", "value": "T1C285BE32A5A2C8BDD5B221F29A37563D09E9AF004B6707C767C0FE1E65706D1993B30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755899, "uuid": "4b7f18a3-da14-4cb3-ad4c-ede53d02e594", "value": "24576:NX+QuepLMMriPhDTzkc70hIazDcfzRNTL+zPf18Mscb3alWTCq:A8aD/cNzo1NWLCjaKeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755899, "uuid": "b568ad2c-82b7-46f4-9e88-cec77d83a521", "value": 1794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755899, "uuid": "f022d18c-aaef-4187-85a5-baee47042ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755899, "uuid": "f2f83f0d-3e66-45ff-b404-212926409c27", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.15587.17147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f6ccf9-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684763095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763095, "uuid": "12b72133-259e-49f8-8f0b-76b54340d8f2", "comment": "Malware payload (AgentTesla)", "value": "f5e079e4631b933e659d2f09d19693cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763095, "uuid": "dc7be491-04a8-4651-8442-9457ed82e7a5", "comment": "Malware payload (AgentTesla)", "value": "a62d9307bbcf6c6a1da2a346c9c53a1354d6678d960d2641469ddf2e8fe3c758", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763095, "uuid": "be4b2e6b-7b61-4c69-923d-dde3834e97ac", "comment": "Malware payload (AgentTesla)", "value": "ef6546b1a69589914547dff90946b78058bfab7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763095, "uuid": "96e292b8-4c2b-4bc6-a50e-d534ea0d3fcb", "comment": "Malware payload (AgentTesla)", "value": "924a852fe9b4dc631195a44946d59e8510ebdfea3116842fa0ca9ca83742041e98ee75e568ff2bdd8092703d506f7670", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763095, "uuid": "534c30d5-ddaf-4081-8a2d-e6578a25dbde", "value": "T1E4E4513C2CBA15E7C438FBAE96D160F3B52B8D23B74F8A6500C347267A6692177C251D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763095, "uuid": "d15675ae-4c4b-4eaf-b869-812e848a4639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763095, "uuid": "1e377037-e047-47d5-a76c-4edbcf3e8b57", "value": "12288:DZhfr2FFcntilDPpZ2LomiwgNqSmc1pBWMm:DyDxPpsL+Nqh6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763095, "uuid": "ea1d3726-171a-4d0c-b5ed-682453328f17", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763095, "uuid": "dc60cc65-fc23-458a-b0a3-4fc4c4ef7f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763095, "uuid": "1459f01d-2ad2-4171-bd59-674d9083c9ca", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794e2cff-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744901, "uuid": "acf666a8-16ec-4ec8-80cd-e585082ebb28", "comment": "Malware payload", "value": "e766a0ee2ff61170cc5de479d889e07b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744901, "uuid": "22d72c43-ff1c-49e2-948f-c37d7b7ef1b3", "comment": "Malware payload", "value": "a66f31ce69972e40c94f0d544791430d784a7f9c42db9e68c4d253fdd219bf00", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744901, "uuid": "a5dcb5a8-8431-415e-8331-a90e85a0dc96", "comment": "Malware payload", "value": "560eaf9d4cef0fc9b3ce12f2ec1212c832e686be", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744901, "uuid": "bb286ed8-9aac-456b-b77f-fabe4a01c3e0", "comment": "Malware payload", "value": "f37b34a236f47c966b2686113440898f09be69b6ff107331f7edeeb33ba89037f2ad36270b1d3d5993e8d898e10d9cf8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744901, "uuid": "89b196ac-eab9-492c-b560-f140442c64bf", "value": "T19245F012D648AC8FC28547B16B4B7898621E7D36BAC85647370CB35F1FF3AA5A913C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744901, "uuid": "e8895d37-46e6-4932-994b-3ab78da5382d", "value": "24576:fLKC/wA/dQmQmz+MXUh+MXUklYk5YuxoNXXXXXXXXXXDXUXXXXXXXSXXXXXXXXPI:fLKU7h+MXS+MXdlYOaT1BU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744901, "uuid": "979fc9a4-dc0e-45aa-888f-40cbfac908c0", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744901, "uuid": "17e0f37b-c977-4d0d-b367-c10ba27289d2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744901, "uuid": "7ea84f78-0eb6-48b0-871d-f3c2465d358e", "value": "SPL242523535252525235.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40b90db-f88f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684753160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753160, "uuid": "c2f41249-935f-4638-8248-354e04578fc7", "comment": "Malware payload (ModiLoader)", "value": "d0d4bf07341ea6a0ba0eb6452b9d9553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753160, "uuid": "516983ff-74ce-4d5b-8434-3730abb27ed1", "comment": "Malware payload (ModiLoader)", "value": "a7a6e2c9ad03dd090858ddc054751485681b77bd24397ad8e87218faa940f4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753160, "uuid": "a71304ac-e9f9-4825-b218-e79ac1b313bf", "comment": "Malware payload (ModiLoader)", "value": "401c57666e38906f0265665ec20debbed6e520f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753160, "uuid": "980aba12-df37-404c-8170-8d2a4ec0ce4e", "comment": "Malware payload (ModiLoader)", "value": "81c167725a2daf9aa75d543d79db64588cb1695ab1e6b1b630497287588a42d216b4f792639455f11b54753da1cc4ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753160, "uuid": "e1162422-3871-489b-88d8-a6ae08dfa17c", "value": "T1A8058E23A3E0C877D5A72636CD0BA374B4AA7E112A546C4AEFE91C4C5F34741382B1E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753160, "uuid": "f9e9653b-c558-4334-9dc1-c6622b32e51c", "value": "38133f6236637d4df7998af089e91f7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753160, "uuid": "05c473fb-4f73-4533-a13c-3b15a1debdbb", "value": "12288:DN91ty1dhMo3EPTUAtGco4Cz096jU9qS/GkXDW2QbqcK6RhdBMueRVP/dU:DN9vjo3EPI4o8EkXDC+c5uueLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684753160, "uuid": "750d4f51-041f-4501-9a9d-e5e95d5ce6c9", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684753160, "uuid": "beccdfca-6ca9-473f-8b55-de82eecea222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753160, "uuid": "70be87dd-5fe5-46e8-91a5-8848724d4aaf", "value": "z20Wgfgsadwhezuih.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19a5013-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752377, "uuid": "179b87dd-6ba4-4401-9ea4-a8372ae31066", "comment": "Malware payload (RedLineStealer)", "value": "08678d6b802fd3743980ef8d7d81ba5a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752377, "uuid": "38fd14e7-90bf-4990-b469-2d969ed855ff", "comment": "Malware payload (RedLineStealer)", "value": "a7ed2bd73bc6965b5ad9e55f38613b75709782a66aeca048b6f583841323a459", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752377, "uuid": "90a99178-ee5a-485a-b0e5-76b64a7b4b65", "comment": "Malware payload (RedLineStealer)", "value": "ecbdc59ea76757a0ffe239ad4d9c23295a955320", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752377, "uuid": "7b6a3247-495d-4fbe-9f07-3c887b65eec7", "comment": "Malware payload (RedLineStealer)", "value": "cc1ca0ef981c657570e7e57fcae7341c807fbb68f9bbe9c84d4ea7fc98595ea8868ae0435ac106f28bc69220fca82575", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752377, "uuid": "c510d5dd-5eb3-4c5a-a847-2988ed387a12", "value": "T15325231ABBE50573E96837B118F705D30A37FCE01A7887772248E99E1DB2585B93036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752377, "uuid": "42e638e0-7bf8-42ea-90fb-f5648e9bbbec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752377, "uuid": "15ff2f04-6871-4e37-8822-7408dc154b3a", "value": "24576:Xy4tdFa39PgFRH0hseVmbK3l+DjmDle6DfMTETUJZSzBPUM:i4tEPARHcHVHl+HmDTrTUJZS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752377, "uuid": "450ca94b-2a43-4b85-afe1-3e32b0076d95", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752377, "uuid": "6b385059-32b2-45ea-9b88-ce91e90ecad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752377, "uuid": "15eb9e37-a6ff-4ec8-9ab4-b102b7f2508b", "value": "controls308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a7e104-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752226, "uuid": "c6c857c2-7fa1-40c9-b3ab-f56742074a2a", "comment": "Malware payload (RedLineStealer)", "value": "97f328caf3e766ca117062041cc9d87c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752226, "uuid": "72489ec4-7235-4535-9b08-3b65267cf1df", "comment": "Malware payload (RedLineStealer)", "value": "a850e1e7659cfb039218f61951b15d92f5ba5a0ec18250d2c7ba5b12981ad1fc", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752226, "uuid": "64961360-f593-4096-8793-b03b0a9d43f4", "comment": "Malware payload (RedLineStealer)", "value": "f470e65e40b02d236e2b271fe77b5786c10a4d8d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752226, "uuid": "f0086291-bae4-4368-8263-61b84a396a4d", "comment": "Malware payload (RedLineStealer)", "value": "4fabb4dd1f90a8ceeb99948fa1057f6ba05dbc1db344b47bad9944e1f3bd84d2dd6a5501c11741df283efd0be747941d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752226, "uuid": "380d91cc-f4b6-4e66-ba8f-07fe123ff32d", "value": "T10A252366F7D89172DDB12734A4FB07EB0B36BCA1982087A22281DC1F58B17D5E076727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752226, "uuid": "2c32b4bc-e1c8-4ddf-af57-052c010277d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752226, "uuid": "798d9cb7-1f4b-46c7-9dd2-328dc8edd5cc", "value": "12288:5Mrxy90/OmSG6jUkLNEjqMRKAZwRqqr03aU5zbGEd0DkZ/W0fJO/YwLP357qQTSO:gyVNUgSVaqwy5ndDixGQTbRxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752226, "uuid": "6cab812f-324a-432a-b312-2a6525eac2e6", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752226, "uuid": "19c762a2-ea84-4319-a1f8-df2da903590b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752226, "uuid": "7cf28569-124d-4362-bc12-deab10a6b686", "value": "248990s684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143ed3b5-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755898, "uuid": "1ef621d3-6d35-419a-bc77-317899d8bd23", "comment": "Malware payload", "value": "a920faa3b9a2b37bb6712202d0fe2f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755898, "uuid": "be51694a-8814-4bf4-be82-0b7a2ac5866c", "comment": "Malware payload", "value": "a859fa1c13f2ca10c4e7244670d67ccb44763189dc3b81269b8fe846ba2a6e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755898, "uuid": "6fe2c88d-68dc-4815-a994-5435275186eb", "comment": "Malware payload", "value": "2855f009ae727c06ab301d51e58c833b7319f455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755898, "uuid": "8a0bf20f-c48d-4084-87d7-1b1588a36d30", "comment": "Malware payload", "value": "1b6fbda862a591922933ccc40f3f23740b2e44a30819e57688cdc8ec622b9e3645948abef4c25d77621b6e4cf4af6736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755898, "uuid": "90a19965-b3b4-48cc-839a-6e2baa34dd84", "value": "T1B963018A221EE596E3AB4D7B07CE5F048778CD331F37EF264442B8850C752C69E556A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755898, "uuid": "73eb5a89-984d-43a8-9ad5-ab50596757dc", "value": "4d906264c542f98ab0a2f52606c476e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755898, "uuid": "b99d9ed0-ce6e-4b30-8304-911bb64d7863", "value": "1536:c0vTgMBcMeHAQyV22OFhPG61fGsMZxku/8C0sRexfhgJVLXPwK83H:c0sPbhAO3fpgECBexfhgJVLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755898, "uuid": "4517afda-0ac6-481e-bef5-c8b2e8f24fd2", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755898, "uuid": "6b8bfa7b-172d-4546-bd17-98fccec27658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755898, "uuid": "4829a81d-1f7a-496b-aafc-d3ae38b69478", "value": "SecuriteInfo.com.Trojan.Click3.20297.24513.30040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2f718a-f83b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684716857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716857, "uuid": "2f6fceb2-42e2-400c-b94a-f924be4602b1", "comment": "Malware payload (Formbook)", "value": "dc7614d708b3b80811a4c8dde9eb4e1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716857, "uuid": "4bd19cab-06c8-464a-92f1-3b66892d49e1", "comment": "Malware payload (Formbook)", "value": "a8982b67f297cc68ff3f3de02cc7b60d51c8b4a3db85971ce4f73149fe67b6ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716857, "uuid": "d8282a41-b42c-4d19-a5c7-b04cf70ca5cf", "comment": "Malware payload (Formbook)", "value": "eea7aae64288e6cacec90b01a94996963f9974fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684716857, "uuid": "4c93df2c-7c98-4fd5-b3c7-68ec0bc32baf", "comment": "Malware payload (Formbook)", "value": "dab2d577ef16458f822e7c3c96c4f78835a2152a286673d5ec3888fd3061da7f51733520d9992de7140f39f90085cd05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716857, "uuid": "ac7639df-184c-4670-84d2-08545abff341", "value": "T158F4D01023A58B4AE5BA87F05DE0E2F01BB99D9A7439C2174FD6FCCB71A9F910750A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716857, "uuid": "bd0d6cc0-a4f8-4aaa-8660-333513f47222", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716857, "uuid": "de75b55a-703e-49e6-895e-0cf5f74383ff", "value": "12288:aqqBGlU2ZWDHiI5KQ5qN06C9DbBPvIp2pm5+i5zbcMP:pq+Dj45qvC1pmb5zbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684716857, "uuid": "c9129d27-8bb0-4d86-a660-11217212f998", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684716857, "uuid": "efc29a00-8272-4f48-b68d-1a0d049090d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684716857, "uuid": "eac56046-ab4c-4dc7-a8fb-7221362d0acc", "value": "dc7614d708b3b80811a4c8dde9eb4e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35649da3-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779576, "uuid": "831e08f1-f120-44d7-8c15-1c245212b435", "comment": "Malware payload (AgentTesla)", "value": "52b044b72aa913f6add8ed2085ce3230", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779576, "uuid": "eed79d8e-b50f-4ec0-b378-3b88e3e6f4e2", "comment": "Malware payload (AgentTesla)", "value": "a8da58e3f0452570272c99237655966fd333788cb4be1ed2da8549c65666119d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779576, "uuid": "5af06e9a-11e7-4bb1-9b08-cbf1e9f453cd", "comment": "Malware payload (AgentTesla)", "value": "252d03d04b9e69e011925c7729f0defbcecb0dba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779576, "uuid": "af6d2697-bb97-4af7-abcc-215dabcfdc0a", "comment": "Malware payload (AgentTesla)", "value": "95ab334400505067a8f40fb38c026a8fa842c67377861289410a0d6f51682e65fb21187d1d6f28fdaaa55da1b4c43e02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779576, "uuid": "a79be9b3-3791-4301-827c-a81cb74f6dd0", "value": "T1D6F49D9533B5DF2AD87E43FF06F0608D0BB875067026E2195F9735D27270BA26B48A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779576, "uuid": "27b65148-831e-4f42-ba73-32f34dfe14fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779576, "uuid": "e9120cc0-ce5b-415c-aaae-60119a524b33", "value": "12288:sDX91DgfDTwdRC/twx6B8ihTQUOxwrM2Dt+A0N50A:sR1DgfDsQ/tZB8iXgwoa+550", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779576, "uuid": "b08a0ee1-b87e-4405-b9bb-b051df20954d", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779576, "uuid": "03b0653f-a5e3-427c-b93c-5e1cafe9ff97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779576, "uuid": "6739fc18-8795-4fe2-af02-b3762484f864", "value": "cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f39ae9d-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752454, "uuid": "b8169c50-3652-47ae-8d6e-98037a406374", "comment": "Malware payload (RedLineStealer)", "value": "07fc0731ca56e085a9f431771364dd57", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752454, "uuid": "cf369447-d50a-4c7a-9685-2130d645bbb1", "comment": "Malware payload (RedLineStealer)", "value": "a95d3697aeb3f0028640b0547fc1ff3e01b83996b7c2b25e51c52af0628b4432", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752454, "uuid": "f894e268-739b-418a-b5bc-7ce67cfa7d6b", "comment": "Malware payload (RedLineStealer)", "value": "bdbb1dff5dab1f70409a5f7f2543443e5d040b3a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752454, "uuid": "d3318e80-14f0-4e0a-a384-f11fdb3e6beb", "comment": "Malware payload (RedLineStealer)", "value": "c593f02d4d7cfbaa75e17bc09bcace790e733e2e7eef3013540beee81b47e6b2c2449fd43ab1f2767f6f498e1311af7c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752454, "uuid": "87993a31-70a1-4826-a0bd-51fef01a28e1", "value": "T10C252317EBD55173EEB5377418FA02530B36BEA05CB4C63A2245694B3D72A81B83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752454, "uuid": "b6b945d4-d5b4-4b22-a3a1-fd43a38e600c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752454, "uuid": "2fed6604-b575-4485-8005-653aaaf37182", "value": "24576:2yRFTVm3zQb6FkeqZqojJ+jtCkkWmPC1DonfTLmCdhAQAH:FRFTVGAEkeqZqotvkcaqfTqCzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752454, "uuid": "53ce6255-24a0-4207-b249-a06155d50a0d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752454, "uuid": "c5f1f4a7-c50b-4883-8dad-6ce4c9e5c79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752454, "uuid": "49057459-e62f-44b5-bd84-4ac5eb393a59", "value": "helper460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd0966d-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684762652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762652, "uuid": "ca0540d6-57ba-41b1-86ec-234b896bb381", "comment": "Malware payload (AgentTesla)", "value": "f2a22242d164946d2d9d3c0174bbeecd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762652, "uuid": "f4846409-e2e3-4009-a7dd-1c1e83b669e9", "comment": "Malware payload (AgentTesla)", "value": "a9cdb9cfeb1c1056c0db558d54cfa61d9f3dac179e934d2869f4bd829fe20819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762652, "uuid": "1a05e20f-780b-4fed-a80c-a9ea255e8c2b", "comment": "Malware payload (AgentTesla)", "value": "43149a3b4d5d16cbc5cece1370c9a744810c8320", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762652, "uuid": "074ff2cd-3fe9-47e6-a5cb-0f99c4a3ab4e", "comment": "Malware payload (AgentTesla)", "value": "b0a33ead87909cfe4c78b0211c50076d150d004d58fda54a5d7063e4f3c4e3079874b73dd5de56ac671cf590ef0b4072", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762652, "uuid": "c8cd55d0-a17d-436c-b34d-62c90fe4588e", "value": "T193E47A6633B57621F47D73BD0119638CCB39B44A2022E22A1F563AD542E37EB770A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762652, "uuid": "1612036b-423e-418b-9c5b-961ffb02c4b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762652, "uuid": "c5e45e1f-2d0e-4198-aa1e-1dfc513ae9f6", "value": "12288:MvV+s1bSQT6tjjdB47gEuIZ9WM9+2XJErXd2Xya7qoJaTkHUoQSjG1HlScRIdYNl:Mt1vuIp6jTzoJaOQAGxltRIONxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762652, "uuid": "199104c2-d247-4694-9911-128606d2bfdf", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762652, "uuid": "a98f7f4d-d2c6-4599-9686-c1c4f5e3743a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762652, "uuid": "6804eb9f-bf52-4b74-918c-32f8f2dd5cb1", "value": "COTIZACI\u00d3N-00437800.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de03d242-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752371, "uuid": "48944d3a-7804-4ba2-9f46-e5d8047975c5", "comment": "Malware payload (RedLineStealer)", "value": "29aef40943ee2d24472f8e94b7483a07", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752371, "uuid": "1a29f61b-d723-459d-943f-445cc1825726", "comment": "Malware payload (RedLineStealer)", "value": "aa234acb46f57dad443ce10f2b55c1bffd5661200004bc6b8ae93c91789b4b54", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752371, "uuid": "c4fe0c2b-0817-43a0-a17a-5666cd0e51cd", "comment": "Malware payload (RedLineStealer)", "value": "3afacd1c0010c42c992145a376ccec8023e5d81a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752371, "uuid": "469ce31c-cd45-413f-ad68-abeef9db21e9", "comment": "Malware payload (RedLineStealer)", "value": "44567661a008366b41b3eb42eadcff446dc0ee7b26fcb591830877c0c9fff3514c81c87c08661314f6db56adfad6ae10", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752371, "uuid": "007b1e44-1d0e-4fb7-9bfd-bbd39838237c", "value": "T127252306ABD99132DEB41B3094F601C31A34FEB16A75A2373B48D92B1C73690A67137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752371, "uuid": "e5aacf92-a16b-4e7d-80ab-1fda442b695d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752371, "uuid": "7605d2ff-f517-46d3-9dcc-aacd0f5f26a1", "value": "24576:MyrfSMtVoimsMJqNJNDGPrnKtP2VTNMtFic:7++pmhJq4PrnK4TNM/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752371, "uuid": "b239f998-384c-493a-aa61-0b080c831678", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752371, "uuid": "b09d091d-947c-40b6-8ab7-40c8980a8d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752371, "uuid": "1df60cc2-77ec-48b3-98d1-19fd5c9dd6da", "value": "config410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cf19bb-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745967, "uuid": "73704810-193a-4421-9f6a-a41a7cbfed26", "comment": "Malware payload (RedLineStealer)", "value": "319313f131907c82c4ec1138bc971b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745967, "uuid": "1d6ec528-d8c9-4b8a-bfd1-a3a4c067c4d9", "comment": "Malware payload (RedLineStealer)", "value": "aaa3f775755052a29acf6d0a4234e19582962a3cfb41566c458283aa8fb71b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745967, "uuid": "0cd727d1-54e4-49c6-a6c9-ca6dca6fe497", "comment": "Malware payload (RedLineStealer)", "value": "0ebbd9c3c916b50661c521e7880f63457851b3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745967, "uuid": "30080c73-bc0d-49d4-abf6-e5d17e09b4f8", "comment": "Malware payload (RedLineStealer)", "value": "b9df41b00e999d2addf82005542a7d88d7d9e97a7266c54061a042db5d474158881d78d4c9c916c07e37ba25981e3c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745967, "uuid": "ea586a5e-a7c7-4d7c-9d2c-199ea6da1145", "value": "T1EA252313EBE8D172D9F6277569F20A830B367DA14CB5671F3290594A0D33A88A63173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745967, "uuid": "0a747891-dc17-489b-91d6-c526828a0409", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745967, "uuid": "702def66-6312-441a-a353-86e4e7cab39b", "value": "24576:2yvos/a0oOTi+9FiVq3uwXmJq5Hc42uUJmsox:FQs/absHQVq3u585Hc4FUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745967, "uuid": "ed208d16-5530-40b4-8c48-b55e93ecda97", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745967, "uuid": "d4562de6-556b-44ff-869e-70549f28f3e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745967, "uuid": "b547abbd-13b5-46a0-b703-912d727159c2", "value": "319313f131907c82c4ec1138bc971b41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61e2109-f8de-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684787147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787147, "uuid": "e09389f4-3df9-49d7-aea1-9fbf22c17ed9", "comment": "Malware payload", "value": "71e83ee2d42e1d3a0714c7791675fd83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787147, "uuid": "8b7077c3-6e9e-4e81-9476-71097fc15bfe", "comment": "Malware payload", "value": "aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787147, "uuid": "bf95d387-f37b-4c47-90d8-21a3ba77c58a", "comment": "Malware payload", "value": "7dccf3322913ee83070bfaa461a05b54486d8d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787147, "uuid": "8aa9e033-fe41-4330-8304-c9659da3a971", "comment": "Malware payload", "value": "de258ee3f540d17eb0673c92c8da42e03fadc41fcd384692f059d963e5d073da0a0f627a5912ddde608ef3666b97e2cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787147, "uuid": "17a5fbe4-577b-441a-b7c1-735c8bfd65f0", "value": "T1CA9623BE2544336CC81E88348423F99872F6152E5AFDD696F1EB7AC0BB5B814D906F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787147, "uuid": "d2712df1-e434-4773-87ca-f91be6470d9d", "value": "7963d3a67cfe4f19646b23c68d457d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787147, "uuid": "f05ccb8e-5271-41e8-bca4-4658a0c6902d", "value": "196608:jWqVkkK1ilhlXpUZhemwD65z08tBUsVDS3yAeaBX:ZVkd8lXpkl35I8tB9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684787147, "uuid": "21c6950e-f8a8-4611-970e-d2804d289444", "value": 8728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684787147, "uuid": "f8118d55-b9c9-47db-8559-db5df06e8f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787147, "uuid": "5b621448-b1a1-4baa-9adc-2247d8280c15", "value": "launcher (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53cc4b2-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737324, "uuid": "2d3f21ee-ecb1-4e59-a1f3-7c79e84fe840", "comment": "Malware payload (RedLineStealer)", "value": "557d94cfe4044bec38a4bc7a651f3e00", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737324, "uuid": "327c1211-2597-4e92-8e58-e4a1839e1645", "comment": "Malware payload (RedLineStealer)", "value": "abbf4d04ecc5eb87507fad5934ace1709f439a4d716d0aa208354912a9a68703", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737324, "uuid": "d4ea0f30-0124-476b-b4b4-6518c0656866", "comment": "Malware payload (RedLineStealer)", "value": "92a8b3dde2a8d42970d65f15266d7aec3f703184", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737324, "uuid": "6896d16f-1deb-4e81-a3e6-03606d91f872", "comment": "Malware payload (RedLineStealer)", "value": "e26007f7b089c0825a7ae8c43f90409eef6b5694465d65b9211fe0fc05ebea9c364e9fb34c0066c8a332b3fd947aab62", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737324, "uuid": "2e8531ca-04de-45b9-9582-63833d91f2d1", "value": "T1CE252243A3E4447ADD6927B058FA52D30F7ABDE25C788B2E0701E98E0873790A5717B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737324, "uuid": "9f9c6d5e-8ad2-4cf2-9b1d-9b40ce73b89f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737324, "uuid": "9860f21b-c174-4fbe-9340-a560bc9cb852", "value": "24576:xyY+AIdUG9qcOFGzdwY2hZfxCmop5TUFlJLr:knUKqHQeYGC5TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737324, "uuid": "57cbc870-c3dd-4df7-8c11-da60145abd4f", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737324, "uuid": "fb2a16c4-592e-498d-9fad-364da1a59b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737324, "uuid": "30ca777f-da01-45a7-90b4-2958eebce9a9", "value": "Setup995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956db0b7-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752249, "uuid": "9e234391-9b58-4b86-bd72-9a4b462089aa", "comment": "Malware payload (RedLineStealer)", "value": "2d3e51a76d2e03a89f3fddbd7af9a9eb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752249, "uuid": "d2f1fdd4-34f9-4c2a-8e6a-7629dc86f5cc", "comment": "Malware payload (RedLineStealer)", "value": "ac322baf22280b8b4c0c4de421a0abe159717d0614f9839ea9ae2b90ebeefee3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752249, "uuid": "6b0540cc-7f55-4710-bcfb-9c3d30aa7e35", "comment": "Malware payload (RedLineStealer)", "value": "c3d1db9046e9b47e8e1dc6119ff819069d6475ed", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752249, "uuid": "923697f1-50b6-4552-a79e-ffca3c186cbb", "comment": "Malware payload (RedLineStealer)", "value": "cfc21996baa0164fc8c72d37bafc0fa31d6ade387091baede92ed5b5cdc56208b04ee92c2d9fd1b2f2592659be1fc8e8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752249, "uuid": "bf078140-3feb-4325-b765-0f0f32a4ba13", "value": "T1F9252317B7F44033CC752BB0A8F916830B3ABDE29E39816B2586B96D4C325D1A572367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752249, "uuid": "107f223e-b26e-42cc-a943-7afc02489fb4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752249, "uuid": "cd399b76-f0d3-4520-8dae-c2ac73db0373", "value": "24576:AyXlYi7MUaDwNqKs+x2mWMMLdF5DRUlvK7KT0RIx:HbscNqKs+xNMLdvCTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752249, "uuid": "1da6fc66-41f5-4673-8d96-369bdd254f29", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752249, "uuid": "69b913b5-9eda-449f-a298-e27f92d4b785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752249, "uuid": "fa8a685e-9ecf-4370-9420-27748d06d46f", "value": "35677293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c27dcb0-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763616, "uuid": "dbc80630-c1be-4e83-b962-ff9e940a6a5a", "comment": "Malware payload (Mirai)", "value": "1becdc33fc0db7c592c10f63c3d22605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763616, "uuid": "19ec0266-2e22-4057-b97b-773613f0e15f", "comment": "Malware payload (Mirai)", "value": "ac8847c615a20841cd5f0f82cdc7d6646266adb5f272468d9431f827426f62d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763616, "uuid": "4b6212c6-adf5-4bcb-9e3d-ba424924f5ba", "comment": "Malware payload (Mirai)", "value": "8a61bdd33f66d5aba6a509b004b702601ed61cb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763616, "uuid": "7b767946-73f0-45d5-9038-f1f402202b5f", "comment": "Malware payload (Mirai)", "value": "50ec804a63b4c85220268bbca1849fa4e1e745875d2ab9af2aa9dc8c131947b8a10c01f03c9ef105c90bc347c14a3050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763616, "uuid": "c72379f6-06c3-4e9f-8c13-99a44fd6d0f3", "value": "T170A34C3237364A23C4A6553841EB9737B3F39F891E70811B7AA05F987F5AAD031837A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763616, "uuid": "789116f4-6bf9-49b6-9fc0-d5a896d8aeff", "value": "1536:U2qsHwHb6DDKmeur+apHA1+9vC02QIC/5fqKtB+D6vy3UDHw5xSa:Uulmur9pH4+o0rfqQxvy3UbwOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763616, "uuid": "967c12dd-b15d-4868-94a5-01c2deaa3f0d", "value": 99237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763616, "uuid": "59210024-ca93-4500-91b5-128842134dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763616, "uuid": "154fad10-bfe1-49ad-9648-0d737d131932", "value": "1becdc33fc0db7c592c10f63c3d22605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6b16cc-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763004, "uuid": "564db46f-3867-4ce6-8c75-73b9d4976ef1", "comment": "Malware payload (Mirai)", "value": "4a588ad98c7397b26003f9b97808ee91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763004, "uuid": "73c0f70a-5006-453c-84b6-57b92ffe6e61", "comment": "Malware payload (Mirai)", "value": "ad39ece587a4cfae63491a959beea2a5625261302ec933090c181dba8dd7c511", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763004, "uuid": "1b9496d2-76d1-45dd-9bfd-221aaa7f8338", "comment": "Malware payload (Mirai)", "value": "2a1fd9465b83a236b1863dabdd518cbf8e38ee29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763004, "uuid": "7aa487ec-236e-4ad3-8d7f-802bfcf8b67f", "comment": "Malware payload (Mirai)", "value": "ff7d1e97ef91166efc9792623bdcbceb3dc4685c3981ece3c5fc7abb56ff4b12ba2efee8f543eebcab56a048cbe152cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763004, "uuid": "573b907c-0436-4b49-9dea-4f8f8e46a78f", "value": "T1DCD32B46AB408B13C4D62776BAEF424533239B64D7EB33069528BFF43F8279E4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763004, "uuid": "2d7748ec-3613-4d93-b8e5-a23f8f9d6f5e", "value": "3072:Qvt8sZAon0aoDY2qd67rHzt1AiJnXksF4xVrQJ004FbG:Qvt8sAk0aoDY2i6zt/JnUsF4xVQ4Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763004, "uuid": "e76ad831-fcb6-4c72-9d0d-6ca29eef22f5", "value": 139014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763004, "uuid": "7e16fda3-bd70-4256-9a5b-36ee61396e47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763004, "uuid": "8669a45b-5bf7-4736-8cfa-94bf11cef9c3", "value": "4a588ad98c7397b26003f9b97808ee91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e57aac-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752244, "uuid": "24017d9f-0a19-4b3d-b969-627b4b6026b8", "comment": "Malware payload (RedLineStealer)", "value": "973e6e06acc1ab04fba12100ec74542a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752244, "uuid": "178cfc74-1984-4c10-8f58-2c0d101aa85d", "comment": "Malware payload (RedLineStealer)", "value": "adacdaede6a300c2bc04f4d10999057d3dc7693932ffcd5dfb897d81a8543101", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752244, "uuid": "2646ea6e-9d5f-403c-be2f-57f07677e681", "comment": "Malware payload (RedLineStealer)", "value": "54a6963a75c0e44ab5ed2b667c72effb4360e789", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752244, "uuid": "8b8ba5ba-a003-4c46-8d3f-b8baa81348b2", "comment": "Malware payload (RedLineStealer)", "value": "a047535efadfefa0a07abd84332177701596e73393c7f41b2ecbcb9810a301e1fe64a539c6e1b5adcc14a2a93b679dfd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752244, "uuid": "aa40f279-e260-4972-b2aa-d35a07dd93fa", "value": "T197252302BBD9A133FD75177098F702970B32BC919A34937A3386EC9F5C7218969713A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752244, "uuid": "9d0d8d61-5105-4b68-bde9-d48560d662ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752244, "uuid": "49aabe99-ce61-4a46-b52f-17433c2eada7", "value": "24576:JydhlsAAv6r2ALzCq+QgqS+M2IfcRzod7wyijxIpC9:8dhl9aYnCqOfAIfy47wVVIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752244, "uuid": "4cbaa6a5-e4db-498a-bd78-4aaa8a4a4011", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752244, "uuid": "65640bd6-d4be-4977-9c60-75e028dcbd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752244, "uuid": "25874b13-0a1a-4e59-a759-f920fa0d7498", "value": "353512381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb256d1a-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777224, "uuid": "d7c870d4-383c-4ca9-9f05-47f119c967d8", "comment": "Malware payload", "value": "9d1ecc14e62e27da4021a52014cc6c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777224, "uuid": "5923ff55-d8bf-4bd2-8da8-672ad3ea5639", "comment": "Malware payload", "value": "adb198fd1913988fe6c4bbc33895fe5691300806e5721e02511c00980720da15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777224, "uuid": "c959c76e-115b-4d47-976a-254ef712542d", "comment": "Malware payload", "value": "d68572a9dc8d5446e93c0bd339d19d9d4e721c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777224, "uuid": "fd92dc06-67df-4038-8c78-4ce8a30523e7", "comment": "Malware payload", "value": "ea99095d1e83c8a08f49c9a1fc456e292405265994a8a18fa4f4362fcbcd3c34652370279c2da53e6fd82a1a4153eb25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777224, "uuid": "577b075b-6ba0-46dc-8cfa-8c278855f839", "value": "T1ACF14BE776185959F08D42FA00D317A3F86A327CC79C06CA4B959683BCCB3302319590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777224, "uuid": "becf99bb-37cf-40c4-afcb-53a25f7f0ffa", "value": "88c968002eca8af59b8ccc340a669406", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777224, "uuid": "c4e85b2b-d135-484c-9cb3-2e9574b7524c", "value": "192:+zxAenjtYoLzt+0D15HuumbZeAsEihuqGQQKdb:uDYoLzUw1kDS6QQKdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777224, "uuid": "b3d4ec11-f528-4aec-a244-2c479694120d", "value": 8054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777224, "uuid": "2fea5a81-0574-4431-ac5f-b66e8ba9119c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777224, "uuid": "3bc1a344-03a4-4795-b788-4ffa4f1b79ec", "value": "SecuriteInfo.com.Trojan.Wacatac.28246.17446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821f5fa8-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752217, "uuid": "c13763f6-6694-437d-a86b-e5384d54461e", "comment": "Malware payload (Amadey)", "value": "faf77ecd87c8c92da349baab7f2508be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752217, "uuid": "923022f4-e181-46c3-88a7-d7f1bba5bcb3", "comment": "Malware payload (Amadey)", "value": "ae65d5f9f90e862aed3d0c1f8b42f6b2f2baba13344a2eae38bf044269b66a34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752217, "uuid": "d9b9cddb-6011-4848-b552-cf6da631d932", "comment": "Malware payload (Amadey)", "value": "fa762aa588a768dca70e74b4776a485c1ef43c27", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752217, "uuid": "709fd46d-b169-4f32-9265-194041b097c3", "comment": "Malware payload (Amadey)", "value": "ed3045b953408c7307171a9c48043aabf6b853502784e745e414472194f04f8022b7f0c5e72dc447c8311406f45eb030", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752217, "uuid": "63ee3e0d-d099-47f2-8cfd-ecfcfeeee590", "value": "T162252363A2C98176C9B23B7058FB23931F36BD925CB682777344BC5A0C72994E1B1357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752217, "uuid": "6e3c0e4b-8a09-4f98-88f5-524ae5e812af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752217, "uuid": "b2f802a3-f315-4696-b70c-5d043e21f4c1", "value": "24576:lylvskQ23AhBFbBx3sRBu9S7sLXAQFo5i6xJzE4:ARsWMrbL8RB8MsUQFo5iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752217, "uuid": "754c34ef-1a26-45bc-89af-25c9db6cdbe4", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752217, "uuid": "74c7a354-a5a9-4ae5-81ee-b2b1294c47ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752217, "uuid": "6d767ac3-e429-4272-82df-f24ae4b1c17d", "value": "245245254574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90cb9b0-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737277, "uuid": "bd5c0d78-974a-40af-aeb4-d4948b9c149c", "comment": "Malware payload (Amadey)", "value": "6a6fdfe03df610fccae7ab095804ab36", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737277, "uuid": "5c21fe5b-9c1f-4933-9b01-46ff639c242a", "comment": "Malware payload (Amadey)", "value": "ae899aa50ad9c260fa0876bdaea9db9a0e8312401188970462e8411889603b4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737277, "uuid": "e6631a92-793d-4f9f-a298-46ea6e6a556f", "comment": "Malware payload (Amadey)", "value": "80f7be0b7e0594507130c52d5061c8f479892d66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737277, "uuid": "d9942aa0-8c24-4d77-a3be-363a421c766d", "comment": "Malware payload (Amadey)", "value": "9d3176967e436a6680e9d5193781a69876f4aefde93c44676f9da370d9590c8f5acf7d0847bc556ebbf2e6747bf82a6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737277, "uuid": "331c6ee5-8450-4659-a823-42e52f7f8009", "value": "T1D2252203F7D9A422DDA557B12CF682930B7B7CF25D38433B2753A8494DB2698A53036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737277, "uuid": "33ee8614-9f4f-4be9-b701-1697a01f2e94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737277, "uuid": "66e3082f-3348-4407-a923-a79ef5101c21", "value": "24576:Myte5YauPYOXesxvt/XcbXfzz/ryZI5V0VgTDNoO:7E8YQV8bIm1TDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737277, "uuid": "b4fbe305-98ee-4e86-9e11-65440abb7f97", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737277, "uuid": "6cc995c8-c881-48c2-9e3d-887033d19e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737277, "uuid": "3820afeb-a00c-4e59-b8be-ad8077648130", "value": "AI467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dc2a88-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752438, "uuid": "9f691bf7-0db2-4687-9a07-c6bb7450d9b8", "comment": "Malware payload (RedLineStealer)", "value": "5ef2b7e7255c2a969e0adba0f9321969", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752438, "uuid": "c2c04a0b-b2a8-4842-b269-513778277495", "comment": "Malware payload (RedLineStealer)", "value": "ae9417fda69d93d2b942c825557d48b3c6143ffbd8a25314cddf6c8f108b7786", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752438, "uuid": "23d4a0bb-d3f4-4911-809c-3459d030202e", "comment": "Malware payload (RedLineStealer)", "value": "1847b8fb26d08300bb1d755b0a3ea9c0f16b6cd6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752438, "uuid": "35f012f0-c90c-4d01-bfa4-8818128f0968", "comment": "Malware payload (RedLineStealer)", "value": "7747b1d468154bc92e8348a49336dc2f7f768316574ff2212c1bbbeb3895ee6994ba3d1acc7b01fc8c7cb4922818bc15", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752438, "uuid": "805b3529-f4ca-4572-836e-fabd5569db06", "value": "T1D1252307EAE81077D8B9173898F607830E32BE91AD39D7273B55496B2D722C1D871727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752438, "uuid": "52c52084-26d2-4d0e-b3e6-bc954957e791", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752438, "uuid": "8b141d81-f444-49f0-aa29-b2188793e196", "value": "24576:6ypU2HRsKBYX/2dHBBqvJvvvplrZo5AhZAASznfkKvUEI/Z:BXHeKSedhBq5plrZVZAbQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752438, "uuid": "3dc78eee-1858-47ee-8095-80c17d132862", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752438, "uuid": "5b0bf8ad-9e8e-4baf-ba90-3b6d28c1b0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752438, "uuid": "d0892e5b-3b18-4ade-bbd5-a05439222fc4", "value": "gameplay317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113a925a-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755893, "uuid": "caad6541-c0c5-4b95-934d-e17f109e9f86", "comment": "Malware payload", "value": "9e0f94c9ea258a8af719e98be1515d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755893, "uuid": "114af6b7-5012-4994-9016-104ded8e7137", "comment": "Malware payload", "value": "aee15fc7460eec2ac7cff223eb63061e03d2bf37bfb6a66eda208dcd95249d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755893, "uuid": "9beb4902-90ab-4db7-bba0-7b9c6c55ea35", "comment": "Malware payload", "value": "31c52b2a8527c6f8d4facfec0e87674f7a690d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755893, "uuid": "20f38c56-f045-4ed3-91f3-83283cf8cb3d", "comment": "Malware payload", "value": "24b1c913cef0673cbc32bfe70850d81712ef32f309928f527e80ab76ab17eb4933af0e9b13eeb4776af73673f67d46ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755893, "uuid": "013bcd5b-75e3-4be9-b7b4-ed62d53a3676", "value": "T1B6A42222FDD197A2CC156C3144E867F1DB19C8C6005153D19D396A9E3FA3C4BA82BEBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755893, "uuid": "2a70e74d-3e4e-49d4-9656-7194e6483b37", "value": "867872423857355356118917a9d5ff06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755893, "uuid": "2333cc13-70c6-47a9-9349-cd5407189307", "value": "6144:09tct8cncNDIgihHwJrZrii2mrTXR1hMLiePAKJFXmoEVByRlBn4uJe:0gl+PihHWn26TXsDYKJFXD6BYBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755893, "uuid": "f0904bf4-8257-41d3-a2bc-5e4347526f41", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755893, "uuid": "a035d729-1e87-4159-9054-9763180c267a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755893, "uuid": "4f90879c-9153-4716-b8ff-78c95704527c", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.22326.7751.20156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c66bb82-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752476, "uuid": "b80e33fc-3d44-484d-9f33-e0e5797fca56", "comment": "Malware payload (RedLineStealer)", "value": "15027728f9976a3636bf49bb0b549739", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752476, "uuid": "5b108222-9c06-4d3c-9ad3-f29675198d4f", "comment": "Malware payload (RedLineStealer)", "value": "af546c16dee429789fcfe664ab3477624088221c02d21650617e5b2d48d4d222", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752476, "uuid": "d4a0f131-4f50-41e6-ad9f-fc9f6a182e20", "comment": "Malware payload (RedLineStealer)", "value": "955b75dcc68319b6d38b904d0a23a48ce572a063", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752476, "uuid": "f039e933-d76f-42bd-bb6a-f20315d16806", "comment": "Malware payload (RedLineStealer)", "value": "908fbf9dc811f8873780870a2dc22e240e91ab6a22961a3809daf7e09aa6336ea31ab1f982547fa3811b724058d7cb11", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752476, "uuid": "e5bccb6c-4b14-4b55-a602-3392c436627d", "value": "T1FE252303BBE92072E87523715CF707972A31FCA18C75933A37C6AD5A19B26C86035B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752476, "uuid": "88dac0bc-2042-4584-bb3f-821bd5159086", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752476, "uuid": "81324819-c423-4c31-a7c2-be7e452ae815", "value": "24576:fy6btUjI9q1JfmeUEAujXsjLikov9wQ92:q65Uc9qHmeBAuj4LKv9wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752476, "uuid": "ceb3876c-12ac-4e1b-b45d-28d0cb367164", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752476, "uuid": "d7847b38-1d66-4170-b94e-c225f420b16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752476, "uuid": "d59ebf50-ab17-4859-8080-8d9a24a4ff27", "value": "launcher807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c7d724-f879-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684743559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743559, "uuid": "6d06d58c-d6ed-45d7-8392-8837e5dd4f92", "comment": "Malware payload", "value": "b3ce3a4d7ef395904e1c865ff9f6445d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743559, "uuid": "db62b132-4cdc-49ee-94e8-ccbb772601f9", "comment": "Malware payload", "value": "af59d0bea5729972dcb65c4fb6c17b69d3b6997f0fb0b337ca13dcbf5cbd7552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743559, "uuid": "ab9d8fb7-ba59-452f-a881-95cada7b11f6", "comment": "Malware payload", "value": "d5d7c4ad90d35141879864196adc977c3898120c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684743559, "uuid": "8599e880-925f-453b-b34e-f90479baee6a", "comment": "Malware payload", "value": "4100979a274e6802932e1fedf4d0d5c592f261011c86a290bf5407b02575eef4faa38b89b53977d1070929a14f66f244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743559, "uuid": "95fe6143-2bc9-4182-a668-ee3964a97e3c", "value": "T17B136C52FB46CA41F489A179588363792A87FD34AE117B474264FF3B3FB31A01E81B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743559, "uuid": "f0099796-b110-4e78-8d0b-3df35e40b550", "value": "5f116d8e20f7d894b4b4ecbad1704009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743559, "uuid": "9e3003d2-512c-4aff-9764-d1582d4a5c19", "value": "768:C/+8ldkxYXO5lsvhBznbcuyD7UTy3wy3BEywe0l:6+8ldkxOO5Sv/znouy8Tuzuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684743559, "uuid": "55b7f541-07cc-4e21-9a1a-747ab1ecc6e5", "value": 43235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684743559, "uuid": "d47c78ce-00d4-4f7d-8ca8-de9187bfbd5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684743559, "uuid": "9462404b-c717-44e5-9273-4c977cdbab5a", "value": "software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d857421-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752236, "uuid": "5cffd4a4-67f0-4a24-b1c8-ec78d24f722c", "comment": "Malware payload (RedLineStealer)", "value": "a8965bf0fc8cb34f75f2a910f441b8dd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752236, "uuid": "07cc807b-9837-46cb-bffc-82c17b82d570", "comment": "Malware payload (RedLineStealer)", "value": "afaa90bd7c6d8aaf56ad67b1df2376eda123ac2312ffdf1eddfc826d983d705f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752236, "uuid": "0db0ed81-cdb3-4c09-b9d7-3471cbe9ec17", "comment": "Malware payload (RedLineStealer)", "value": "fcdba6ed90ad6ff32a9f2e18a37c5f7d861e885a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752236, "uuid": "84f880f1-39ca-4ee1-a62d-adfa4941edb5", "comment": "Malware payload (RedLineStealer)", "value": "ed8f8a1ebc283c411f86b9a88a6c1406edede5929e2fc36328b04c7d9ab13e7cc0c419f91de8caddb0445b88ab0229cc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752236, "uuid": "f470fe68-fde1-4280-a094-cf76568ab9a6", "value": "T190252343E7E44472EDB917709DFA03870A777CA5AE74161E1299EE8B09B2344693233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752236, "uuid": "ded9a05e-2bb9-41ac-93c5-fd96e6de39be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752236, "uuid": "bcd98a65-4cd0-4516-af6b-06974d04591a", "value": "12288:kMrNy90LkCpO1H+0psHCwvmr8khL+ljhlJ3Gu5Qnmoou+B0ldPvdA+t6R:JyOkCpqDpsHjm/hKx520ocalpvtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752236, "uuid": "d8a1642d-c859-4460-9a40-774874584aba", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752236, "uuid": "30bd5dda-f08c-45da-9d01-a52baac4b7be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752236, "uuid": "cd12e377-9f60-43eb-9d71-ccf959c8af93", "value": "274722206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2cd7d9-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684745360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745360, "uuid": "e4829682-c6fc-4a89-956d-4a7d60bfe6be", "comment": "Malware payload (GuLoader)", "value": "03fcdf6b5b453715a0bb693b630c33b6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745360, "uuid": "038747f6-924a-4610-88a4-7132ab857fdb", "comment": "Malware payload (GuLoader)", "value": "afc0bab309529f18829ed03cdad5cd127504293c6080dcc463881137b2e8e9ad", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745360, "uuid": "2fd84a47-76e6-45d2-b035-96f9aa1fe5ed", "comment": "Malware payload (GuLoader)", "value": "ccd315811b2c344bd2f5fac05c749d28ea059533", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745360, "uuid": "f8df6aa3-af68-49a2-bb4c-ac5c0979ff25", "comment": "Malware payload (GuLoader)", "value": "76f00eaa1da65a396d57dbbfea5c5b851f2a38b1c70d97a90127e4917b04d362450c658b79fd5b205709bea077f3dd30", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745360, "uuid": "a513e811-37aa-42fc-bcc8-c676be4d0456", "value": "T1427533ECAFF660D8D6289775EFF6631442DC68CB1D6C25C428916F498838A80EF91B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745360, "uuid": "c7f4c17e-475a-49a3-a276-084ede40b2e7", "value": "49152:X1W8bigsOmuEY0vWXCW8bigsOmuEY0vWXZ:k2euEY0vWF2euEY0vWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745360, "uuid": "89b4fb68-b89b-4cf4-9cde-4952b8a27af3", "value": 1605547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745360, "uuid": "d9a5bbf4-8a7a-4e87-9810-2eacbfc7a78b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745360, "uuid": "c01069ae-aa88-4718-a8eb-fb8b246cea15", "value": "REE098765457890K.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1508688d-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684745162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745162, "uuid": "aaad7269-97eb-4776-9092-1264ac9cffc8", "comment": "Malware payload (Formbook)", "value": "c9a545716a8b2f9645c9c6aa6de2306c", "object_relation": "md5", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745162, "uuid": "12b7b96f-d36e-4ba1-95d0-203dfe2eb9b5", "comment": "Malware payload (Formbook)", "value": "b025ef03dfe5778be2d70ac7a4ff7624bcdb5e2b11dde309f10aec9916fe0e7a", "object_relation": "sha256", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745162, "uuid": "9d183530-1d13-45ac-8ae2-ce24fef54564", "comment": "Malware payload (Formbook)", "value": "e53e531aed1005be96b48a3c24c6a5c0845d2fde", "object_relation": "sha1", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745162, "uuid": "771ab86f-1a17-4f78-b03c-e1b79434a630", "comment": "Malware payload (Formbook)", "value": "5c4d1b820be4f7176415e83cea320dfdd6105d2fb1e41b1500004e8c48501632abf304e53a6bb7457e1ab582ba259790", "object_relation": "sha3-384", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745162, "uuid": "e9f74528-54bf-4749-9974-d1e89706f1fd", "value": "T123059E27A390C877E1B72A79CC1A537468AA7E112D656C4AEFE41D0DCF346413C2B1EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745162, "uuid": "4dc6b0d1-14b3-4556-864b-d7da0de7d7bd", "value": "38133f6236637d4df7998af089e91f7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745162, "uuid": "051c5307-2557-4763-a7d2-b7af48ca517b", "value": "12288:DN91ty1dhMo3EPTUAtGco4Cz096jU9qS/GkXDW2QbqcK6RhdBMueRVP/1U:DN9vjo3EPI4o8EkXDC+c5uueL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745162, "uuid": "4bf9c0f4-e853-46da-a7e9-d007c9a8550a", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745162, "uuid": "cf57db56-b28f-4a25-93f1-285342cf8692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745162, "uuid": "e5321fda-226d-4708-af4a-d1f39842d7fc", "value": "Bashkangjitur eshte lista e re e porosive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e387af8b-f8da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684785452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684785452, "uuid": "5ec7c54b-ffca-434c-a025-9d09ccabfe48", "comment": "Malware payload", "value": "33d9a61059251432d01365ece4afd89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684785452, "uuid": "f7c5549d-ca06-4028-8445-dba8064211d7", "comment": "Malware payload", "value": "b0a72e5b26ccf897c37a2328f24b52ee875e6cbd8e8898aba2f4aad18b832ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684785452, "uuid": "056b8bda-1bed-4e27-b676-b0b9727092ac", "comment": "Malware payload", "value": "d69aeb8f2ce1e0a169e2de2aa58ce0e43e1e5945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684785452, "uuid": "4a8b7c4b-5044-4d58-9584-87a29c39e127", "comment": "Malware payload", "value": "d7b3b69ebd81289b763f84d176b75b7a58f7bcc4169a28ec598faab80b244366ea874629d5dd5265520263d05b5a9e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684785452, "uuid": "2fe608e3-0c82-4e70-a1c7-316c1d941ddf", "value": "T12BE63362D2768C77D66EDA3D7699A4D0EC2F4078ECC858B9B31C667400363F125A43AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684785452, "uuid": "562cfc36-9f04-494b-b861-52b70d74e238", "value": "51ccd6ab4429339a00d7b3418e2abacd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684785452, "uuid": "9d396573-b854-43d4-9642-b9a5499e5b9c", "value": "393216:iSQud3UWomKKvK8GbXMPTdMJK1BbY516Kug:iSQSVKugTaaK1BVKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684785452, "uuid": "1b8085c6-58cc-44f5-bf99-37cba8072461", "value": 14344136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684785452, "uuid": "68bd1d10-e174-42ba-9bf7-ba62a357e1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684785452, "uuid": "569c76f8-232b-4e39-9a7a-06dad3f306f7", "value": "3DCoatGL64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3941585-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752273, "uuid": "c01e7001-e3bc-413b-92d1-e82c39631919", "comment": "Malware payload (RedLineStealer)", "value": "a86543f18bcf1c82a76708447739b4b8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752273, "uuid": "a83898ad-8fbc-4f1f-aadf-4a71bb066447", "comment": "Malware payload (RedLineStealer)", "value": "b0df9fb8a49400c9708a6873f317900d698a5760cd05a4823e70cd5e52c4e3c5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752273, "uuid": "a5b81dc0-3830-4f0d-baec-c35f19cdd351", "comment": "Malware payload (RedLineStealer)", "value": "1529a2375f04dd798d4d415886f7aa7be485332f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752273, "uuid": "92ab1f8e-3d60-4b05-b9a5-2269bcd9c407", "comment": "Malware payload (RedLineStealer)", "value": "638bcbc51d740bc51f4520e24a55ef6b126131111aa0769d5324b8fd28a95948e70ce2652f2cf23cc8664daf841e149b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752273, "uuid": "b31fb8c5-426d-43bf-825d-0b4e4b59867c", "value": "T10F252323AFE890A2ECB6177550FB07C31E36FDA75A74575E2705290E0DB3188A17632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752273, "uuid": "1079990f-e5aa-4c61-921f-68bef8bacf92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752273, "uuid": "904f0708-e088-47fa-aa34-cf531ccece08", "value": "24576:NymbOPN9BXyVPFRE1cp3jKmXQDaOjjRtc/4nTw+TX8puvt3:oKO1rXeclsQDaq764nTw+TXGGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752273, "uuid": "15219385-a85e-4ca6-a854-4ac025934830", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752273, "uuid": "e93a4c75-6c1d-4c6e-b1f4-5a3df0e60bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752273, "uuid": "f2648c20-949c-4502-8751-bae4080a90c6", "value": "646745784130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79708e98-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752202, "uuid": "130182db-b774-4023-9d02-600c9b38b711", "comment": "Malware payload (RedLineStealer)", "value": "0f5af41d27b3a1c8e7c47aad40d6684d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752202, "uuid": "5bd9bd7e-ddd9-458e-87b4-92d5e73d1bf2", "comment": "Malware payload (RedLineStealer)", "value": "b15c1da5bce4f895dd1d8d85136bed01adeff6655061eb898c6fc971739d5287", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752202, "uuid": "cefafa67-35a6-4035-b6d6-576977a44fd7", "comment": "Malware payload (RedLineStealer)", "value": "f784d9b9b4f0385b396828bc72b3026e54fb1dc7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752202, "uuid": "ce2f97d2-df8d-4205-a63e-39759af341fd", "comment": "Malware payload (RedLineStealer)", "value": "6f20ed3b4d97d9ecf12bd3f11999b954b48945561ba77bd1777dd55981ff2eceaed0c283c08914d38d689d39bf5d5ae0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752202, "uuid": "83799148-d5d5-4025-9378-f4b71b8b1ab8", "value": "T1FA2523035BCD8173E8E563F084F607931A36BDA19C74D62B26CA9A1B0D73AC06A35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752202, "uuid": "031d50b9-4d4c-4b3a-bb74-ecb4ffbfdfc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752202, "uuid": "92562cf9-aec7-4121-8be4-c12c00b5d9fa", "value": "24576:+yRqloExDyacwJq8pfjEtanQkxMo9yD8A6QksNvD:N8l9xDXcwJq8lEmQkuo9w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752202, "uuid": "e0c3cf19-0680-4405-abe4-4f52334e7722", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752202, "uuid": "a7b14704-df32-4bf3-b83e-99ff432d7219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752202, "uuid": "45f263a4-c67c-48a8-a141-19a1c6c76374", "value": "2332324712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4c1d3d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752232, "uuid": "8e74605d-61a9-4d2f-bbbf-02eb1b5e9313", "comment": "Malware payload (RedLineStealer)", "value": "c0ade906e88e1221061cb1c29a659ddb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752232, "uuid": "021d1968-9173-45ec-911d-dcb399ca4cae", "comment": "Malware payload (RedLineStealer)", "value": "b1a7863b448320ec183e169881e7ac1ce63792b38847e046a530556652522d89", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752232, "uuid": "2e22a322-2900-493c-9b44-19357ddada6b", "comment": "Malware payload (RedLineStealer)", "value": "eca8b35e1dac2d71ed3857db6396f651396115a7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752232, "uuid": "e463ffb9-aae7-44c9-be8e-1a97106fda09", "comment": "Malware payload (RedLineStealer)", "value": "3ba38d6eac5f2bb7d3269f36b55dfd16a0718d0a5ff6d1669765be7ebc70536aab9f2c829cbe7fa85215e078cbbc00be", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752232, "uuid": "55d9e56b-dd35-4b25-840f-437b2004b52b", "value": "T135252326B1D8C272DA715F3448BB06DB0E3AFCA28670E6A53795950E0DF2590D8327DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752232, "uuid": "9d5d53fe-b50f-431f-a44d-bbde6e6db120", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752232, "uuid": "c5eb409c-07f9-4be1-88fd-abb8404078eb", "value": "24576:cyX4lhKhXNBvdtBNFclucBeEKpiGUnBtdY081x:LX4wF5gnGU/dYB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752232, "uuid": "463bc973-e418-455b-abf6-b024c92987a3", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752232, "uuid": "cd04c3b4-bbd0-41a6-9bcd-1489cfbfa9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752232, "uuid": "4305da0b-2397-4c36-821d-0dd8eba2d898", "value": "2724243622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789c7642-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752201, "uuid": "ed54472b-a52b-4eb0-aa96-987888195cde", "comment": "Malware payload (RedLineStealer)", "value": "37857f6634adc2e3ab6e6c521eaa0457", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752201, "uuid": "d4559e76-4ad5-48c6-b980-5649aed1b8d0", "comment": "Malware payload (RedLineStealer)", "value": "b1b818f4050215f7dd6341a7684e37244d8f286315df0e6d850d65c1cdd0fb34", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752201, "uuid": "af28483e-3309-4fb3-b3fc-46315599d04a", "comment": "Malware payload (RedLineStealer)", "value": "c43cd27a7a3aa98527a54131e14a8234d82ead38", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752201, "uuid": "d622bc16-0553-46d9-8abf-2d13eb46a91f", "comment": "Malware payload (RedLineStealer)", "value": "4133525bbe88d78de96325f7c12f458c886daf8be21f30eb6f4b7b5bb7e9010c0a3152b975cf6174f4c3af2d39eb82ba", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752201, "uuid": "ab375171-1830-4d33-924d-c7e18e57a968", "value": "T1A1252317BBD81133DAF127B002FA13670A74BD90AEB8C3573655986A0CB36D5E6703B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752201, "uuid": "6c9e35d7-8ca0-46f2-b70c-590363e4f98c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752201, "uuid": "7aebf9b6-6b60-45ba-a359-29c0b944411b", "value": "24576:By8bX9W4YV+HmFrOHHiD3eRw05dIATH/mc+:04m1cHFRw6djTH/mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752201, "uuid": "7d56c7f3-1ed3-4d38-968e-2c81dcebe00a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752201, "uuid": "d97e55d9-45c3-412d-b0da-4239d6d2d507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752201, "uuid": "7c62f109-5f98-4862-bed0-1523b03c09db", "value": "21324777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4d09fa-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752449, "uuid": "24935673-c7c0-4032-b7a0-03a4365e2392", "comment": "Malware payload (RedLineStealer)", "value": "f14d0e35dfb82d61359481390a18fe62", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752449, "uuid": "cbddf719-c8d8-4121-adf9-3f2874e348b4", "comment": "Malware payload (RedLineStealer)", "value": "b22f774024bc68fe538c11440aa222914dcd1e11090b8b023c2f9841d21d1132", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752449, "uuid": "c3e39ab7-9976-4e2f-8e5d-9208b09f1f0f", "comment": "Malware payload (RedLineStealer)", "value": "64891166150c1aa7b16deefb394c79af1a1480e4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752449, "uuid": "c1ee7419-330e-48ff-bd02-09471d89cbbd", "comment": "Malware payload (RedLineStealer)", "value": "e81dc9668885b3ac9c8df3a663d4e49f758c791d92f945dbde081fad0d8d19c39d72126d21988b8e9a53a5a1b89f4979", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752449, "uuid": "891a64da-874e-4ce5-b2f3-8c37d9bab287", "value": "T1502523176BD84875ED7217749CF302530F3BFDE09A7C872A1A61B80A4D329E06A39767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752449, "uuid": "0d3c80b1-4648-4990-bda2-25831b04c21c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752449, "uuid": "69cf3712-f837-4258-b8bf-cf8546276db8", "value": "24576:UyGxNKzcSf5GqCY6AWUo95lL2Ce+yY/fJ2J5dgDEA:jGaoSBGqCHl4qh2PdgDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752449, "uuid": "135e73cd-d630-423a-b8bb-6b029df67ce8", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752449, "uuid": "edd80178-9f0f-4a98-9cb4-959112d7089e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752449, "uuid": "a095f713-667c-4ed2-806a-3be1993c76de", "value": "handler377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090fbd9-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752402, "uuid": "db68d981-924c-4bd5-9f21-f8fa28a15d0b", "comment": "Malware payload (RedLineStealer)", "value": "85aec37a90561000df03d1f2bac62259", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752402, "uuid": "d8544096-5322-4b5b-869c-75ff01f9f68b", "comment": "Malware payload (RedLineStealer)", "value": "b327e64ed701c24e576e9ded7d5e8b3f738b78a987572103154ac234dede72b8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752402, "uuid": "35bc25a0-643b-4b44-9ee9-92f007a7637f", "comment": "Malware payload (RedLineStealer)", "value": "10f03cb764f1eb1a622f23a036b60f474fec8dc1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752402, "uuid": "f13de2e0-59cd-462a-9ae9-d4262793f1d9", "comment": "Malware payload (RedLineStealer)", "value": "f9e50affdbd289969d29d0082fc580377a3bdfc6358d9f991ef4f9704c5032f40e9971932c8e0cb895efeb61ff9f762a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752402, "uuid": "41d5f2f0-99eb-4d01-9743-439f83fb0b83", "value": "T13B252306DBF465B1DCF10BB084F206831F39BDA14E75AB9636A1F81B9C33291EA35356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752402, "uuid": "e8aaabde-f8be-45be-8691-e7f933f331ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752402, "uuid": "9ffeab7b-b77b-4dca-92fc-49c9946a5fcc", "value": "24576:Qy3kyW6C3yKHOcUq1blBQSsqrE8n/RiOcLggg4s+pr88:X3kjR9HOcUq1BPEQ/RiOugg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752402, "uuid": "85020eab-b25e-446d-a538-ae421fb914a7", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752402, "uuid": "474fdb2b-3e96-4d8b-9748-b7d830a07234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752402, "uuid": "bc5101ac-5ae2-4c91-b152-f3afd5bf4df3", "value": "download814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f848cc-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684745382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745382, "uuid": "edfef3ad-b0a3-4185-8bb5-8ce31ffdf8a4", "comment": "Malware payload (WSHRAT)", "value": "9ccea994750b4d63ec5ef4a705f4855e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745382, "uuid": "123d0a45-b71f-40df-9a7b-89aa5a030fcf", "comment": "Malware payload (WSHRAT)", "value": "b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745382, "uuid": "72a391f3-6916-4751-8b41-ad0c8f1db40c", "comment": "Malware payload (WSHRAT)", "value": "334b5f78ce8d2a73fdb551acd389991552c39b3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745382, "uuid": "edee31cb-1861-4573-823d-6615e2c22169", "comment": "Malware payload (WSHRAT)", "value": "b9a629973606cbb5f2022227c902a9333af5c7f7fe8023f73bf20383b8f662e4d5d3f57c46b6f3411e4c9424ba500df2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745382, "uuid": "694a0563-20da-4b35-90b3-22d66d1353ee", "value": "T11635F6D038C81B257FE366E3D9755627A669C1D31A42330369DB3F8CAF269403EB29D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745382, "uuid": "3fd4cda3-6b7f-4748-bdd1-faac6ec4b25e", "value": "3072:Cm0EaAcTqGaSqBHJZieEDQjb98Ztp8i8Jkzh:Cm0EaAcTqGaSqBHJZutUGzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745382, "uuid": "b854a27d-6f57-4ef5-9689-ff8623ed4c08", "value": 1091356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745382, "uuid": "4b556f63-bb89-481d-ac68-4793ccf00eb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745382, "uuid": "ce522a5c-7de2-4586-a5c0-5cfac841bf4d", "value": "05212023840.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b6bf2d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752225, "uuid": "0c551acb-49a0-4a1f-b9ab-5dc95d971a02", "comment": "Malware payload (RedLineStealer)", "value": "7cb966e80ec8a6ad074980fba70a916b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752225, "uuid": "593b2058-0833-4745-95a4-38f22344c6ca", "comment": "Malware payload (RedLineStealer)", "value": "b3535e7684e84726910a585a437f04edf957715e4c2510b75167cb33ab9dbd9f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752225, "uuid": "58b711ea-b334-446e-baee-2fe1c5e28537", "comment": "Malware payload (RedLineStealer)", "value": "72d929984d907903f1e98498ff6f040a9352e9bd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752225, "uuid": "58945ad2-8575-4deb-b671-24aa438b5742", "comment": "Malware payload (RedLineStealer)", "value": "657ac968d7bce59bfe5db19785a98bbe6ef713388c62a2264d5bc580792bb89d8a1fb414a54899b1e5a7375ea297b8c4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752225, "uuid": "151d4c57-e80d-4bff-94f9-20e287d9772f", "value": "T199252391EAEC5471E834337029FA12831B35BEB19C34916EE7A5AD6E8CF21C45876733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752225, "uuid": "6ef4e1a2-4514-432b-b5d5-50573c333e82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752225, "uuid": "264bbf22-c699-47e5-8d3b-51e04a839898", "value": "24576:Y3yUm5yMZ757qZb9yxdGzG0UpWJxV32LjM5rbMk:YCF5y6757qZZyxMoWX0LQ53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752225, "uuid": "70f005d0-843c-4b6c-b091-5c0a011479e3", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752225, "uuid": "149773ee-f8a6-4718-91ae-95a163b16cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752225, "uuid": "0d176987-fd59-4773-8ec0-91eb1e992537", "value": "248990s289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130fdb73-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752460, "uuid": "db2a2e4b-499e-47d6-a7b6-a66e460a47e2", "comment": "Malware payload (RedLineStealer)", "value": "d912c95017ecc2c6e224774ebf01fcb0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752460, "uuid": "0f26365f-ba80-4ff0-89c7-f44a6ed18ce7", "comment": "Malware payload (RedLineStealer)", "value": "b3bdc148f86949f87b495fcb9c78ab63a99ec1716f9ccf8e679f5dc6609c8520", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752460, "uuid": "907fb8bb-8c19-4691-ae62-5ba474a4c9bb", "comment": "Malware payload (RedLineStealer)", "value": "843b12329eedc473290f2c80dc5c6524d621f497", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752460, "uuid": "7e399b8d-242a-493b-a153-171a288de710", "comment": "Malware payload (RedLineStealer)", "value": "6a0458c86c5877259e63f5ce5c24f89ff4bf9ebe9b0a3dc8f5d02a5479eba3d37246a16a438b0485d89e5fa7c2ca0810", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752460, "uuid": "ebe8c24b-f1d3-4e00-976f-1cf9a22c35a4", "value": "T1C8252352A7F05436FA7527B018F703C31B3AFD618774D2AB1388A54A08B39D4A97276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752460, "uuid": "07ca3fad-d881-44a4-bdb2-5b1fe7aeb369", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752460, "uuid": "bc7fd296-0d2a-48e0-990b-c38c66d86056", "value": "24576:vygRgphzEfBN5varL9q2emXxrocFk80IzRO6zYB:6Agp+56LHe0rocFzzRO60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752460, "uuid": "0c2cbd90-5fe2-43d6-8ae7-9cf5b468eaa2", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752460, "uuid": "97cbddee-733b-448b-9411-4bdc50c39ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752460, "uuid": "f9dba404-8e87-4dca-af44-9678139d79f4", "value": "installer230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9664928f-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762559, "uuid": "19587dd0-c22f-4b07-86b2-06eaa5af2eb1", "comment": "Malware payload (SnakeKeylogger)", "value": "9d492198c90933eb067ea7bd158d0597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762559, "uuid": "043ec121-08db-45dd-9016-c4fb32374f68", "comment": "Malware payload (SnakeKeylogger)", "value": "b4b38d7d62a408e89a3c7c0157405cf65862ddb6a1fb23a931311a468d051890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762559, "uuid": "f2598ddb-68a3-44f4-b1dc-b2d3f889d998", "comment": "Malware payload (SnakeKeylogger)", "value": "56950f6ba640b4edf603c5bc0f0fa7f460c807d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762559, "uuid": "2bf50e7c-ce6d-4819-ac82-8fb06900abc4", "comment": "Malware payload (SnakeKeylogger)", "value": "c679410cea76f31b80aa47accf1c4bcdfd5be5b9240628a3fa851034ec16fd54c20f1e49f4f49e2abd49b1b62542e1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762559, "uuid": "ad162001-3c95-4304-9095-14e0a1418600", "value": "T1F4341254B7B4C8AFD8220B360EBD16BB5BA2AD25A4A9D30B139129CD3D73603D51FF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762559, "uuid": "293920e7-98aa-4bae-80f3-f2bac65392f9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762559, "uuid": "34fb6c6e-16fa-499e-8adf-9690c48345e2", "value": "6144:JYa68XJgGIPL8bhiG7FYmjIaf76t+EmV8kPgXjd1qN:JYOJgGIj8TYmsaz6t+Eg8bTdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762559, "uuid": "f1ef6373-6980-45ac-b25d-b5508ab4a40b", "value": 238633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762559, "uuid": "8396e65a-7c09-4d92-8a9f-a4a663f40972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762559, "uuid": "5c419626-0b6d-48f7-8dc4-22d307316b15", "value": "6589987TEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8393df2f-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752219, "uuid": "1fc9f2be-91cc-4dfd-b84b-82ba94ac393d", "comment": "Malware payload (RedLineStealer)", "value": "a06d7cbd824efa61f4546576ba09d808", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752219, "uuid": "7c14f4f8-7955-4d19-96ad-777b82025dcd", "comment": "Malware payload (RedLineStealer)", "value": "b4e76b1af0ce374c48dd5a8fab0ac7caa8da2831b495d2dd851eac557f487725", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752219, "uuid": "b0253bd4-0b67-4d17-81fc-13345385f153", "comment": "Malware payload (RedLineStealer)", "value": "9b1c4a0c90c0817f685c7a32b2d2402ece2dc959", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752219, "uuid": "9aaff8f8-52b0-4884-959d-f40db71a8e77", "comment": "Malware payload (RedLineStealer)", "value": "2340803d45e9d0d72e19620575745fc7db2bc3c6d9dd768b966ffaef5d6f399ccdfa1d1f8200224d388cfe45f27d44ae", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752219, "uuid": "4779eba0-5116-494d-b8a8-6dbac1913783", "value": "T11B2523075FD94037CC712B3188FB13931775BEA09D69872A2796DA4B1DB32D0A86077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752219, "uuid": "6119edd5-27eb-49bb-b9ad-bed7930e67b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752219, "uuid": "d3ab41a6-7e3b-4e2a-8caa-cb4236ec0fee", "value": "24576:qyDY1fqq+D9g42ut8tyRO9AmQeWJ+LguIEKa6b:xDYsq+Dr2utzRO9/QedT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752219, "uuid": "fed92947-9268-45c8-beb4-ad6316178ad4", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752219, "uuid": "c0673a92-c09d-4741-949b-eeab71ffbd87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752219, "uuid": "d8af850b-5248-4517-8f05-a4b34dc22f70", "value": "2454867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c37182-f8a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1684763578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763578, "uuid": "3dcd468c-9502-4496-879c-7d6b89c250ec", "comment": "Malware payload (GurcuStealer)", "value": "79c89dbf459925657671b0d3b2a14273", "object_relation": "md5", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763578, "uuid": "bc0d4353-d5ba-424b-bb39-cb4b347ace93", "comment": "Malware payload (GurcuStealer)", "value": "b4ff80b956cbfefb3f17a21551af195a2c3b96f83785840ef181c21b7ea5c15c", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763578, "uuid": "a6c78efb-3da5-4ec2-8347-36daeef4fb8c", "comment": "Malware payload (GurcuStealer)", "value": "9ee190c676d21d0a4dd03a231f8ade2ae3115f5c", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763578, "uuid": "f9b29b11-7b06-4e36-bcc6-3780f6b352c5", "comment": "Malware payload (GurcuStealer)", "value": "eb3d6674431caf2bfb1dc122532b1e62f58928599ff5aa955f73040888c86d33b36b6fd96fd1b11939c79486eb355fa2", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-201", "colour": "#84CE4D", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763578, "uuid": "612592e2-0e59-4fe0-88a0-e43e7de5c698", "value": "T10594D8B31253AEAEDB670E44D40C1501ECBCA86FB36891BDFE4545D257AA0AC8DB4CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763578, "uuid": "2829117d-83c9-4626-904b-798e88caf7ff", "value": "12288:1Warxt142uFbYRF+c/FX6Qb2sNixiOCiGa2Z/H2:n1424bYRF+c/FX6U2sLOCiGa2Z/H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763578, "uuid": "3dde613a-0366-43a9-b009-adeaf934112d", "value": 446835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763578, "uuid": "88f86313-1ce4-482c-b691-795007e1b45e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763578, "uuid": "787c8d95-12e0-45f8-ba23-88ea4b743179", "value": "purchase_order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7045cfd6-f8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684788265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788265, "uuid": "70923624-b93e-4932-892a-c2a578dc9172", "comment": "Malware payload", "value": "95f8c9acd6ea072a7d18d4229820fe6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788265, "uuid": "00fa85b9-4ca1-4ab1-9ef7-33fb9e1ffc9d", "comment": "Malware payload", "value": "b51278851242867be0c23ad21ab5900fe3a740a06f9ef3e6880439b963c6a596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788265, "uuid": "4ea44e1d-a444-4f65-b151-75d2d840546e", "comment": "Malware payload", "value": "6a82c8e801ff1d99a2e4ea38b171297b2e3a224f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788265, "uuid": "832552a2-99b2-412f-a8bc-79ef3aabc8a9", "comment": "Malware payload", "value": "71ecca25f39a234185d4fe8edc86613244104770b67d15d4e33f22924da5505ea1a440af3f469dacbc31aaae1bd0b59c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788265, "uuid": "f8dbc626-85e7-4a06-9026-4e9a00412f81", "value": "T1AD26336E162691F4ADB0ED7050C1E3DCC4066BB20D4A1B648317069FB49CBF79AF6CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788265, "uuid": "c6b596a4-ee9b-48b2-9d06-7e5b1d41b875", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788265, "uuid": "5a94189b-35c6-44e2-a382-c8b5b21cf804", "value": "98304:PogPXqsgfokGhBmzhtHyZP0p2W6/CXYZlHW8UZQjXRydgrOHNN:wsTk4mzjGcQW6/CXYfCZQjXRnOtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684788265, "uuid": "f603f98e-966b-4816-a48d-edcce03a983e", "value": 4510208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684788265, "uuid": "6175b43c-d898-4828-a005-acd7da1ff837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788265, "uuid": "6ed4a5f3-a3ab-4d4d-a793-6a1b1e2622d6", "value": "ground.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b732c465-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752306, "uuid": "cce96ad4-41c8-4508-b5b5-2f748448aff5", "comment": "Malware payload (Amadey)", "value": "b119f94369afce0df45d1ce158b5e24e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752306, "uuid": "669252cb-f7de-465b-9343-f14ce7fb80c4", "comment": "Malware payload (Amadey)", "value": "b5acc9bb27336d7cf8bfd6ea98229da283a5463c84e4501dc61b072be295cb17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752306, "uuid": "02a530d6-8869-4849-9616-181b56df38be", "comment": "Malware payload (Amadey)", "value": "8f86d31b527fe895120cd5159bfef05db4ff48da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752306, "uuid": "f0d09908-af01-485b-9191-56a1ac0cbaa5", "comment": "Malware payload (Amadey)", "value": "332acd63d77a4d40f922e4268de1939ee8786b95fd4203146ddc3d05a5d8c928baa3161ff52432332f29815a7c864f73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752306, "uuid": "79f64115-5a16-4093-b12f-084568811675", "value": "T195252306ABC41062ECF2977064F247932137BE52DD34568F27D6ACAA0E725D4E9307BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752306, "uuid": "99d17c34-58fb-4e0a-9d30-76d961804c6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752306, "uuid": "30e99af1-02a9-4040-b713-d692b3561f37", "value": "24576:8yubAS/7cJ2dWzFtXPqSYglyC+wzzNBqfwliVRn57udB:rux7co8LXCJglrzzNB4wlibn5id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752306, "uuid": "aea05705-87c7-445c-a5f9-113ad8309924", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752306, "uuid": "8ac0536d-ebc9-4b66-93ad-f62065cf521f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752306, "uuid": "3feae346-1aca-4f4f-9ab7-35d3a9c53f31", "value": "Setup679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956b1768-f8e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684789186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789186, "uuid": "ae347998-58bd-4487-8e5f-869d67ba51fc", "comment": "Malware payload", "value": "5149c75de335e16d8af8a90bef5b98e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789186, "uuid": "bf0fc0be-c7ee-4d54-8ef1-564c20b4224c", "comment": "Malware payload", "value": "b5c3a91c2e79b404b42776c33ab7921ed4da72aaa3a52da35fc569f0afb8c73e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789186, "uuid": "4c3d6183-f35a-4338-9ee8-e96a2ca7320f", "comment": "Malware payload", "value": "249bd9b5890f87f473cef14029577ea229a18d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684789186, "uuid": "e33c2a6a-5445-42b4-8769-f85f580efe18", "comment": "Malware payload", "value": "2a45b769e4b296814582f04d64f33f2544847e5ee7ba808f29b9553936cc57b90a0044a951fd15d8e56cbee1259bd547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789186, "uuid": "1cf2ce69-d58d-4c73-b685-564f726a6a2b", "value": "T11766E1F0575D6590E9BC6C70C8D96E768313B732BC26EC33186479C06A9211AFDEB48E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789186, "uuid": "d21a956d-c33f-4922-b55f-d279847ca254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789186, "uuid": "8edfda53-da8f-490e-8dc7-1bb4103ba8eb", "value": "98304:N+znkO6GLW+DFnW72wE17DBNs/exRNFLfrOqtEBCatWFN8NXz2PeqE4:uknHugawE1PvRNT6CaeKVimqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684789186, "uuid": "30cdb32a-627b-4ea7-b86a-066c8bd80378", "value": 6677032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684789186, "uuid": "c7e1a8e1-f8e3-4c7c-84b6-1fab61e33aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684789186, "uuid": "e7e59197-146e-431d-9378-4d9ef009053d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a94b436-f8f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684795476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795476, "uuid": "f97eb7e4-a9ae-4cf3-af8e-ace0dd72d925", "comment": "Malware payload", "value": "cdf24c345a8d32c5dff424aeffc8e623", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795476, "uuid": "4c040d3d-ff3b-416a-9958-1f0d2e9ba2c3", "comment": "Malware payload", "value": "b612af2ebe45a3865d1d962919351879b86b34a817aad719388c1f98fccb41fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795476, "uuid": "e4264c1d-4783-4682-a5ba-25be0f80eb91", "comment": "Malware payload", "value": "ece8aca4a58bda5bb4b163f7412cdfb6cab18ef8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795476, "uuid": "d991ffd7-1405-4cd1-85be-c8b2ef4a8a26", "comment": "Malware payload", "value": "ca89d9cd996a16896de70c145b26fc48cf570148bf16ca62cc1abd3c57a5d82460c9fdf5e193c9f029750612b96e28fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795476, "uuid": "7e7eae7d-1992-4641-84e8-111592bfbe26", "value": "T145D479143BA7CD4C9B2C56E87B9B97079B2456F3D5F29F0E06A2B1310A1E8217D5C0FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795476, "uuid": "6b8c01d4-7115-4de2-a46f-0b1315d40ec9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795476, "uuid": "f8a52259-9ed3-46ab-8972-db3a0d63e564", "value": "6144:C5cYNEB7YxA9yP9Wrs7KIpTxza+YIWlSBe8+oUZnBZm25L71:CuqE5Y3PSs7KUza+Yae8+hBZm2p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684795476, "uuid": "ff131e56-d1ed-4cb8-ae76-e9edb3530009", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684795476, "uuid": "fea05de8-195f-4338-9241-ed80f038975f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795476, "uuid": "8d57970c-6a9e-4799-a20a-f9e864bf5781", "value": "vABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZu7TTYP3pLSKKD5JSFGIyEClBdkRPQMmZSURsSATbEApIUi6OFEGWpBVHKWUTWdl9HVPCbLGuMLYEyHBIZfJTXH_exnGSnW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50431a64-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737531, "uuid": "be1aecb7-f9b6-4945-a96a-a69089d0c879", "comment": "Malware payload (RedLineStealer)", "value": "4eec134f2fe852196646de35df8ebb88", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737531, "uuid": "4abd98da-bbcb-48bf-90ed-99136bd30c44", "comment": "Malware payload (RedLineStealer)", "value": "b62563832f7ee7dd4851b62b501421c9e686dba29f9de9a024b5243971d49ad4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737531, "uuid": "8a462dc9-55f6-42a4-8023-5b96d7d8df1c", "comment": "Malware payload (RedLineStealer)", "value": "8a83be4b9fbee8b1ab4089eefda6f8dd6b7d0c00", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737531, "uuid": "f9c060f7-88e1-46eb-a2ae-728f75a370f9", "comment": "Malware payload (RedLineStealer)", "value": "a6cd94f5e8f3f5596ca28c11a1ba92c57db4c63d0c3e357284860c2158c69ea05d66412947095b7411ad4842cfb81b0f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737531, "uuid": "644cbf6a-4df5-48c5-ad44-e3918a01e7fd", "value": "T1D8252363AAD85463DDB4173058F102C3073BBD919974DAAB3349BD1B0EB1EA4A17273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737531, "uuid": "c527dc11-8e2e-451f-af67-81a7da187581", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737531, "uuid": "0ad483e8-30ff-4add-a34b-930bac74748f", "value": "24576:2ybrV0etcDWb0jWzwqFAF7/QMTNG79DD+MWJTaC6S9:F3xtcvawqFA5Qn9X+/TGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737531, "uuid": "c3b14af9-ca09-40a3-90a0-bd605a983962", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737531, "uuid": "ce73717b-2a9c-4963-a992-fe3d129e8896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737531, "uuid": "e3bdffae-a16f-4247-8c01-d94d90fb72dd", "value": "notifier563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cd8e66-f8a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684760550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760550, "uuid": "c5342958-e0dc-4725-bc89-1ca65f1c69ee", "comment": "Malware payload", "value": "6bd8d9bff301eb2c68808be876658b64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760550, "uuid": "3a503ca6-c08d-470a-8b18-8ab02376f6f3", "comment": "Malware payload", "value": "b63920979ad36b52a0d1ae7322fac7ef83386293b0107fbe5b7a1d04ecd43d08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760550, "uuid": "1b5fb6e4-d7ad-4d48-900f-cfeef39d0612", "comment": "Malware payload", "value": "bc88ea292a1faaffd6c2afbd255a35bab2cfa91a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684760550, "uuid": "8ab1e460-3e8f-4347-b9fa-740de904143c", "comment": "Malware payload", "value": "29aa98edbf3df6a84bd26700921853cd83d76d7f740d252e92dadf951e4f2ad57be8942810e5c1ee798dd030ddc3b141", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760550, "uuid": "857ed307-74cd-4e9e-9b6f-2ef304b80214", "value": "T1D0252325EAE85873DA79137058F605530A36BE995C79879E2381CC9F1CB3280E8753EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760550, "uuid": "511cf9a0-213f-45bf-83df-e3d015501086", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760550, "uuid": "0235839e-006f-4bd1-bb73-2a9f9ef095b7", "value": "24576:Uy7I/Q57VnTvNMCMUvcEG9sNw4y7btQxsRSnQkt4KdQv:j7gQ57VnhfkSy4i9rKdQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684760550, "uuid": "3de9fe16-4aab-4735-88da-b8471cf38c28", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684760550, "uuid": "19a4e12e-f2a7-46d3-ac5c-54c681394015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684760550, "uuid": "4c6e4107-6943-4af5-8d67-a0c8f277c519", "value": "6bd8d9bff301eb2c68808be876658b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0c12b1-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752396, "uuid": "af59c496-2851-4902-bfe3-b52c2160bac0", "comment": "Malware payload (RedLineStealer)", "value": "faa0947cedd3dbe46893a29093fa24b0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752396, "uuid": "a055a8e1-53bf-49f0-bcf3-e816a2dd023d", "comment": "Malware payload (RedLineStealer)", "value": "b68f9696beab0ba69f827954561e22608cafb4463a31d1c1e6d17ba62c297d9b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752396, "uuid": "df1602a0-874e-4fab-b8bd-75daba56e85e", "comment": "Malware payload (RedLineStealer)", "value": "f7a2b72a3ca9ab51d6395e206f2c26f3350db5c5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752396, "uuid": "515c45f3-f12d-4b71-bc4b-40d8041559a4", "comment": "Malware payload (RedLineStealer)", "value": "cd7c9967daa4de3f7fc47d534cca86af65788ccb39513f6491220321c16bb48ecfad082f59e82c8b0b4d1a8455ea98a2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752396, "uuid": "20a33115-2663-4266-99fb-0b9efb395975", "value": "T15A252332B6EC443BD8F9237038FB07831672BCB59DA5875A3305E89A5D72698953073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752396, "uuid": "dd2aa8e7-9e9c-4716-a49a-7f7238ded5f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752396, "uuid": "2aca37e3-7fb0-477d-a6ce-34e124377c3b", "value": "24576:8y8ga0dSwKWDXnic632ryNDVDCLg0+AqcGaT3YJSn:rja0EwdnJ3gZvWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752396, "uuid": "c0889023-ed6b-4cf7-a0c9-e4087e885bf0", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752396, "uuid": "db3e2dc0-3fa9-404b-bfec-28559411c647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752396, "uuid": "0d7c10b0-e6c2-4a91-8037-43b91d199ea2", "value": "download111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4c1b28-f8a3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684761525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761525, "uuid": "6ce7908a-cfae-4bd6-9fd6-6755d86e4ed0", "comment": "Malware payload (GuLoader)", "value": "6399593bbec1aab9be0769c45ab256e9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761525, "uuid": "1d7d9819-8013-4c4a-baed-5e4ba326461c", "comment": "Malware payload (GuLoader)", "value": "b76774b8776d4bb73cdd7cf8589f1f61cc80af7486a9d9eaaf8c7e122e82c8c4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761525, "uuid": "5679093a-d010-4729-b8a8-cf12057794e9", "comment": "Malware payload (GuLoader)", "value": "763a6e8c945a562d88a896d80d50e24f668e9874", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761525, "uuid": "d3cddfe8-bde7-4a81-96ff-215205769555", "comment": "Malware payload (GuLoader)", "value": "66cb9c4f989f03094ff3319cd4b6775ea2903fcd36997a9296e89361d5e8972c405f7e6cbacdd63bf93820ddb425e4e9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761525, "uuid": "f1fbe841-52e2-4736-9021-fe610bbdcb1d", "value": "T1B3E209B1FA5517191CC7278EDC816840D57AC519253A03E8BDAD138E510ACCCBB7FBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761525, "uuid": "2a2e0d95-09f9-4052-8b8a-14c9c3ea95d6", "value": "768:iGnpzp2q1rAXDNTmZslcW4nLFmx7FzuwArg1mB/r:i2reS5hiFSwArg8/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684761525, "uuid": "5d59f32d-ae0c-463c-a09b-94162f4a0897", "value": 31407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684761525, "uuid": "cd57782a-5f51-4002-b285-c5283a8cad8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761525, "uuid": "9924bbd8-61ae-40d0-9366-11c249ef23fd", "value": "HOBL_WEB230130599.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f13da3-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vjw0rm)", "timestamp": 1684745409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745409, "uuid": "7887b6da-a204-4d39-8729-9a962bab040f", "comment": "Malware payload (Vjw0rm)", "value": "600ff23c99cac605541142deb6d59d08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745409, "uuid": "52b9bd77-96b5-4905-9216-a0e3cd221d77", "comment": "Malware payload (Vjw0rm)", "value": "b7c5d83bcb09217db3593681c1aab762b936b6bdcdef4c89b155ed5456d2224f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745409, "uuid": "63220a8b-1a49-4278-879b-4aaf776b9e89", "comment": "Malware payload (Vjw0rm)", "value": "609b030ed3ab2d856533efb140505ef77ab45e27", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745409, "uuid": "cd270aa5-2c3f-40f0-9ea3-2eace3e67b0a", "comment": "Malware payload (Vjw0rm)", "value": "448a688510add0d0c52b511b492b262aed55bf7de3a5076711c1b01a5be520d0b89f7ed7740daf2979a47c4cbd2cc32d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745409, "uuid": "7e862a95-25ed-41ae-b954-a66e7de9ea68", "value": "T10C26A0547D83A0C3EDD25EEEA68E51A5D29D3ACC20886949D1007CD03FEAD71EED1BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745409, "uuid": "ff7e6a6d-cd73-48e9-bac2-466bf1c7ef25", "value": "24576:SnSV1KQRkYy4g47ycfEVP75BupG6wcBRpY3xxc9pURy26cJ39ftFvxwv9NeiObv4:GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745409, "uuid": "6c434ad8-9048-4380-9499-58216f84bfd6", "value": 4615189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745409, "uuid": "f07d8093-6aaf-4c9a-a6a5-4207d61ba489", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745409, "uuid": "f0e4e207-0404-48f9-9d91-484b51b90e69", "value": "Order-POF561.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf0d83d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752235, "uuid": "e5d742e2-b205-4b7a-9793-98cb77ea98b3", "comment": "Malware payload (RedLineStealer)", "value": "52b3374637fef078d34d6b5afe5d993a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752235, "uuid": "22bc4fea-2e2b-4ec6-b9bc-bb32536a89c5", "comment": "Malware payload (RedLineStealer)", "value": "b88f68e1501438ed0cd140cb670acd1b52d7d362ab71b1391bdac6019d15bb2f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752235, "uuid": "dc7095b8-1ff8-4330-b035-f16faafa8fef", "comment": "Malware payload (RedLineStealer)", "value": "fa0c8d8dfca540b5064aa29de668d40deeba5681", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752235, "uuid": "e999256e-f5fc-400d-b5ab-7c52aa13cd74", "comment": "Malware payload (RedLineStealer)", "value": "f57250f84b2ac4f8a99cd52294731cd680c5ba847c37464d6e782f57b74a959a251f84bde086c87d8ff5e05d3fe84635", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752235, "uuid": "fbf25cde-f999-4149-a842-ff1dde09bc0e", "value": "T111252313A7DC9033E8B65F7006F71B430B32FEF2DD64A31B7759585A0DA2684993236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752235, "uuid": "815cffd6-c12b-407e-ba98-13743d2d30f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752235, "uuid": "b0d9df6c-ad46-462d-a243-e2421c2dcbd1", "value": "24576:1ydYLIe/32bPi+j+hOqDtYSZy5ytSi+WLHZ01mrhWO0rDbGe0dcH:Q0P3xhOqiSZvHXrhAb30dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752235, "uuid": "935e249a-5845-4abb-93ea-dd69c0150a69", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752235, "uuid": "cb8718f6-eff5-44b3-82e2-1998994f9389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752235, "uuid": "da31c7df-8248-4b2a-a3b0-53ef4a4d6a64", "value": "274711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0065defd-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752429, "uuid": "0b00e0b5-5b40-4d61-8860-ccc035f9ec76", "comment": "Malware payload (RedLineStealer)", "value": "f45bfb38b2c56dea93370c0af3d49e18", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752429, "uuid": "fe8e618d-080c-4b11-92d6-d381143b4ee0", "comment": "Malware payload (RedLineStealer)", "value": "b8f596aedc847b59c5ca5dcd67cbd9a982aeb336c6cef96de5782d6037519827", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752429, "uuid": "4abc0daf-89b2-4231-ba36-d952fea8b394", "comment": "Malware payload (RedLineStealer)", "value": "153d21e56bcb1735452903501a095006f063b5d1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752429, "uuid": "8bff405c-89dc-4763-9d4f-d7c6971f269d", "comment": "Malware payload (RedLineStealer)", "value": "2ea88e6dedc31cfd2d54690a1e75715287654e59c8b498557f43c7455183de95d0700ef63f2d57d1e3c4330a6fc2831b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752429, "uuid": "07d69841-80f7-4909-a026-e02db3b4b0ec", "value": "T1E7252322ABE58471ECB127B064FB0A530B31BCB0DD38C21726D45D6F9DB3590A67276E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752429, "uuid": "d85d2f13-40e6-4086-98be-49ccc2235bfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752429, "uuid": "c33ab836-f842-4b21-8c36-6ee8e8b7e219", "value": "24576:/yP4K4dcKeq1w4gqWTNVL40VOn0c79PqfTZE6w:KP46Keq11gqOTU0VOTpPWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752429, "uuid": "c8f5ae80-9093-4b47-874b-4e3c19332526", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752429, "uuid": "d3b838ee-5795-40fd-a8b4-a361384b61d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752429, "uuid": "6ea6efad-edc5-491e-8ca2-b256fcc6bec1", "value": "filter833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fa2008-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684762672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762672, "uuid": "9554e90b-21ef-4d4c-b827-defc282ff8ae", "comment": "Malware payload (AgentTesla)", "value": "97e28fcd5614c50a1ba71f9f55d13f12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Granti", "colour": "#F89EAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762672, "uuid": "ea3421c3-9e88-4959-97dc-d01bc81f295c", "comment": "Malware payload (AgentTesla)", "value": "b8f93ed64ae3d45de335e197bd70e9262b9921a7beb6d95e27dc5362007004df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Granti", "colour": "#F89EAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762672, "uuid": "7593f626-f39c-46cd-9268-100a8545f091", "comment": "Malware payload (AgentTesla)", "value": "d161bd1742a77991f3b602561825317adb835c2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Granti", "colour": "#F89EAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762672, "uuid": "972cf673-aa7f-416d-be2f-603053ffa807", "comment": "Malware payload (AgentTesla)", "value": "23925b12df676cdf165db7146ad24abab3102178e980caf6c9f0162bfbebdbc90a9ed6a656692e9b88d3900b6f98b7e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Granti", "colour": "#F89EAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762672, "uuid": "d194d605-b167-41cc-922f-0427e21aa5cf", "value": "T194F49C5233B57621F47D33FD0019638DCB39B44A2122E21A1F5A3AD552E27EB770A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762672, "uuid": "8365bc34-1a94-48d9-85eb-3a3515640f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762672, "uuid": "11109f79-33d6-4e8f-9b4f-2f46ffa716f6", "value": "12288:EvV+s1bSQT6tjjdB4kY4uzXfJt8PK4XwtUtyyXe36B4tXLBSOjbQFSgOnHnTMHNL:EtG/uzXfjEVXwtnDHHQFGnHnTENeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762672, "uuid": "598c5b4c-6f0a-4ba8-a6bb-53c5ec64d90a", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762672, "uuid": "f0786345-07ca-49dd-a01c-7207692fdc3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762672, "uuid": "51819e38-39f6-489f-8e3f-7ed7ef11f8d0", "value": "dekont ( 65).pdf Garanti BBVA scan0010F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d470bcf1-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752355, "uuid": "3477bd40-61c4-4b36-8fad-bcd3738b3d6c", "comment": "Malware payload (RedLineStealer)", "value": "0311ae7dbd5e8fef1675437c9fdaa5ec", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752355, "uuid": "90b935c9-c90f-481a-9632-dfb72e956183", "comment": "Malware payload (RedLineStealer)", "value": "b9453ebd30c21479b5c48841cdf205f44ed9f9ddf7185d0d3b6b041272e40d47", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752355, "uuid": "248c41d1-e12f-49a2-981e-b133b461398d", "comment": "Malware payload (RedLineStealer)", "value": "df007c8b4e5b78cf4b4155357b5d41e24ab3a149", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752355, "uuid": "4ead2def-f47d-4529-a776-306e4d66893c", "comment": "Malware payload (RedLineStealer)", "value": "c201174c84375a46315403f355470268959d30080ae4fc79106d47e4f834cf21f28441b80b18f36989e9c9f456690cb6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752355, "uuid": "b82bab48-1f3e-4997-92b2-16293eed0c6e", "value": "T14C252311AEE45476C6B42BB058F617930B317D92E5B8C2EE27D8894A2C73DC0A0B775B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752355, "uuid": "78c62ae4-5324-4715-9946-c1a9d19d4397", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752355, "uuid": "acfff598-fe8a-4f4e-8df4-fbdbf6e79391", "value": "24576:w/yIvwdRII+sRTY07npdXvwnMkAEAo8DKfLni61PTjYSV:wKJdRII60bsI9uiKTjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752355, "uuid": "63676c6a-9c55-417e-81b6-27ccc2430dc1", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752355, "uuid": "a5dcd4f4-d127-47c1-abc4-2ebfd225bc7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752355, "uuid": "babea8cc-f618-4f16-a10c-6b015bea22b5", "value": "catalog135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01b6c4a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752348, "uuid": "3db0e649-fa8b-49f3-a1f0-3032251ddc5b", "comment": "Malware payload (RedLineStealer)", "value": "187358b96b9b58aeb82c4908be69111f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752348, "uuid": "63c132c4-e57f-49b2-83c8-07ccbcefe7c1", "comment": "Malware payload (RedLineStealer)", "value": "b9668618f2897dd8ae6a9b04bfd438a757b7bfa72bf6a01fea3d7370869ecf86", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752348, "uuid": "8b2101e7-98c9-43b4-b7f2-84f489de92fe", "comment": "Malware payload (RedLineStealer)", "value": "d5a35bd9d52d26d7ea6c25575bbec317640256d6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752348, "uuid": "d0f8af0e-2f9d-4702-80e6-a392e2e186b0", "comment": "Malware payload (RedLineStealer)", "value": "bef5537d5231448d761d20215bc332ad98e6f9b23415ec32db9e133673047c1f93f768f1001a0bc2cc0dea0bc6816458", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752348, "uuid": "d0164da1-7b0f-4bb4-8f01-25cb7094a26a", "value": "T1CF252312B6D480B6DDF837B0ACF612832B327C219DB4525B1756A8271D33699BA3136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752348, "uuid": "5677f7ec-b172-4196-abc3-1968e7afdc40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752348, "uuid": "e5fbdcd0-23cc-48d4-9f34-d873e1f37727", "value": "24576:/y3xfGAXoGzQoJK1hMm8+D1x0KTyC9Z+Jz:KdGADPJKnMX+AKTyQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752348, "uuid": "9071ef95-b766-4b9e-b0d6-062c803c1dbc", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752348, "uuid": "4c23b0e0-4fb3-47c1-8959-e1476f47eb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752348, "uuid": "765a8d6f-fc81-48e9-9d34-e270c2343cc0", "value": "builder554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e15659e-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684779510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779510, "uuid": "776080d2-798e-4657-8cb9-6c64ba982f41", "comment": "Malware payload (SnakeKeylogger)", "value": "4ab52b6c3d4524c160e1aad2e695f895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779510, "uuid": "b84bdb87-7df3-4419-a907-dcd1953863ab", "comment": "Malware payload (SnakeKeylogger)", "value": "b987909b3f1859141562a9206ae1e8d64102f7675c8a4b69719257eb5998fa33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779510, "uuid": "1f614848-3afd-4d29-ac4f-4e9c6c97fa81", "comment": "Malware payload (SnakeKeylogger)", "value": "2078e02d41ca44c984e92b86ce8e8a5e4cb96d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779510, "uuid": "9dfae4e5-4fc9-4413-bf8a-c7a3711ad6d4", "comment": "Malware payload (SnakeKeylogger)", "value": "60e318ff2b1153dce92db0fb3801a47a190f7424dcbc8bb8ccc26fccbca5d863325a492ea9a932b0b938886b10a353ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779510, "uuid": "38391e8d-48f8-4b08-bc50-0925c12940b8", "value": "T1F706CF3101ABFCEDDBAD2934E4896A250CC86CF7A12445ACBEC539EB36F5344D8719B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779510, "uuid": "4c2441ab-1cc4-493a-818b-35245abdfefd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779510, "uuid": "42dedb6b-3d28-499a-bf98-21ed616ff3bc", "value": "49152:USjJh6s4gME6SZCuiYGozum/vSN6zY7FtPYn9wE8f:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779510, "uuid": "a47eaa98-e828-4337-82f9-962b3e4340cb", "value": 3893760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779510, "uuid": "1a915a2a-e24d-4241-90fe-7e0b3dff0e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779510, "uuid": "902b2d4d-6bb8-4879-abd1-0c76ddb85a93", "value": "inquiry 22052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10004280-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755891, "uuid": "8c2757eb-242d-4502-b287-bebccd8093a9", "comment": "Malware payload", "value": "ef6570a66fb41d7522fc48c53e007d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755891, "uuid": "afea163d-fbbd-48a2-b0d6-2ac992256ca6", "comment": "Malware payload", "value": "b98d1d6f825e3c8b2288797f4615d27ed79d75e78760269f2573128552d510b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755891, "uuid": "3c56a9f3-942c-45d0-a655-e9b8cb03620e", "comment": "Malware payload", "value": "a5e4d845fdb15bbee0b386e5c79a949b3a19b53b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755891, "uuid": "ad8aa5dd-1562-42a7-bf5b-252b7d8a7a50", "comment": "Malware payload", "value": "d658aed4e155f85195354070c0e7b58c102d733e12b700253b4b47f3836bcd54676221f02b0fabe91d095d5203583a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755891, "uuid": "58fd1a78-45fc-490c-acdf-8627bb95e713", "value": "T15564011BFBE71065E4F72AB11936A1991A3BBD56C77092DF8740F11C2FA14A0E97C321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755891, "uuid": "b679c67e-3e75-4ae3-a438-f9053b8a6d9e", "value": "6144:rHJWcw5ZLFn26hf5lakYx7VkBec9mGr1lyyfndGwj:rHJWcmZL86hBixBbcMGrnBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755891, "uuid": "77d4e3b9-15ec-490d-a181-189f900277d9", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755891, "uuid": "e6fca3ca-b2be-421f-9352-007a4df828d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755891, "uuid": "0b5ff71f-e10b-473b-adab-ff5ef44e6915", "value": "SecuriteInfo.com.BATCH.Virus.11944.3523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229d3cb0-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684744755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744755, "uuid": "4417c4bd-349f-4487-9e4b-aeab404cbf00", "comment": "Malware payload (GCleaner)", "value": "dd9d9909401908a30b828dc6e7e29295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744755, "uuid": "2183625c-309e-4a38-aa93-8bcd1eb40520", "comment": "Malware payload (GCleaner)", "value": "ba0c05d725946666f05196ece5829f5c034c4ae91aae98893cb506caf23f75df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744755, "uuid": "72be1dbc-44f0-4f86-a9bf-cce647451f80", "comment": "Malware payload (GCleaner)", "value": "4ec89165ce876ffb969b8d3db9f9aa638bdecb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744755, "uuid": "5a1fa0af-b708-4477-a1f6-5ecf1f98de96", "comment": "Malware payload (GCleaner)", "value": "8af3d554aa1555e494018ed0f96a07b8c2fe5c5aa4fa04cc67d2484b27694f8257b901de835ba54418391ebb858e6025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744755, "uuid": "87b93e99-b100-4428-b4c6-3d145b09ba69", "value": "T17074BF02B6C2FB31E96596318D3AC2B426EEF9514F152BC777543B6719322E3CA32742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744755, "uuid": "adedb245-022c-44fd-8968-681545bb2141", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744755, "uuid": "1c7ca9d7-83f1-40ac-b7a8-8a9e0d8721ec", "value": "6144:QBp/UlNvAxRXHBkKeEwxCenQ340adeqKqT:cUov3SlVZQI3Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744755, "uuid": "dc293e3b-8b65-4c95-b9ba-54796b91dde2", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744755, "uuid": "07339b2a-b868-4c8f-ac5e-cb9481e78967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744755, "uuid": "b777b2bd-d65e-45ac-b565-be9f84704560", "value": "dd9d9909401908a30b828dc6e7e29295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b698315c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752305, "uuid": "2972c60b-be55-490f-b15f-69068f7c660f", "comment": "Malware payload (RedLineStealer)", "value": "c5cfeee2b19e4856944d6cdead70bd48", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752305, "uuid": "029333f9-57dc-46a1-a621-9bb60d56ed74", "comment": "Malware payload (RedLineStealer)", "value": "ba14e9ce866905888cc84a26e6e22d23facf85261afa218b6b70262547042153", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752305, "uuid": "9de2af8e-5f7a-410a-958b-0ce36ec1c674", "comment": "Malware payload (RedLineStealer)", "value": "002e74c748e2f04e114a433a0a646c13bcaaa480", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752305, "uuid": "f0701c6b-f874-4a91-884c-ac730bc1b41b", "comment": "Malware payload (RedLineStealer)", "value": "4eef9ee515174b48fd9b096cdbe95e6be34dce82ab9d55274d47cb1db9a39902af78605ee85f0cfdc1b05c07633f1586", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752305, "uuid": "c3fd5cd9-4ee3-4437-9fcf-4fe7eddc3eb2", "value": "T15C2523036BD48073DDF4AB7048F5029B0B3AFC909E34837B1A59AC974D756C8A87676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752305, "uuid": "49f9708a-4e7d-4bd7-a513-2108811cb06b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752305, "uuid": "23dc3ec2-1261-4aea-b1d6-5408ed184485", "value": "24576:+yFaVwgpSlinYTnql9WXfEtTyHTIm8KzkI3Ia1saldw:NFqYJnqfWzIZK44R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752305, "uuid": "e6fa3e21-e0f3-4cc8-aa58-d428d0934a3e", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752305, "uuid": "5b4a405c-bd84-4299-b440-82c6b0d254fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752305, "uuid": "d415fa31-9acf-4643-9ed4-8532812f9ca7", "value": "Setup603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067f7f89-f834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684713784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713784, "uuid": "cd08ba5d-520e-48e0-9996-6028f85b3517", "comment": "Malware payload (Stop)", "value": "3e1c0245734eb8e3e000901e164705c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713784, "uuid": "c81e2898-6537-4aef-a4a8-165ced9afeb6", "comment": "Malware payload (Stop)", "value": "bae772606108ae73c38008179f4258c67a3e940e5e82d89803985c091e541624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713784, "uuid": "0b4a58d6-91a7-4391-bd66-cca0af87456f", "comment": "Malware payload (Stop)", "value": "39f07a7b0bca1692171285734d5b80bc613f7089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684713784, "uuid": "04d05dbc-3755-438d-80f2-fcf2558a2b2a", "comment": "Malware payload (Stop)", "value": "0f7dc48bea184623585427e235a5b02c5c903c4cafa72b196108eede85e350ed28200d66cebcfb85adf6b7eb607d4e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713784, "uuid": "6f91fbf9-155a-4d72-bb82-14121499dbe0", "value": "T19305F10362D1BC61E62646F19E2EC6F8761EF9608F093BD72B445B6B29701F6C672F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713784, "uuid": "5dfdeebd-b635-4cfe-a2c0-5b0433f3e825", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713784, "uuid": "0a10138a-b4d6-4ac2-b809-f5f2f37325cb", "value": "12288:UDApEebqMQFVnql5Cjs6GoFjw2NbXqkE9iZMOYW4SgpSmjhX/H1:KAvbTQ7qlb6GUc2dstOYfSghp/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684713784, "uuid": "2758666c-bf19-4226-bd2c-488f95a22e45", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684713784, "uuid": "82ba0595-69c6-43f9-82e1-e9dfecd7c485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684713784, "uuid": "b28ac0ee-537a-4c84-bbd1-6b80807d1618", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d09ec-f88b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684751186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751186, "uuid": "5a7c3030-156a-4578-a277-6b6663b6f10e", "comment": "Malware payload (GuLoader)", "value": "32242150aaa493a53c356b6f05006915", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751186, "uuid": "3252aae9-9a06-4aca-b721-b6b8112d4b3e", "comment": "Malware payload (GuLoader)", "value": "baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751186, "uuid": "b51ff976-d466-4c81-b32f-705995db5ff9", "comment": "Malware payload (GuLoader)", "value": "50cb5fc894eb8f0d35fe2753ba022dcf21af7f9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751186, "uuid": "ec624600-8d06-43ff-a23b-bf2d8789736d", "comment": "Malware payload (GuLoader)", "value": "ca40bee0fa4200614c16bdd174e93c31bd160227e36a0dd1f9eb0f97ec74351edad5ea0be0b8a1071887ea07bdf1edc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751186, "uuid": "4d24901d-9df6-4a92-a1c0-9ccec7f9f37b", "value": "T142D4E0023F2CA55DD5F9C6752747CBF60FA5BE2AC8F152CAB7C5731C68B85820A8E502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751186, "uuid": "f1ff1dbe-2286-4089-a85a-df8f6c4fdd6a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751186, "uuid": "c96705b9-b5a8-4c08-94ad-531dd170b71b", "value": "12288:04+L3gMNEauRir739U+BXLDNenuY/woW/jn8C4ROKQiEE7GQ:a80EauRir7NU+lpen9Yo8YzROZfFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751186, "uuid": "a983f834-ee56-4f36-8a74-47f4c9a5e3b4", "value": 640488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751186, "uuid": "8cdf2e85-ea47-4355-a0bf-35df4adab48e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751186, "uuid": "6cc1d87b-3c87-468b-aa44-dc55ea1c3558", "value": "22-05-23 SENAL TRACTORA FIRMA 23-05-23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febd546c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752426, "uuid": "685258d8-0335-4530-8bfd-b34de6663dc3", "comment": "Malware payload (RedLineStealer)", "value": "3c471059f49779bdf6528b0f4c377b3c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752426, "uuid": "b1a44b2b-7450-413c-be6f-494cb9a4e374", "comment": "Malware payload (RedLineStealer)", "value": "bb2da6fa8177864f2a2bc28a61fa461633b1fc9bf2d3b243f260e05068f1db41", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752426, "uuid": "17da7dc2-0856-4b21-977b-396b9575dbb2", "comment": "Malware payload (RedLineStealer)", "value": "a48ed3466145ac73535d574fc5b72c8c6942af08", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752426, "uuid": "92e88e67-a4d9-4ed1-bae0-f3aaaaa26aa7", "comment": "Malware payload (RedLineStealer)", "value": "051e9fb251f1b0ec2d6d48d59caa25426fe2b39f514b4de830999ce359ffc500fec158b175073afec9c73556452531e1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752426, "uuid": "16470357-0e70-42f7-848e-228e1b98c4ca", "value": "T135252313A7E9943AEC72177040F703D303387DB25974875E67561E0A6CB2E94EA363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752426, "uuid": "9d962b48-3321-45cb-979e-f5a23bd38d7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752426, "uuid": "5b4c6a03-46c6-44d4-9b48-ee6faee6ab26", "value": "24576:uyeXr+9C3SxLVqxzfSKLHeN6LODBWkCET0OCp:9X0CxLVqx1LzaDBBT0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752426, "uuid": "e64ef595-5e10-4fc5-8006-ac02db069e3c", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752426, "uuid": "29b093fc-b042-4fc5-8c4f-10632fedd46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752426, "uuid": "9472c76a-ac75-43ca-8da9-c57599cd46d5", "value": "filter402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76999e30-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752198, "uuid": "2e8f8ecb-ac59-43a7-82be-3b825ca151d7", "comment": "Malware payload (RedLineStealer)", "value": "4f0f0aa2ceacdf1aed34df9eeb921920", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752198, "uuid": "5e799d8d-93c6-442e-acf1-51da2c06d6b3", "comment": "Malware payload (RedLineStealer)", "value": "bb3b3739947b9f982bbefe2d750a454709acd4bdd4b25fb6f988819645f72952", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752198, "uuid": "1c74661a-7cd0-4066-a429-ff9e8b2ba448", "comment": "Malware payload (RedLineStealer)", "value": "e647f0de0274b16ffc59c8e5a918bde2db562d36", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752198, "uuid": "0b1db42b-67b6-45de-b4e2-b84f19aa0f2a", "comment": "Malware payload (RedLineStealer)", "value": "6704cd02f9b7d1c432a9cb79dfeb33fc49dc04dae515b926d771820e78dad52e5a82e2cf3eec67f955bf708ce0f9095c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752198, "uuid": "6938e30e-6d8a-43d6-9d4e-1ac3cf689191", "value": "T129252302D3E88073C8B4377058F721A71B35FDF0A975976677866C2E28B2B989435B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752198, "uuid": "9bcbb377-8a6a-46bb-a8ad-98bdb1746376", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752198, "uuid": "e819741a-259e-4235-82e3-24d2720d7809", "value": "24576:UyUoGh/QqARhfIyFzHXj2jwCVBQ0aONEV:jUX5QqARhAyFjuF+0NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752198, "uuid": "29b2fa7f-8278-4ab6-a204-acc90be670d9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752198, "uuid": "595b7192-9f8a-4b57-9fe2-d2d84dd2545f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752198, "uuid": "03c16456-5250-4951-8697-e30e99fcc625", "value": "21324177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8aa9bc3-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751906, "uuid": "7ef165d3-be2e-4e9f-a756-51fa20781cb8", "comment": "Malware payload (Amadey)", "value": "b9a3cee12248fc3501ea7674d38bf02b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751906, "uuid": "5f854527-e000-40e6-ae74-006557e0a014", "comment": "Malware payload (Amadey)", "value": "bbccd794b3654404597930562f981cb5a4831e1f6a3f664736502ced432d9bb6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751906, "uuid": "4fb4a5c7-f5b6-4875-bea4-ef544c2fa082", "comment": "Malware payload (Amadey)", "value": "4d704e39ba976c55d14bb20fb284a8a62fb3541c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751906, "uuid": "e1e51e02-dd4a-457b-9ae9-f415ca71c55e", "comment": "Malware payload (Amadey)", "value": "3b7cf2b5b576f0e2468d1d59d3c3844e2a6120c7ee451461b24954869722870001105b46ce67704e02cc6e9a6f55aa52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751906, "uuid": "241afb0b-6264-4e5b-9fed-3f3ff103e8d9", "value": "T1BE252306A7D58076D9F927B444FA02831A31BD928E68D3CB33D5789E0C731989A7637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751906, "uuid": "359f886f-35cb-42d8-a207-e1cd37ff33ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751906, "uuid": "a983e16e-07c6-4e76-b300-0682b3bab148", "value": "24576:6yaMzwGxkVKSnvc9m+0L5jzuGhSA0cH6Vy7T7q8E3I:BbkG6AXgzTcUagTOl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751906, "uuid": "83d5d63c-44fc-441b-a967-3cde44536359", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751906, "uuid": "821d1de3-fd15-40d4-aca6-c976346aa970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751906, "uuid": "8cad877c-0a3a-4a36-8c0b-73f529d06a22", "value": "debug271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0105660-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745959, "uuid": "762011c9-6f71-44e5-852f-db653af033a2", "comment": "Malware payload (RedLineStealer)", "value": "84bb9599ce3c21f987717207163c0a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745959, "uuid": "d7185fb5-efeb-4f29-88cc-d759a2358af8", "comment": "Malware payload (RedLineStealer)", "value": "bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745959, "uuid": "79b8ae4e-8c80-4f42-9dd5-36fece5f3395", "comment": "Malware payload (RedLineStealer)", "value": "0e43e8452ea288b84fd0630e03a3b00e3cbfda09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745959, "uuid": "a8c72c1d-0631-42a5-8c53-f731764b2362", "comment": "Malware payload (RedLineStealer)", "value": "2bf0c10507ff0ee9162fb72b425d2f491eb0594de853bbd3ed45fe6e3aebd2fc1304931e3292df54f369c4a438ff8ee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745959, "uuid": "3dab4d1b-4ea1-4bdc-af3f-68c6ea295e15", "value": "T17AE55A56F27B0411C1D9883FAEB10140DDA8B9BD184ADF43E6984F9E5FBE68214F4E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745959, "uuid": "a7e265ea-e52f-4cda-a334-8b94cda68e9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745959, "uuid": "82297969-832b-4b47-ae5b-c4fd096ecce9", "value": "3072:Ffd7R6tb/jBP26oxTsitGIRTbW+xqRLOQt0OVvVGb31f3PG5YB:f7ybs6pgGsbJxqRL50OmZPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745959, "uuid": "2ecfa47d-a7d7-4df4-b1a6-5c2763f84a8e", "value": 3145728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745959, "uuid": "5b9c731b-f8de-409f-b37c-b4a2bfb80d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745959, "uuid": "2afc475c-9669-4fe9-b36b-63f34df61432", "value": "84bb9599ce3c21f987717207163c0a3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883ea69e-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752227, "uuid": "39e9d9a3-3dd4-4bdc-893d-fc8fcd271c80", "comment": "Malware payload (RedLineStealer)", "value": "0e22309f7b5ad60e212f4c9d5a7d6ae9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752227, "uuid": "8d52f625-484c-4b8d-8fb2-9e474b7dbe58", "comment": "Malware payload (RedLineStealer)", "value": "bc0beac231dc96b975e928797b5996a8b9ccefa9dbf53cb8dc30cd7939caa726", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752227, "uuid": "bdd7ff13-209a-41a8-a537-2b0e5bddc88e", "comment": "Malware payload (RedLineStealer)", "value": "7a87c7221dee17a3e9beeb54b0375c8e8d6837d4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752227, "uuid": "8a4fccaf-90cb-42d4-8af2-56b368c807ab", "comment": "Malware payload (RedLineStealer)", "value": "3e4afa5a4407c87697362e3288024f5b3d8902ed6d5e0a0b5230c5f063792750031916e5c21e3f0e2a451538448a61a1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752227, "uuid": "3e2a149c-c722-4c99-b71e-33d0e9d7982c", "value": "T1CB2523233BD84072EC6627710CF302D32A34FD649BB492572A89559B1CB3690B876FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752227, "uuid": "1c7a63d1-27b3-4e69-8533-52a6cfbb0721", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752227, "uuid": "23428129-1125-4755-a3e0-d4b6a4d1710b", "value": "24576:TyI3QW/bhbTx4cgg+q+TXGdds/u57X+eAbx/FpKNOTI3D8u:mI3QW/bh/Scgg+qy4q/uYbN/Fp8OTI3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752227, "uuid": "1e477b4f-d540-4419-a712-fb2e5ee45dcf", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752227, "uuid": "0f923695-3805-4dd8-9b4b-5624fcdcee2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752227, "uuid": "e557b104-6bd8-4481-a74c-dc7a1b7a758f", "value": "248990s932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6547231-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763015, "uuid": "43ba728a-c2b4-48fc-b13d-701a541351bd", "comment": "Malware payload (Mirai)", "value": "7100d6f71705ca0bbe22009a36fe0dee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763015, "uuid": "2cf1e3ba-1dea-4aa4-9fe0-cde0c8b278cc", "comment": "Malware payload (Mirai)", "value": "bcd44528640e8337ed44e6b374e34e31379792223e39567c4040261ca664838d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763015, "uuid": "b3ebccca-c8b7-446f-8722-8cb2cf256c50", "comment": "Malware payload (Mirai)", "value": "9ad2951d2cd9df9e4a8aed8ef46d1f6136a39c1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763015, "uuid": "d819b032-1272-462c-9b11-74862553af2a", "comment": "Malware payload (Mirai)", "value": "ad3394f0de860000db22b06baaddd4822774992d3e40c9269e489619fe11636fddad91a08843b01e1a21aa7c4ae1561b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763015, "uuid": "e2a56b43-4ef9-4ced-b3dd-992669c977f4", "value": "T121631A85BC418A26CAC512BBFB2E418D332A57ADD1EB32039D15BF2137D796B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763015, "uuid": "4bed26cf-f968-465d-87a7-d8f334c2ae57", "value": "1536:4WYQ3BXeWPewnLpToBa00vIc2ZBMjIFcfrvM3khsdU862sv+rG:3d3BOWPRLpTea00vl4esFcfrvM0WdU8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763015, "uuid": "d1012240-6cfa-4e67-b38e-db13d3b76dec", "value": 66992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763015, "uuid": "f4e06b9a-3c6f-4d09-888a-6a305ceb3b10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763015, "uuid": "7ded639c-e32a-47d1-bbb4-13e237c07bb3", "value": "7100d6f71705ca0bbe22009a36fe0dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9997cfa0-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752256, "uuid": "e38bf88d-e970-43b8-982c-b77daef0e749", "comment": "Malware payload (RedLineStealer)", "value": "a5f1ea7b7a2390c021c3ea154f71797e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752256, "uuid": "535109af-2f08-49a9-a490-38dc3e1848f5", "comment": "Malware payload (RedLineStealer)", "value": "bd14b2fa825264e84a56c89cb37cefba98fc2753a8422d7574be88f2eec6ea65", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752256, "uuid": "ad5eaef8-5177-4195-8ff6-878dd996774f", "comment": "Malware payload (RedLineStealer)", "value": "43586054df5e815017da046bfae40eab6dfbb04e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752256, "uuid": "34645373-5484-4237-875e-8fb2bcb23177", "comment": "Malware payload (RedLineStealer)", "value": "060601972003c8954826090bf1a7754577cd3bac1d65652537e902e49c1cd369d263c5b0a29bf73599f2c1d29ee21e42", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752256, "uuid": "bc429389-c5f8-4129-81c7-5c00d78e6b56", "value": "T103252316A6E98873FCB5A7B818F953830F327DB1492C835A75897A4E08B31D1E571B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752256, "uuid": "54d541dc-a9a0-4e71-a85c-19715584fe9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752256, "uuid": "9e8331e0-02ab-45c9-91b7-d46455545e87", "value": "24576:QyYh98J0ijGWUFgh++Rr9Lje3hla4owljyWW8erfNi:XYenik+Kr9+hwrRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752256, "uuid": "65c32111-981b-4fa9-9e3d-6c1910cd5019", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752256, "uuid": "daaee0f6-df00-4533-b597-669b5f2ebdb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752256, "uuid": "93650a18-5d9c-4725-b6cb-1b3d6bc806cf", "value": "42345997.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3af835-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752420, "uuid": "ba21d867-c345-4ee4-89da-9e91282b936b", "comment": "Malware payload (RedLineStealer)", "value": "497a45950203e618980f2e4545f9838c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752420, "uuid": "45e6ff60-62ce-40ea-b64c-ed42ad2cfbe3", "comment": "Malware payload (RedLineStealer)", "value": "bd48e85f2607991dc27704ad7c4367be0cf6e46aa08de8342ab4d8909c0f2c10", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752420, "uuid": "19820580-f8aa-4368-b1ba-ccce11af7844", "comment": "Malware payload (RedLineStealer)", "value": "d7109011a2a588da37eb89e6f3a2cfab4de7e4db", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752420, "uuid": "7ba43b54-5db8-4cce-9364-df09cc9fb2d8", "comment": "Malware payload (RedLineStealer)", "value": "54890d1e6d1bf38b0359053b6cc0ff5cd00e83d0459d65ee07194c999ee88eec4d7f6b907f91b27cb50a721889347bf7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752420, "uuid": "facefbc4-24eb-4987-acb4-c0036be1c3b3", "value": "T16B252397ABE84862E8796770DDF301C30B35FEA18839C72A3B15691E4C72684693573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752420, "uuid": "e94842ac-8088-485f-8ab7-0a9839e4566a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752420, "uuid": "dde7d4c7-6e0f-4bec-9c14-474db7fa777e", "value": "24576:Wyww5Y4Yphy72eLSqLpFpI8gUkcm9yjVSfMJgQQ2PJKnVo:lwbI72eLSq7pmcmUSfegQQ2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752420, "uuid": "d28f5910-d279-41ab-b64a-0898403a42ad", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752420, "uuid": "3c3d2243-580d-40f9-82bc-d109bd7ff647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752420, "uuid": "bd099e2c-edba-47de-8bef-84abb90875c2", "value": "file429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1811e180-f885-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684748603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748603, "uuid": "94946a0b-b632-41b9-a0f1-9307d1ef34f7", "comment": "Malware payload (AgentTesla)", "value": "8689df974a7e34d98ab1b283cb18641d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748603, "uuid": "b7afce6d-ef63-4bd5-bbe6-1f72ad2b5113", "comment": "Malware payload (AgentTesla)", "value": "bd609ee07cbb567275cc8a8b7a1c1e3c14f61f778f18b90b6454ad68c64cfdd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748603, "uuid": "0e15f4e8-e989-4b7e-b76a-1120e9f14fda", "comment": "Malware payload (AgentTesla)", "value": "91ccff7d416a5bf7fd5400ad230e194aea2d3df5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748603, "uuid": "31295322-d332-400f-8a61-07972e8a9fd2", "comment": "Malware payload (AgentTesla)", "value": "fcda69d4efe338399597943057c0d08b009f221221f2e7733bff8cbbb05b527f2ee2b7f3e617c923a5bc22bc0280064a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748603, "uuid": "2f07d7b9-96f9-41ff-ace5-40d017a13c9a", "value": "T11EE4F1C136988D01E2AB5FB959B2F63403747DA5EB23874924F42C9B7C66E823B017D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748603, "uuid": "ef7748ac-33ce-427a-9916-52c815ffd178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748603, "uuid": "6d038287-5df9-4a4d-b4d5-917a8bd56046", "value": "12288:7T3x0YPX/NqPscEWSfC5hMVvXPJPFNrOIs5h0m8GxwLKsTCP6y:7TCHPsr5fEhMJVrs5+mmusTCP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748603, "uuid": "ca907926-474f-4f05-97af-413b696aa9cd", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748603, "uuid": "f800996d-b946-437e-b4a3-099ec97cddbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748603, "uuid": "f8ff906f-ad72-455e-b4f2-69064d7002e1", "value": "8689df974a7e34d98ab1b283cb18641d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dddae42-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752210, "uuid": "27c65224-bb26-4846-a94a-a85385c182ac", "comment": "Malware payload (RedLineStealer)", "value": "f2716a80d819000ee6411b2115574146", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752210, "uuid": "66b651ad-202d-4405-920c-00d1ece13d82", "comment": "Malware payload (RedLineStealer)", "value": "bdc9bff933b4951a5a7a1f1d7ffb9cfcc7fe7451dd026e3d064390631d75d729", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752210, "uuid": "e05c5ced-89fc-4860-9c06-214bc4e6f674", "comment": "Malware payload (RedLineStealer)", "value": "be2f1ff420b2a1c0082ac8ea1262aa70ab8ac47b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752210, "uuid": "1d72a0b7-7efe-4ee3-8bab-7c52c56e6903", "comment": "Malware payload (RedLineStealer)", "value": "0dc669058c384636708131b042d7a6ec583e58d327e3e28563d1c66704dee0acaae9544445a44a2b394799e6c5cf0d59", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752210, "uuid": "59d09a80-fb20-4ea8-9b00-1fceb3160998", "value": "T1132523029BE54563E8A9573049F387C30B37BCA6CE38C27F6741A99A1C71698E53532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752210, "uuid": "20210372-d6ac-4efc-822c-5c8e2c152d61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752210, "uuid": "5371dadb-333a-41b7-a397-99e28ce604fe", "value": "24576:4y7oOEezgW2sjH+M3v3hkVO2apHi/1PuP+NIxoLX3IPYxJ:/UPsD+MhkVOLRi1DKWX4Ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752210, "uuid": "12c7f8fb-71e2-4c31-b747-fb638b532617", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752210, "uuid": "e951ba7c-a6c8-4dd4-a713-2eb5d53acf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752210, "uuid": "bf5ab039-c9f2-467a-b31a-3e00351638f5", "value": "24468211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9802648d-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752683, "uuid": "73821e03-c7ba-4f1f-9f3f-0e6bb63bfff9", "comment": "Malware payload (Formbook)", "value": "8ab700318069969083a8647e236623e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752683, "uuid": "6f264e9c-3ff9-4506-8534-a37691a7a8dc", "comment": "Malware payload (Formbook)", "value": "bde2918cb64c5e7a60fdd3efb2a0a11bd352210b61c600a19f5b47bc61e5b2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752683, "uuid": "55b498c5-1e9d-4bc5-9fe2-db7ff90ed267", "comment": "Malware payload (Formbook)", "value": "b80debfed73f923c6e1f4c0c67a27e3d8dc6035b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752683, "uuid": "1ba81da8-ab80-4720-adb9-042ac5f577f0", "comment": "Malware payload (Formbook)", "value": "d5d253f7a6d667ba771546fbde7977e6639787e28a14ce741c99ff3b44146a93c0b63d3c5ec42f2d6c812f11a1bfc7fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752683, "uuid": "58d52e91-91a3-43fe-8ada-7be922d5c5cb", "value": "T18325CFC527244D4AD0812B789F92FB381B745EF1AF028618B5E02E6F7CBEB567D02752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752683, "uuid": "a8858289-6144-46a3-bc16-7e610140fa0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752683, "uuid": "fdde3d1a-7b5f-452d-a539-895756306691", "value": "24576:xT8HPsdoX9C4wgYm4edU+qjGxThy8uPeq+8my:6HPsdOC4wg0+qcNq+8my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752683, "uuid": "35c60447-c1b3-4020-a8e3-3870a9dbbb4c", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752683, "uuid": "d894f3c6-1719-4eb5-8349-86ca8c640af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752683, "uuid": "803b757f-f44a-45c4-9c59-afbe5d11d7c9", "value": "RESonak Corporation new Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46626ef0-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684745245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745245, "uuid": "f8a61ed2-ee51-45cb-ab68-b41ada5828a9", "comment": "Malware payload (SnakeKeylogger)", "value": "0ccf77a8618572e7db472deb75721667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745245, "uuid": "fe67ee93-d0f2-436d-874b-20ef2e3f174d", "comment": "Malware payload (SnakeKeylogger)", "value": "be493996dade9c217151bd2f63fe9310d34ad997288d40de3fabdbdbf88cc450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745245, "uuid": "cb0d6a8c-4dbe-4027-9732-75d377adde44", "comment": "Malware payload (SnakeKeylogger)", "value": "8a7bed64958921559c66806efa1d8869eee7993b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745245, "uuid": "6e3d5f67-9bed-4938-b102-565d21cdd7dd", "comment": "Malware payload (SnakeKeylogger)", "value": "1d9909b3ad6f048cb15f9c63a17fb8651e3214c0b95fc1ca26c383eb9a7b1a5f32c17e0d5ece49bec29e9d1227da935e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745245, "uuid": "f3bcb0ac-2839-451d-8a0d-8baab7380d2e", "value": "T190E4F1C017988D50E65A5EB95AB2E23443793CA1EF17870E68E46C8F7C66F823B017D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745245, "uuid": "b85034fa-5e53-4abb-af1c-b96f6026c0d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745245, "uuid": "5ed62379-f7e0-4f9c-ba4d-5ddef84c3282", "value": "12288:UTux0YPX/NqPs0K2/tWqjHgGQr1eLwThtPjnr0tj+l/zdsqcmnTp8o+UXn0:UTlHPs0j8YA91hGRSpsqTTj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745245, "uuid": "40d07c43-0884-446c-bb96-754e2dbf3b13", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745245, "uuid": "68f04fbb-b74a-4805-98f4-2f86da4f5dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745245, "uuid": "6e05e99b-5b48-4d9a-be46-f1775846cc33", "value": "Halkbank_Ekstre_20230321_080804_358439.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdddb5c-f861-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684733282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733282, "uuid": "e05a268a-4197-4d65-a1dd-db7cd23da646", "comment": "Malware payload", "value": "44499bcd0a3df95da6c40b0b85effb6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733282, "uuid": "539c4367-4e52-4b31-ba6f-0b43a3426b76", "comment": "Malware payload", "value": "be77529abc2627e72769e305c6a262c0f4a6a15251c427853dcd14d77319f587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733282, "uuid": "8cb4a7b1-d349-4dc9-bd63-5dfc5ee42ed5", "comment": "Malware payload", "value": "8e090a4c0c85e88b8cd343df654d24c8bdac0771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684733282, "uuid": "1ae240e5-598b-44cd-b407-66c121199a4f", "comment": "Malware payload", "value": "a18e53e7393c04b46bc099e190034596908cd86a360728ba1272ec8c3978094789648a34e7ac26a6a59db9d9b50b3900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733282, "uuid": "22e72f71-7c81-4780-b1a9-d129f00da788", "value": "T1FAD4AE87F69FC83BC91BA0BC68911FA76709C4C7A1091B3341ACE51E3D501DF6AD69B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733282, "uuid": "aeae5d05-a912-4e62-94ab-821359300ed4", "value": "12288:SiHN02qSOnu63a7FLpRidcZHHzwf0MRNxFI6vlCd+QIkNA/:Sit1qHn2+F9lfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684733282, "uuid": "3ab38483-a667-4263-81a7-a3c022233ac4", "value": 611988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684733282, "uuid": "195326f1-e5f5-4c31-ad48-da5e3e56a9cf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684733282, "uuid": "a0e2c2c1-d3c3-457c-87e6-ca06a696c544", "value": "SecuriteInfo.com.PUA-Monitor.AndroidOS.Spyapp.9744.10995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0730093-f89b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684758308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684758308, "uuid": "e624760d-3ba6-408a-b72b-aa2d4efb574f", "comment": "Malware payload", "value": "5e9a6fcdcd84fcff69f87ccaa1697724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684758308, "uuid": "186956fa-4051-424f-bda1-4f027ff398b9", "comment": "Malware payload", "value": "bea937bca6ceb4af050bbfa661bd39d9d42e50fa114ee2bffefd5bc84a6635f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684758308, "uuid": "cfe71b78-1d6a-46a5-8168-039f89d06b52", "comment": "Malware payload", "value": "d4add7cf3654b466894804db30a343f69e7194e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684758308, "uuid": "8c6a32ef-c096-4caf-96ec-7d3a658aa165", "comment": "Malware payload", "value": "06715b0053b3b9e1c4e3f7a1440824c8583cc73da8f399fa04eabe3529aa81fbb4bbb40d3fc7134a502f7f4591c376a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684758308, "uuid": "fefa4421-0cbd-4e03-86c7-82f9dce3305f", "value": "T1CBC5D0DE72732D80E1EF983A9FE5EABC6C5E2D10E8C4D9F78114BA811530958DAC0E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684758308, "uuid": "3ecb65d8-3e31-47a2-a7df-8ecbadf966b9", "value": "d7f453c93b7b0824d5f5b199cc80e5c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684758308, "uuid": "2cb7fbb2-3f03-4afd-aa4a-0294ab09d3b9", "value": "49152:fxCvYFU5JuxuRbLqsbtwxeLfKqVLOoAnMgRKsbtc:kr4uq4twxgKqVMnZ7btc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684758308, "uuid": "3d326e9b-e91a-4bee-b906-34015d6de251", "value": 2660936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684758308, "uuid": "051bc213-ac3f-4ea4-b09a-81a847ba8394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684758308, "uuid": "c07de0d7-1bab-4fec-a71a-83513c96c2aa", "value": "5e9a6fcd_bea937bca6ceb4af050bbfa661bd39d9d42e50fa114ee2bffefd5bc84a6635f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3083d5b5-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TyphonStealer)", "timestamp": 1684776991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684776991, "uuid": "0b72802b-8bed-440a-b545-423c24b46cdd", "comment": "Malware payload (TyphonStealer)", "value": "22ba147ed50ff44941fe486426432115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TyphonStealer", "colour": "#631607", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684776991, "uuid": "6f95d4c2-adc4-4cee-bd00-16e6b6ce5748", "comment": "Malware payload (TyphonStealer)", "value": "bebd7434928eb7d1fb89a84ba41c3838fb5734f446b58b8bfb2d5dddf48e518b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TyphonStealer", "colour": "#631607", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684776991, "uuid": "ba629c10-0656-43ad-8320-eafb03175663", "comment": "Malware payload (TyphonStealer)", "value": "a113bcca40c9c420442533589311a74ef0e30e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TyphonStealer", "colour": "#631607", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684776991, "uuid": "2058ab8b-a8c6-4329-90d6-4c40592084db", "comment": "Malware payload (TyphonStealer)", "value": "73968963b6b5fa96bed0311fc3b8ccc632218c8f183e2f60f849a1c78f58fa2bda34cbdfc653c14a0db2299ca6d353ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TyphonStealer", "colour": "#631607", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684776991, "uuid": "221e75d7-8663-46c9-b7f5-179502959950", "value": "T1C0A53308FAF5092FCE66A2FC7C3B41282ADDE46A8358FB3799D24197D0557F4A527203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684776991, "uuid": "226f056f-bed9-43e1-8676-b16f08507c09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684776991, "uuid": "6290f23e-7997-445a-b516-d73bb8f25dc1", "value": "49152:P0Ux5jMHPPoTAlFra5La9wMgtHr2yyP3HkYR+:Ppx5ovTTra5KMHOfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684776991, "uuid": "28529f30-3d3d-409f-89a1-9257473227a6", "value": 2164736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684776991, "uuid": "ce6236a1-25eb-445a-a220-46c6e5a99d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684776991, "uuid": "7bd4c3d3-03f1-47a4-8a24-dfef24e5220d", "value": "SWIFT_USD_165092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e19d21d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752264, "uuid": "53909e8a-34c4-4f1d-948c-8da32b4d79b2", "comment": "Malware payload (RedLineStealer)", "value": "9f86dac831b9319316c442a4585febe4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752264, "uuid": "9e547b3d-7d01-47cb-b10e-474a3d205486", "comment": "Malware payload (RedLineStealer)", "value": "bee55683c19d138ac2a3087b3a2632902093ec4792ee7d3ed7ee0b0d0d5cc457", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752264, "uuid": "7ce9b14e-6f3f-4a4f-9f04-11d371d9d485", "comment": "Malware payload (RedLineStealer)", "value": "e26fee770d501902c0c96c46f64548e418d159b4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752264, "uuid": "33048a48-1311-4de8-a011-8a5bbfe43bb8", "comment": "Malware payload (RedLineStealer)", "value": "02461f214ec47d2688e89f3decbd2610be69781e29c82251e508caefab703951d73684ff94bee7974f30f468a248de25", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752264, "uuid": "51fd2d61-1716-4f79-a2eb-e79c928aefcf", "value": "T1E8252323ABF980B2D9B187305C7203830D32BDB79EB1935B275558AF1C73591A532B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752264, "uuid": "3fea8bd0-5fe4-4d43-9384-4b10fac2777a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752264, "uuid": "1a04c84c-e0a8-4628-880b-f04b8ea655b0", "value": "24576:tytJhGkIq5a9DckgXvUknq6La1GTZQzST7btUcnHKY:Itf5IqI3gfUkXLeGTmzST3tU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752264, "uuid": "cfdabec2-2754-40eb-adf2-6d06d5d860b7", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752264, "uuid": "198716fe-c951-456d-962f-57e24027ff19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752264, "uuid": "f8da55e3-1f70-4e5c-9e1f-a4348935fa97", "value": "526293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1922f95e-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744310, "uuid": "e4785964-34d3-4d73-9ba2-a0dfa7a19538", "comment": "Malware payload (SnakeKeylogger)", "value": "0c71ff77a7da50d45b2ac4bf4d977e4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744310, "uuid": "3654fef3-a690-4218-abf7-e8430ff33588", "comment": "Malware payload (SnakeKeylogger)", "value": "bf704e0670a2ee267abbeb2463c006d1957070a66f1dd086d807ea69250a5ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744310, "uuid": "c81e7580-168c-4145-a117-f34ffa6145c6", "comment": "Malware payload (SnakeKeylogger)", "value": "1fa368827f5420cf69f8ac291daf28ad10986ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744310, "uuid": "76262100-3dd7-4ffe-b171-d86fdd8abcd1", "comment": "Malware payload (SnakeKeylogger)", "value": "10df940da6a1db1c5b22720cf604790ecc31a3a8bb0da28a5751d563c0c236efa6f6c7c013b47d8633e89e5411d1ad7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744310, "uuid": "a3aba15e-6260-4556-8fa3-15cd9515d1e4", "value": "T192C3175D2BF88900F1FF9A7306B16112C375BC12152ACE1D4AD2F65A2A7D690CD1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744310, "uuid": "25cde9a5-116e-4ea1-84be-7751a827f8f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744310, "uuid": "0c11eb67-4569-4e99-9def-6e6d0fad6c92", "value": "1536:htMpEvqHEIsanj0ly+G0/nE+vBUFrlY9DZKkAMFFxgfPpAbKuNJtbfpyJI0piOW0:htMKH7/tDZv2abfmJIewBnFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744310, "uuid": "56a35ef0-1029-46ab-8060-81631fae2d43", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744310, "uuid": "ac9b8748-3833-4356-b3b7-1a893bfb9241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744310, "uuid": "aeec18f6-d7ce-4f1a-8d73-817675acfcbb", "value": "0c71ff77a7da50d45b2ac4bf4d977e4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a728e1-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737489, "uuid": "7bdf4d55-aecd-4557-97f5-db1f924d97c1", "comment": "Malware payload (RedLineStealer)", "value": "9a2f675b193e042b7b6f0037d601042a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737489, "uuid": "e31f97c0-d6cb-4649-921b-13a6c4a756d0", "comment": "Malware payload (RedLineStealer)", "value": "bfcfcefad24dc4a1d86962211eb82e7c4aec23e1e3de64f6fe3c2d998b77ca2b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737489, "uuid": "9013fdc5-d0d1-405c-8aea-6b7acebc24b0", "comment": "Malware payload (RedLineStealer)", "value": "7f7afc295291032525ac3833e2f2bc24a6da6ce6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737489, "uuid": "31de9d04-1d87-4b46-adc3-b908c0fb555c", "comment": "Malware payload (RedLineStealer)", "value": "4b93939e276c7a573a61496fca221d7294d3949a3cf37d2628f45ca9b91c76ca8c31c4d02084ecb7e36f994d081d61a9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737489, "uuid": "56407363-2390-40a8-a036-50b2cf1029b3", "value": "T1C725235377D89476D5F12B7068F902830B7ABEE0AC78537B2745A92F1E71281A83173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737489, "uuid": "cafc99b3-c407-402d-972b-8cf9bb737069", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737489, "uuid": "c67b3dea-b8eb-4e2e-8cf2-f3cf9c4896b9", "value": "24576:aymgaAUtiw6kOH+UTG0pKYDETDFIRHKEkmsfB2gM5Y3bdcKTuur:hmRt76kyTvpnhKJJfBRTTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737489, "uuid": "b7617238-7e50-477d-bcaf-29ba0afa9a2c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737489, "uuid": "d5dc457a-11f4-4872-9403-1dc25517c271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737489, "uuid": "150e6b7d-19fc-4b28-81cc-536fd802fce5", "value": "listener786.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c184ba7a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752323, "uuid": "761c1910-7fc7-4224-939f-fe0c9f1e605e", "comment": "Malware payload (RedLineStealer)", "value": "8c4d97c6bfb772087985b36bb0399ffe", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752323, "uuid": "c18be179-919f-48c1-98c3-85e8cc3d2466", "comment": "Malware payload (RedLineStealer)", "value": "c00dbbfd3aceb9b90fd9dadeb2b37d82f673faafd20b2ee2c51ab3818dac4c2d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752323, "uuid": "9e2cca5d-3a20-4102-b432-bd5d4cbcfdd3", "comment": "Malware payload (RedLineStealer)", "value": "426fe31283833f2743854e96858a6561d85672e6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752323, "uuid": "2be4aefa-97f9-4eb3-a064-d238234c3888", "comment": "Malware payload (RedLineStealer)", "value": "b71c2521bf358a37257d883ef93a8953a6221017f67b549862a887cba8e14280b3bb29e6502fa35dac4e48ee527e1720", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752323, "uuid": "a9d8632e-2360-4a7d-ba96-29282eb4de1f", "value": "T1B52523936AF89573FDB66BB058F213430B3AFCA45974436B2794AC094C712C5EA32376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752323, "uuid": "d500c061-9be3-4bd0-af05-3fed9bf2a0bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752323, "uuid": "c75cdfab-c584-42b4-9938-f1c98f6f58dd", "value": "12288:NMrxy90wf1cTlR8GUAG3lhMUuH7kBAPmVIf/RNfh1/zalUlWBmcOZ3PRXW5JA3ks:8y9g837w7mOhNfhfWGpXUK3ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752323, "uuid": "7fcc1c87-a612-41ec-b6a8-231a99dc292b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752323, "uuid": "7d595275-4a89-4a0f-a8ad-3d2d82383f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752323, "uuid": "e7aabcd7-6dbc-401c-ba6d-9f0455178d86", "value": "adapter122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab44d5-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684748040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748040, "uuid": "20f1f69a-ab21-4258-8796-da57e0968994", "comment": "Malware payload (TeamBot)", "value": "eb97deecd3627cb1eaefb5a3842a610b", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748040, "uuid": "4e27e563-79e3-4195-a6f1-545ffd51c7db", "comment": "Malware payload (TeamBot)", "value": "c0929b59d5c48c760aabb6e535380a9484160fdf0370d779991b9a2fdb279888", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748040, "uuid": "0e7561c9-ff26-4a10-975a-209ec66c692a", "comment": "Malware payload (TeamBot)", "value": "900b040d4168f4988ac8cd20edf3f138d3b3d132", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748040, "uuid": "5a552ad8-91c5-4155-b1bd-0ba083944612", "comment": "Malware payload (TeamBot)", "value": "e3934b9f154ce226a56c9751f2adcd939410112885482ec8675c5afaf6be09eb72b3d3dee8fcff851093723107fc9f10", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748040, "uuid": "3eae12e4-d2b2-4ae3-a4a4-7f062ad3a00e", "value": "T1F624BE2236E1C033E16755344AB2C6A28F2BBC725BB259CB2BD51A7E4E347D1DE74306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748040, "uuid": "b7474747-62ae-4723-8e11-bf260558acf5", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748040, "uuid": "ebe81ddd-0bff-4bb2-af2f-07d02ee31ec3", "value": "3072:ExpvQ8lJoaPFdsIKm4ljUqZbUE5+AKJPoiYntbtNxbm:Mf73K1ldZwYCJPtYNtNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748040, "uuid": "75fc6a35-e13a-4baa-ba8f-a47996befd99", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748040, "uuid": "b14b36ad-db2e-48aa-8587-196921d84f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748040, "uuid": "4bca17b0-8a3d-481f-acdf-c0390b2c6802", "value": "router173.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6fe148-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777226, "uuid": "b5f7ba91-10ee-4644-9806-14fb41277c9f", "comment": "Malware payload", "value": "a0e0622238d612d4791b9e048854212e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777226, "uuid": "680487eb-747e-4c7c-afcd-21399d11fad1", "comment": "Malware payload", "value": "c137a2827c8ea974c4738f05c1c7c8621eedc3d23c84faa758232cb3cab04787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777226, "uuid": "cad6bd0f-294a-4632-af3f-ed57956610e2", "comment": "Malware payload", "value": "09adf126bf13b8ff4ba251faf9a6d8df08e4de6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777226, "uuid": "b4db357c-53e0-44a8-8efc-86b586518171", "comment": "Malware payload", "value": "867f7c18c6cbb70657db91ce17851375bc8ed17c656718f5fb64853bdc28ee6a0ba3186db9f206be103f06cb0d1ed2af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777226, "uuid": "3d598603-556e-4448-99c7-83bba6a283ea", "value": "T122048C9AB310C98AC1E805325C13DAFD7B257E3A8D144E0B3AD4674F3E32795EC06A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777226, "uuid": "bf14a362-8231-42d8-bf6e-50281894e287", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777226, "uuid": "497d5429-bdc4-4a41-921d-f448995a404f", "value": "384:ALDTs8hsF6qtK8lzQ8+Sych3mYvCPHxZ:ALXVhaTtDE8VfCPHxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777226, "uuid": "f22bb724-cd1f-460d-be3f-3de174be1c24", "value": 184384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777226, "uuid": "df2d9502-6726-4b7d-bf50-d9997d0e764c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777226, "uuid": "ce6facc8-d7cf-4a24-a861-8af14da3abd6", "value": "SecuriteInfo.com.HEUR.7733.1137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5b6720-f8e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684788233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788233, "uuid": "fab439c5-3e1b-40c5-a349-5cb2c7ad6926", "comment": "Malware payload", "value": "81bae01ef237bd6773bf2fddfb8ea683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788233, "uuid": "6f212b44-5515-4b9d-be8a-c80ebb7bffff", "comment": "Malware payload", "value": "c15da027c5f076acc82ae4424c5d56e7aab4cb7b77c6241416d18357a1d78be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788233, "uuid": "f2b0d7aa-53c8-4e95-bf69-94bb8c84e01a", "comment": "Malware payload", "value": "061815f6c0ecb635352f6999ee0d4010aaa7b8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788233, "uuid": "e3ac499e-fbc6-4fa1-b080-0673f9523ed7", "comment": "Malware payload", "value": "b1277c8e72c58d2986a95ac3f0fda0f67b5f028739521d5d775c61c07b198916ccea0e0839991bf5f6e6c50d927d7402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788233, "uuid": "5bb11f36-6818-4735-a38d-9e19c679bb50", "value": "T164E65A07F89191E9C4ADD230CA268266BA303C495F3533D73B24F7B92B36BD45A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788233, "uuid": "87d9b408-7882-4094-aed8-77ff2ad9ddc4", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788233, "uuid": "156f36eb-ce47-48bd-ba79-bab58baf8143", "value": "98304:r72FHD1U/72QjYaBM8Jtlhs+EX/4Xv6nbVT0g:HEj1UD2QsapJPhwAXvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684788233, "uuid": "e43e7a74-0d01-4e76-a7f1-c5e8b86c50b2", "value": 14546944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684788233, "uuid": "49a9ee71-73b4-41f5-8247-35e1927cdab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788233, "uuid": "c8c6f821-a0ac-46ab-b6b9-4409d21f9e46", "value": "windo_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba81540a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752312, "uuid": "b6b5b299-538b-4b85-8857-fab5c6b7dd9d", "comment": "Malware payload (RedLineStealer)", "value": "44da8673e36728bf155976e362cb6b2d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752312, "uuid": "548ebb31-8b77-4cb1-b6fb-9839e7e12400", "comment": "Malware payload (RedLineStealer)", "value": "c1d401590a3508400a321bb9f99892e4d81515fe98ef49af97a26caefa79044a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752312, "uuid": "8cd592e5-fbbe-4ae8-a00a-d218bd836b6a", "comment": "Malware payload (RedLineStealer)", "value": "c209ddf4eaaa243403872627920db8e6cb996c6d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752312, "uuid": "bb09b299-5b28-4316-9e80-fdf9e68008d1", "comment": "Malware payload (RedLineStealer)", "value": "287990038c8c1d66cb9419dd0f6c6cf1e44a71d83e641b89fb2302a1878ded0d96632e79592bc0d5da997636552739c2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752312, "uuid": "6d582702-ce25-4860-9a22-abd4307bec15", "value": "T130252313EAD884B2D9B217B15CF602870B36FD919875E269331AFE5A4D732C06D32727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752312, "uuid": "48beb15e-ba37-4cfa-b2bc-aa1018961127", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752312, "uuid": "6f8e32e3-8cad-471a-8c97-1ae1421d04ff", "value": "24576:6yKqHcfimbp3qtZFeQ/pm7eekIZql2sS:Bfv03qtr9/0KIZ42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752312, "uuid": "4ba94abf-8f20-4273-8857-584d0f15c083", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752312, "uuid": "0aaf0e1a-dfdc-4437-b7b2-2bcffbb692b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752312, "uuid": "18d3e42e-b841-444a-9f5a-355f298e5582", "value": "UI202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1275f68-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751947, "uuid": "dd8ce1fa-c740-4099-85f1-239ace4ccd06", "comment": "Malware payload (Amadey)", "value": "be6dd90e55af07cbc6ec90f0bf92b561", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751947, "uuid": "5e17e26c-2c9d-48a5-baea-a7cf08c3b63f", "comment": "Malware payload (Amadey)", "value": "c1f2e59f1bd0bb3b5a94e8214d64b03796bae6e8fdf9b777cbaf3481cc5cc614", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751947, "uuid": "44a5adc4-2b8a-4a77-92d2-1ed630e2b2de", "comment": "Malware payload (Amadey)", "value": "0fb650c77984e5c24b9425838ec1aee8ff798c84", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751947, "uuid": "9ed10a72-ae0b-4495-81fd-10f63f359883", "comment": "Malware payload (Amadey)", "value": "ba142268787213a28cf6c56c304d31824604765ec7fa7256e030e1692d51d0f84b89518fa00d3eacf62655e1a29e8666", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751947, "uuid": "d8f7303e-91af-4fde-bd3e-f795ac5f641e", "value": "T1D3252307BBE88572D9B53BB058F507C31A79FCA046B0869A37C2595F1CA29C468B173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751947, "uuid": "038f24b9-5dc5-4c63-ad95-396ed98c91af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751947, "uuid": "4d65278a-882c-4c6f-af64-936d45aa4bc5", "value": "24576:+yYwYnGcJ7oGv7TE41MjntkXnFznId/T:NYXnGGtTPsntkXn6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751947, "uuid": "808977c1-8a74-4bcc-be11-bc9c10ebdcb0", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751947, "uuid": "651725d9-5da6-453b-8dcf-deade544b3d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751947, "uuid": "4aaa612e-12e4-4682-984c-368588ee3e8c", "value": "gameplay211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af649075-f869-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1684736831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736831, "uuid": "0d5daff3-c358-44b7-b0ec-78e7d7b0ccdd", "comment": "Malware payload (GurcuStealer)", "value": "a65e9165a47ed2cd2f168bf71db4181e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736831, "uuid": "49d36787-b839-4805-bf8e-b04bf50b14f8", "comment": "Malware payload (GurcuStealer)", "value": "c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736831, "uuid": "3b4b2c2d-bbf5-488a-9ccc-68566c6f71f7", "comment": "Malware payload (GurcuStealer)", "value": "c7fac0793d14413bdb2b6240dff2a2ce33b50ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684736831, "uuid": "692a1662-6ff6-4eb7-b937-922c64f5ce55", "comment": "Malware payload (GurcuStealer)", "value": "29e50fefacec4717fe4e6e0929526041beb98c22b640eed1a3b7df37218516918428f98cdcb4fd99fb2cfe65db7a427b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736831, "uuid": "d09d48e8-c224-4e9b-b802-12a6775d4e6a", "value": "T1E3B43B0C7749FDD0FE3E89F9A5B52610633880439205A7473FDE69E66F522406E8E8ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736831, "uuid": "4c2100e1-f58b-4aa6-bf6a-9c0c8b433ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736831, "uuid": "b2d86e00-5aef-43f1-847f-91e661a0a267", "value": "6144:H6Vo3IhHN5ya1R64TxT8jWHgf8YJkVHC++VeQPBZnq0LZYSwFxQx9tkD9bMLtttB:afhtHxpmWHgf8Y6/Qp1nLiDKyOLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684736831, "uuid": "da39d9df-675c-47d2-b5c2-0ff2955b7dbe", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684736831, "uuid": "b6ccb18b-206a-4d28-a9db-a8d5749e67f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684736831, "uuid": "bf43d4ad-e13e-4af8-8ea9-56d2e9472922", "value": "snake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69e0ddb-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745433, "uuid": "5f561281-26a5-46b1-8990-96a514d5603d", "comment": "Malware payload (AgentTesla)", "value": "a912f849e565497eb3832a8fc72ab34a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745433, "uuid": "599d393b-bd56-4f57-be47-e88611697540", "comment": "Malware payload (AgentTesla)", "value": "c258adf0015f1607b2b09594cbec41de70d816829820695f8c9778ec4b11d553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745433, "uuid": "de4ae8c3-3edb-422b-b5dd-0b7abfe5761f", "comment": "Malware payload (AgentTesla)", "value": "7624eb01da36d87a35319b1a73dab4ddfde705a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745433, "uuid": "d466463f-03f4-4c9e-a4a6-44a97c6a49af", "comment": "Malware payload (AgentTesla)", "value": "aa39f57812ef33ca9fac3d84785bd2f6b72cb51e6c236da00eebe0e0e76230321b48616e01e4ddae0b06f77ca05b96d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745433, "uuid": "ba804e75-541b-4188-812e-1d3842392303", "value": "T12D542752D1DE80C4F3F22D57ABBE51A83BB7B894AC388D4D4488DA3A7BDE400CD51766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745433, "uuid": "5d70944d-99e6-406c-8d03-9d2e8c5da077", "value": "1536:9Hmd+CKN/SoY+oYFt6C26S17haPCFjhWubLf7LUz0RkJDY2mT+NSlS:9Hmxw/kYF617hQCFrvffUz0RGPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745433, "uuid": "b0cc3e5a-994a-43e3-995b-5713d594839c", "value": 285376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745433, "uuid": "9271100b-cf71-47d2-826d-1b48b2946580", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745433, "uuid": "b32ff764-8433-47a5-a76e-962ba862112a", "value": "PO89809435.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f95839-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737374, "uuid": "e4162f88-efa7-4cc8-8313-3d2090993830", "comment": "Malware payload (RedLineStealer)", "value": "cf43abdc686832e0978e631ec8ac3aed", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737374, "uuid": "7a0996fe-da0a-46e9-82e2-5f3fdda24012", "comment": "Malware payload (RedLineStealer)", "value": "c331c6da37db13bc992c564dcddb389f056ae776711310dfa981cefc408fb636", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737374, "uuid": "118512d3-54cb-41d9-8e6f-f0071afb65d2", "comment": "Malware payload (RedLineStealer)", "value": "80f0aca5a32927e6ba474fc5658c8e286b36e2fe", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737374, "uuid": "03d9257f-d355-4db9-8727-30bc40c34bad", "comment": "Malware payload (RedLineStealer)", "value": "35f592fd11789a4e8b80f2e1f01d98260fac00e26a6d7b5d823338ef38f69993156698213ca1bd533b57f30e61360062", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737374, "uuid": "9f26caca-c8c1-413f-9601-54f89d2b4594", "value": "T1F125220766D88579ECB52B7049F642930E3ABCE00E349317B3AAFC6B2CB35C155B1766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737374, "uuid": "03d75dcc-81d6-4b58-857e-40a44eddfc63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737374, "uuid": "32d219ed-3a64-4fb7-968f-97ec89480e70", "value": "24576:cy+zU9/OQC6p0EU3dOaQXO7IsIb4mvuCtRh/IEs6MZRL:L6c2K03dfjhIb7uqj/IEs/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737374, "uuid": "4abf40f0-f89f-43a6-b43f-cd5ac1c2be27", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737374, "uuid": "d90309bd-73c6-4ba7-b789-bc8de2535a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737374, "uuid": "033429db-4221-4cae-91af-0cf3dc22e8a2", "value": "achievements634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c68562-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684744730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744730, "uuid": "20f32a62-c877-4b9f-9bf0-8e568d2d51ff", "comment": "Malware payload (GCleaner)", "value": "cc7f5dff3737dccd68b2697a934cc23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744730, "uuid": "ab0c9703-beb0-4e62-8a96-93da65558e5e", "comment": "Malware payload (GCleaner)", "value": "c4ed2e62240fac6487c1e235014d582c7beca03ee863049ca7fae0ab5627ebb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744730, "uuid": "2082854f-b965-4b93-80dd-1b5c3bfaeef2", "comment": "Malware payload (GCleaner)", "value": "89755aa1c75073e72c1070674bdbe09156924324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744730, "uuid": "e8bd7710-7759-4db8-a5c3-ea1a9ea280f6", "comment": "Malware payload (GCleaner)", "value": "051629de9d70efda76eddab929180cebeaf41dc49ef795098d5613bd5d9d50b9a0a5e040e2cffe6dcc5be68c6d49af02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744730, "uuid": "5ce80992-6328-44f5-aaa5-5c06bb6a42fe", "value": "T13184AE03A2D1BC21E7651A728D2EC6F8361EF5514F093BC77A686E6B19712F2C632F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744730, "uuid": "b087e5fe-d736-4e09-a93c-98e1f89f7583", "value": "ad1da3007d39bc21ababd35f90247ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744730, "uuid": "de18a526-47d8-46c7-a400-df08aeb706ab", "value": "6144:dphULdSihYxszn4Ngrs0Blb8y6UsYWqMhVXpdT:edExcnRrs0LX6UALP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744730, "uuid": "e9a7fae0-f3f9-4220-9f7e-c75a439659f6", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744730, "uuid": "a554d8ae-2183-47d6-99df-f55677808bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744730, "uuid": "f096ad98-92ce-4354-9dcc-f65b3d31ff16", "value": "cc7f5dff3737dccd68b2697a934cc23c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d95553-f8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684787925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787925, "uuid": "166e201e-6607-4856-81f0-d03e3543e8ea", "comment": "Malware payload", "value": "d100de3c3de7cc23d65623fed1e6287c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787925, "uuid": "6ff50241-2b26-478e-b5f2-a0f4b7ff1ad0", "comment": "Malware payload", "value": "c51f1c555a8323109e221f384ccff3a0a068d1e5f1b429d5e093846c2cc84536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787925, "uuid": "68875b55-32f8-4d22-99ac-c6fab4054485", "comment": "Malware payload", "value": "73bb2cd9cf76862754b7e75e208d0a0b0c030ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787925, "uuid": "647fa399-faea-4f2e-bf46-863e1345c68e", "comment": "Malware payload", "value": "a44c8ff2021c102d3d6b48e7acdcf38034b3a529116f26c7ab5b90dd72c5357d1a5f2825c1730e51ee1dca84a2b3ffcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787925, "uuid": "7d32d249-e23f-4e41-8c28-a99b9c95b6e0", "value": "T1692633897BC38C4DD2A221714B1AE9DDE3C45A20E9331E99FDADDE14798B181B513B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787925, "uuid": "8fcc85b4-7ff7-4fa8-8d41-297300a8d884", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787925, "uuid": "2a0d26d8-c84e-4971-b546-0fc58f99d118", "value": "98304:kvkP/VICEsZUx3jz8Wrv6l+k3Lya+NPB9ahjAHu:kveJEsZUljIWelf6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684787925, "uuid": "d7d6d3c5-fee5-4faa-8b31-e0c96a3f66ef", "value": 4511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684787925, "uuid": "1bc04f29-bd82-4ace-b18a-a0efe5bc813e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787925, "uuid": "2fc58031-b444-412b-9095-118ecb66f450", "value": "pron.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a475bdf-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684752472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752472, "uuid": "b785d10a-875c-4a85-a42a-e80cb938adcd", "comment": "Malware payload (Amadey)", "value": "48001f7ce1c025b20264806c7a6c11f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752472, "uuid": "ba188dd6-234c-411d-8280-337d34370912", "comment": "Malware payload (Amadey)", "value": "c5212dc87e1907ff0ee73952134c5cbdc22eaf8516ba56f4dd6ba37ad89a47af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752472, "uuid": "afaa1db6-0b26-4111-8d41-fb735b1202a3", "comment": "Malware payload (Amadey)", "value": "cb11da16690ff1bbca24e19169c56bb2b606798d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752472, "uuid": "365669d1-51a5-4f1e-a403-fdc973565500", "comment": "Malware payload (Amadey)", "value": "d2f6360b07039ba077b3d6b327f5920664f4409a9e450c52f3ebc7939cc2b792fbfc7c49c75848bf95f82137f99adf07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752472, "uuid": "52a4fb8f-93a9-4ed9-98f3-3285b18d4f14", "value": "T10F252362DAE85175ECB41BB04CFB03C30F33BD64593982AE272AB95B1D72685E471339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752472, "uuid": "755fbed4-2a69-4ee8-9fa8-a57f0aef9fa9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752472, "uuid": "b4eadf98-ac43-4ce4-8ef7-7880a2be8ed7", "value": "24576:wyZhNqFczg4HyuokcuaQIAjloilIepeEbMsT+IS:3ZhN2czgay/MMPilIOvbMY+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752472, "uuid": "5574632b-93ae-4f07-b8f4-f68e00b10c95", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752472, "uuid": "41fa44bb-537c-44ee-8077-6b749a0b1d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752472, "uuid": "67d207fd-4134-4489-81e6-76677cedec76", "value": "launcher395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe23d47f-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752425, "uuid": "e19f9136-b241-4845-8034-6b1a2b03f05f", "comment": "Malware payload (RedLineStealer)", "value": "80dc22efc81ed2bf30b7a969c50f4deb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752425, "uuid": "aa8b8f3c-096d-469b-b92a-4398ac933aa5", "comment": "Malware payload (RedLineStealer)", "value": "c542eccaf0f58d9b2a69559fe3816ed78c0b06b80555ca3fd496cfe3e749e161", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752425, "uuid": "5554a6a8-3832-4b80-9893-cb7396353d30", "comment": "Malware payload (RedLineStealer)", "value": "4635b28401f2a4cb87cd5a3673aba87970ccb271", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752425, "uuid": "361eb23b-2422-49be-8257-42dfa3d01af6", "comment": "Malware payload (RedLineStealer)", "value": "ec85d667820ef134665efee1d694e775234ce1abaa03b57edb22bd1260a474296e2ee6141f0132de914ea27ea4ea0a4b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752425, "uuid": "a36c677e-7cc7-437e-b2a3-8923c047beea", "value": "T115252342A9C44062E9B21FB069F307C31F39BED11D2A4B673356E9460C72746EE7276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752425, "uuid": "399275b9-c170-40c5-baf7-10c436a17e47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752425, "uuid": "b29f3a67-0791-41e7-86bf-9861ff77930c", "value": "24576:Ty3VHq01WAahu1Y+83ubdHO+WhcrVhaVHK3uuheaqGk:mlHq01ay8+bdHO+dLa83BuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752425, "uuid": "1f719400-a858-4731-9222-1dd694c5bb1f", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752425, "uuid": "981b049b-f183-40fe-aaf1-aacbd9d84383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752425, "uuid": "e54f7bd7-fb16-4f1e-b794-d5be33dec139", "value": "filter370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2342bc4a-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752487, "uuid": "0967c9f2-c07d-4a03-b7b0-18cacb5aba7d", "comment": "Malware payload (RedLineStealer)", "value": "7979d367fa10170200d520f8989687c5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752487, "uuid": "c69b1aa5-51a7-41d7-9202-ad0fb092102e", "comment": "Malware payload (RedLineStealer)", "value": "c5ab4eaedeb7725ac7c11d42f24224d6f2b571899c467d10a10b7cb95ddf47f3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752487, "uuid": "6a232215-78b8-4efe-bc62-4e249c654b74", "comment": "Malware payload (RedLineStealer)", "value": "87d3a505e042d9d5133fa040257accb9b711849f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752487, "uuid": "2d40373a-9e05-440c-9734-9f5444dc15d1", "comment": "Malware payload (RedLineStealer)", "value": "c6ae8137cc46281080f30c38d685c554004cb3367eceee4aa0c72102a614dbeefba328ae5f39e0750371154bbe450d12", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752487, "uuid": "32b54ea1-f3d4-41c3-a11b-aeca1dd48903", "value": "T1C5252317F5EE96B7ECF52B7198F602C30772FD619DA1821A2B425E5E2C331842935B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752487, "uuid": "ff338316-acf3-4a6b-b30c-045cbdbc1e31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752487, "uuid": "a02a1e42-ebf6-47d5-9906-dc70bd88e2bb", "value": "24576:eyZR6aT7FQxGyrq/IV84nHy3RjdW1VIJasvB:tXJnFwGyrq/IiCy3WbEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752487, "uuid": "f0f52375-e708-43c9-a35e-25986d969b1a", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752487, "uuid": "fda5a721-5fe0-49f7-ab77-31003a7afe1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752487, "uuid": "83038711-7a68-4bb8-ae53-b6d5bedeca9f", "value": "manager512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99346cd8-f8a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684762993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762993, "uuid": "9c511405-711a-42e7-939d-d0c478828590", "comment": "Malware payload (Mirai)", "value": "bcc43891e72d70182fb88e10fc25f41e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762993, "uuid": "97ed10a6-0f13-4f7c-a821-6ca6d01e14d6", "comment": "Malware payload (Mirai)", "value": "c5df2a7691aa464c9d7d60230749c3f0c27997db483a02cada2af0b0dff185ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762993, "uuid": "559b4604-d787-43f1-a1fe-67ec27530bae", "comment": "Malware payload (Mirai)", "value": "e401323f968ed3de014715cbcbfa7bddb37297d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762993, "uuid": "722ad762-f214-4ce0-bbcd-afc7811aab21", "comment": "Malware payload (Mirai)", "value": "0de083160dc919b52676f19c55214bfe45a37917a1dcc2900cbacb02d78565e13614fe51a30991907b698977848e2574", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762993, "uuid": "331f41eb-6329-4ae4-b1ce-e63a4f1bc04e", "value": "T1B5D32A46AB408B13C4D62775BADF424633239B64D7DB33069928BFF43F827AE4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762993, "uuid": "fb55198d-c6d0-42e1-96fb-2c9d39b21e59", "value": "3072:Qvt8sZAon0aoDY2qd67rHzt1AiJnXtoOrV7rQJ004FbG:Qvt8sAk0aoDY2i6zt/JndoOrV7Q4Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762993, "uuid": "8bd4bb5e-5d96-4a29-b289-279338fe9433", "value": 139014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762993, "uuid": "c76dab06-2793-45ea-8b5a-a321cb00eb72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762993, "uuid": "64181f11-0463-45bc-86f6-30fb982d5c86", "value": "bcc43891e72d70182fb88e10fc25f41e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a1406d-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752218, "uuid": "905320f3-4416-4d4b-8b72-495238026fbd", "comment": "Malware payload (RedLineStealer)", "value": "b40b9c70880cd43ebfb604692ee0cc84", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752218, "uuid": "006842a9-87ee-489f-9807-5f72dcf43513", "comment": "Malware payload (RedLineStealer)", "value": "c754d32e7fea63db5826d451654e70b23e38bd2b24c2c254ec38f5d2380d3b4a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752218, "uuid": "1c41412c-2996-43e6-94ba-b0e65bee2249", "comment": "Malware payload (RedLineStealer)", "value": "9fed46375a156ce3981db716fc35c16d5b6f2e29", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752218, "uuid": "0758d6a1-8c3b-4e8f-9fd1-3258c6401570", "comment": "Malware payload (RedLineStealer)", "value": "c818df9e1976c11c2f3efcf143a5c3b80ba0f76e43785ac0f4731e572548ddcdf2a4a1bac27cc87af4b9c4a5b7a0d1fc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752218, "uuid": "8d190dcb-c00a-44e6-a516-0afa6148755f", "value": "T14C646C23A6868035FC2B96F847C699B941ECB9701B9F41E7DBF49FDF4D90AC06621207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752218, "uuid": "9044e79b-6c9e-4e5b-adb6-a8624a2c429e", "value": "b46b7655f5ed701dbc7075afa681ec5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752218, "uuid": "1e95d504-7953-49db-ad0a-305bff184c50", "value": "6144:6C2jogwHx/t70kBAWMzeFMca5kgrqnnAHkI:6ogwHT0kBkzcDgrj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752218, "uuid": "ab61191e-872d-49fa-8f8b-dbf8e3c8b8ae", "value": 317200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752218, "uuid": "ba747a71-8730-4260-8c71-dface2bda126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752218, "uuid": "103de069-fe93-4400-be38-2e1e81583977", "value": "245245254734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9f620f-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752453, "uuid": "d66a74f7-f69a-4c62-9a74-ee88b9e619cf", "comment": "Malware payload (RedLineStealer)", "value": "95085bdfe828692a8d30cac1a256cad4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752453, "uuid": "10d20636-c902-4a2e-884d-0d43c72b5c90", "comment": "Malware payload (RedLineStealer)", "value": "c7965904e7c7bf9b4fc7bda1e6654b1e1756e5474dfa283404fe53dfe14e7b77", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752453, "uuid": "2e9f3a6e-1c43-4494-9c40-88590722a9e7", "comment": "Malware payload (RedLineStealer)", "value": "d224a4697e0890cf550b3ccd7753ee01eb8fb0d5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752453, "uuid": "748d7cd4-976d-4673-8bc7-32f93f8b2768", "comment": "Malware payload (RedLineStealer)", "value": "7cc485455d013871079432315fb4535a9121548bc328d7fa499044d7039d603c211abda434f57f79a3ae9b33753caf81", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752453, "uuid": "669f3792-97ca-45aa-9e52-8b3a787d885d", "value": "T1B3252243ABD048B3D8A02B306CF657971A76BDA05D74DBAB335A5C672E327C02970727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752453, "uuid": "000c8e87-2531-4221-99f7-ed48f6b1bcb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752453, "uuid": "663597cd-f35a-42d5-a712-02d8af6c2f40", "value": "24576:3yykUZO8udTfP2jq+MKnYCwtAdSB/+hEza6I5r+Q6sFT/gd:CcxuRuq+vY1tc6I1+VsFT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752453, "uuid": "33e0f31f-68c0-41e6-8ba0-ce31d93a7ed9", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752453, "uuid": "cc9c4e24-ebd0-444f-83d4-896e67a38afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752453, "uuid": "15b5e4ca-02f0-4249-b473-d25b20e2ebd3", "value": "helper450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a56fa48-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737655, "uuid": "0eb50ccf-b4b9-4a52-90c3-cf3a7736b7bb", "comment": "Malware payload (Amadey)", "value": "d05fbae20238944de516a744f9b55ca4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737655, "uuid": "3d614b34-fd67-4dd6-8ed1-9f2263552cef", "comment": "Malware payload (Amadey)", "value": "c7f8808b528aae76743562d0e66151fae7f12bc1fa421608f3eafec0504d127d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737655, "uuid": "192749b4-3ad8-49fc-a1a0-bbd7246eb58c", "comment": "Malware payload (Amadey)", "value": "edffcd57efb87a11f7dad7e19cb825e0dbc35137", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737655, "uuid": "55f2f70e-2f2b-4884-a7a3-5fad7f655c0e", "comment": "Malware payload (Amadey)", "value": "b7d91eeb739bc5db5d335380fa472778b1fc641c34bc150edf734bb567474d266a251d40ef554cdcd083996cba6e9983", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737655, "uuid": "940ef8b6-0098-472d-aae7-4056523ed36c", "value": "T1E925232353D58062D876277544F342D70A37BCA39DB4C77B2A86D4AA0D72EA47A32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737655, "uuid": "1e4ea52c-793c-4031-96c2-251661a68ade", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737655, "uuid": "d6c6e72a-6ba8-4115-af79-9ee6eff1e414", "value": "24576:Ry9n1RvNpAXtqoQKsztbmm9M6/UtMipIKkhO/:E91dk9qoQKshbmoxU2c4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737655, "uuid": "4f6e2055-c910-4c4a-972b-e293793e25b4", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737655, "uuid": "bae798fb-b128-4a47-94ad-016853f8a45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737655, "uuid": "8e0c275b-3ac2-4c3f-8f2d-42337e9cea23", "value": "service409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d522a0-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752440, "uuid": "ab794b98-63ce-4bca-a4dc-893388476112", "comment": "Malware payload (RedLineStealer)", "value": "9a2dc43adf4b581af1ad7adad14a1dbd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752440, "uuid": "9abcab7f-0f8d-48d6-99fa-c72d9cd58049", "comment": "Malware payload (RedLineStealer)", "value": "c81eecc179639c96ecf6db273e9185230773fef7fa8ed5d9e57f31b84080cc47", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752440, "uuid": "481caaa4-e6cf-49f3-a818-935132ccf68a", "comment": "Malware payload (RedLineStealer)", "value": "e58fe305a982709ccaefe0795ecaa823a9508d96", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752440, "uuid": "f79bb2e5-975e-4f8b-bfce-ee9f85c13111", "comment": "Malware payload (RedLineStealer)", "value": "42d7f359b98ee0c979364bb50bbc0f37a8382227a9bfaf2aabdb6427dac17f61cd07243e772af8cda4a083bbf5fcc243", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752440, "uuid": "d2fed345-487b-4aa6-9494-f2d486a4ac1d", "value": "T1F325234AEBD90832E5B5137058F246C31B39BCA0BD3C576F23D58D690C72A84EA76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752440, "uuid": "a533d5d0-bb3f-457f-a629-9ed224f95a84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752440, "uuid": "c07536f3-ec8a-4fb4-ac1a-5c226af05cce", "value": "24576:Yy7gcn48Xk4NxXcQc02s56h0sc4OthC4/qtYdsm7crLiMr9:fbZXkqXGG9f4kcntP1rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752440, "uuid": "e4ca126f-ca4d-47a5-8af8-de9c0b46c688", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752440, "uuid": "4784776b-db6f-44c2-b6b3-109c8a961858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752440, "uuid": "d5269427-6a77-4bfa-8ff3-55b529d2fdc4", "value": "gameplay373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901ca663-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752241, "uuid": "f5302d8e-562a-4a2b-9e7d-a91b5da5775c", "comment": "Malware payload (RedLineStealer)", "value": "716f54bda98170d76f665c24155306da", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752241, "uuid": "7601371c-a0f8-4cd7-b2fd-8b648ada6c3a", "comment": "Malware payload (RedLineStealer)", "value": "c87b5c08bb153444b559f23f43d2d7bcdb0bf8335db32da097d1e6d675658a07", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752241, "uuid": "2e8881ea-44ff-482f-adcc-63abe6c0363e", "comment": "Malware payload (RedLineStealer)", "value": "a46b6e21a5c7b468dc43e17e4ecd35373d6de4ee", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752241, "uuid": "dcc44368-3e43-44b9-acdb-ba688d88c0f0", "comment": "Malware payload (RedLineStealer)", "value": "7abca1523141fd363e54b1103d08624a23d35de7e4cc43172e059e99a4031400679ab9263a1f1af0168218748e3f6da3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752241, "uuid": "f5a5ec9e-f626-4df8-aaf1-22c3f65f9ec7", "value": "T14A252301DAC88466DCB5237494F701C30B35BD91AE38931B3B0DAA599D737C8E5B972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752241, "uuid": "41819014-c091-4ab6-a70e-c1398f172417", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752241, "uuid": "8615e8dd-6ca7-4fae-ae0a-5a1c80fccf04", "value": "24576:AyZvOQlr2xq9rhqsL1khpN40fmHfdsTJL9U:HoQlOq9r1kTNvfkfeT99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752241, "uuid": "84f2d38a-3d57-4489-9dab-808516025b6e", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752241, "uuid": "cd1c620b-5d99-4a78-b5ac-0b0297674813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752241, "uuid": "923fd5bd-9505-4a79-8043-10a00fb750e4", "value": "32332659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f56131-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752385, "uuid": "03ef2444-4075-41cf-bede-a27fa17135cc", "comment": "Malware payload (RedLineStealer)", "value": "43219c65e48a5e74cc044a6787fda17a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752385, "uuid": "14d829fd-f90e-4acd-8877-e1bcd7f97556", "comment": "Malware payload (RedLineStealer)", "value": "c927b2722fdb4096aa020807487f62a3416a65cdf44f4558ba0fb4ebe49e1eb0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752385, "uuid": "6dcce2ae-9997-4d1c-9bdf-b868d89964f7", "comment": "Malware payload (RedLineStealer)", "value": "081655a4ee52c73a7235fe87a3a7bc3fbaf26ef0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752385, "uuid": "42b1bb50-eba7-4a4c-9710-395177f41b05", "comment": "Malware payload (RedLineStealer)", "value": "a627ebb2fdeba3419d056e7399094bdee94fbc52f501b185b4aa1f82f708106c002904f92f1f9f42f35501d5b073d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752385, "uuid": "7418916c-0f7a-4903-9992-9211ac61f208", "value": "T19A252352EAE98123DDB11BB02CFB07C31F307CE39E7842172A85AE194D736A55972727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752385, "uuid": "c59e33d4-3ee9-42be-8676-80433ac58063", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752385, "uuid": "01ad548f-8187-4e6d-b17b-725102c434bf", "value": "24576:7yAZlx2k4gvr6XdZ8pzEoRMWZuuYPO3IUaz+N0by4qrQoKsJ:uWSk4gWtZyEnbyaSxrff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752385, "uuid": "39ebd506-b147-404b-96bb-4d7667bef35c", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752385, "uuid": "8ba16e18-127b-4eb7-b674-7a86db47be7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752385, "uuid": "7ffeb518-576e-4f79-9f31-69501493401a", "value": "converter349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1369c2-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752502, "uuid": "263b245e-9074-4776-bd8d-89fadd61c0f7", "comment": "Malware payload (RedLineStealer)", "value": "d95487f0e0bff3c3ab490116a194c958", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752502, "uuid": "dd8c7825-26af-47a6-abb4-3566db63a576", "comment": "Malware payload (RedLineStealer)", "value": "c9c89cfb3d3239dd2e0402da23caa0f803be818f8557bb568a09afab20285b7b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752502, "uuid": "5a6da81e-aeda-4cef-8116-088c6e2e36de", "comment": "Malware payload (RedLineStealer)", "value": "665262a1ab5225e67a0a75d0d44bf93a7eb3a573", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752502, "uuid": "622e8c5d-c490-47ea-836e-36c23b8fcfeb", "comment": "Malware payload (RedLineStealer)", "value": "d9f6f6d7937e3a2c63281f28b89cc03ebdb78ba3c0373d19a82728ffef9c452d774a22a7854c72bd06723bb72926cf6b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752502, "uuid": "a5f034ce-0ad4-4e78-b644-1060146ff4a8", "value": "T19925231172D880B2DDB427B065FA13970B35BCF18A7AD2962780AD395D73790EA32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752502, "uuid": "25c0a867-b8ed-4ee4-95be-9fee5737da65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752502, "uuid": "17bdee23-ad0e-46eb-a9c8-6af283814794", "value": "24576:rycHy/2NUD8zFq6vYk2xNh6Le1bRnv2yg0iJnfQhA:ecSeNMgFq6ADxce1Myyhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752502, "uuid": "b7a925c6-74d2-49af-9335-d36d379c5c8b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752502, "uuid": "33a185b8-6942-482d-817c-059879aeb9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752502, "uuid": "35b5f988-eee0-4dd9-9151-b39fe95329fd", "value": "networking992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a73853-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779550, "uuid": "81cac556-cdd0-4cc1-afe6-69cfa89f82a5", "comment": "Malware payload (AgentTesla)", "value": "7b15278fd1519f11b456b7263c320fab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779550, "uuid": "91c21a9b-1152-4dc9-b847-d1cbd730dbb7", "comment": "Malware payload (AgentTesla)", "value": "ca060a8f218d4de07bc339fc49969feeb49cabe4892bbe3d541afcedeb09dcf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779550, "uuid": "000bd4b4-6547-4eb5-a39d-dbd0812b21cd", "comment": "Malware payload (AgentTesla)", "value": "684727a6aa2a58b3dad653483ce24c00cbb9d73d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779550, "uuid": "790598cd-2517-44af-92d0-722f9dbe882d", "comment": "Malware payload (AgentTesla)", "value": "dc4c9813c7b5287339ed276a1547fcf0027c26bd90d1cb76c7d70e0c4d4d5cf5d3885798240959ea7dc1257df1d069bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779550, "uuid": "23a20d93-7939-43e2-a3b0-9e59f556eb21", "value": "T1E2E4F1C12A949C55F5675FB94AB2F63403B46C91EF27C70A69F42C8B7C6AA813B017C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779550, "uuid": "dff311a3-5191-420e-b28a-5924f8fd6e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779550, "uuid": "9c2bdc05-473e-4cb5-8a2a-bf29dcd4c406", "value": "12288:XtFx0YPX/NqPs4SucFYqr3jJ9C8nKP8st+TBZvecYgZUCiEKNf9C:XtwHPs9hi8nKPT+9ZGjgZXinNfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779550, "uuid": "2ebb2e54-d2ac-439f-b70e-76b3d5449c02", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779550, "uuid": "9cc68ad5-6636-445c-889f-03a87557a034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779550, "uuid": "17c3c182-fabb-4e1d-9d6a-f4073d95b4f2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd193664-f8c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684774220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774220, "uuid": "6089715f-ebe0-4d97-8564-05fe2aa87230", "comment": "Malware payload (Loki)", "value": "951ee88ec8a449dec4f3cede4747189e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774220, "uuid": "234d48a9-3dee-4e98-a177-be90b2e5b81b", "comment": "Malware payload (Loki)", "value": "ca42449197049cac366377403e6e1aca77a1a5d5dd374d9f51038c1d5f532bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774220, "uuid": "532bcc08-02e9-430f-89c5-a8cfed09a378", "comment": "Malware payload (Loki)", "value": "38e05f468358783408fe1419eba43be705bdd5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774220, "uuid": "dc657356-e6e6-4541-a03c-57527e91ca45", "comment": "Malware payload (Loki)", "value": "db54000a27f18649c4a1fa80cbf7d6ee3ced461adc49c865d4423376942c21543d1d2c33c3933ad3d25fc168cc6d3ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774220, "uuid": "cd76594c-c05a-4a24-a70c-830431b72aa4", "value": "T1C2B4F160EA24C41FD972DE308C26D37D4AA5AE055D73528B3F123F6F2E32645AB2E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774220, "uuid": "f4cfd63c-f38f-4113-bb6f-1249c75200ae", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774220, "uuid": "a200755b-6ad8-4bd4-b9c5-c117228d7c11", "value": "12288:s3w0eNbZ5daCyE5n9G5xxuCSSWPa+YYeQD6JxL:s3w0MZZyin9G/xGSWCmeQDExL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684774220, "uuid": "c91dacd5-e920-469b-a971-103eab66c43c", "value": 518216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684774220, "uuid": "bff429aa-85e3-4136-9436-beeaa58f3032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774220, "uuid": "e7873ced-aa0b-428e-beaf-e49b41fc11f6", "value": "Miscellaneous Promotion\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2dc552-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755915, "uuid": "944822fb-4e86-4d30-a7c0-baeab3c5bc83", "comment": "Malware payload", "value": "96a350283022f4d4260d4ca8d462b29f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755915, "uuid": "e4bedbc4-4b76-40c6-bf02-0c513d82a11b", "comment": "Malware payload", "value": "ca48eae4b4ef6bef3d80ed7464fa09102c724134669dd9c4bb64900ca4d6adde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755915, "uuid": "60e1a3bb-f324-496a-9417-18896b5134eb", "comment": "Malware payload", "value": "736bcd686e694ff1a29c17377002678b7f080f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755915, "uuid": "96c25ad4-4ff3-4e44-8684-b7b49a552a34", "comment": "Malware payload", "value": "810d83af7421923d6ae8e810961c7f88957528e198ef19a67d574d9abbf871b3b1b164b5bbbbc1fa907654d0bca9a900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755915, "uuid": "4a6def49-b76e-4788-a4f5-0b31f1804f75", "value": "T1A5B5A26F3BFEA431EC29C531AB06755A0725AA60CF32C45E27BCE97DEA60741A4F1047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755915, "uuid": "f67479e7-dc8b-418d-a0b4-e59323efd072", "value": "24576:3XGp6XWWD6aPYOBKW3Tmhbvp/k8pRN3jWzLDZXHkDDDDDDDDDDDDDDDDDDDDDDDe:HqwTLD6BTmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755915, "uuid": "a62943bb-c1ea-4369-be41-c03d66c9ac57", "value": 2470912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755915, "uuid": "d9af1985-b747-45be-a5c5-47a773e0cf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755915, "uuid": "108635ba-6a2b-40d0-ab0a-a8c0c6a445b8", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.22326.6295.11587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a5bcb2-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755897, "uuid": "e52aeabb-cf36-4a19-980e-cba905dad8b1", "comment": "Malware payload", "value": "da1f05c49f94abfd87852cad4f485ae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755897, "uuid": "7898f51d-633e-4b0b-b09e-1a30327edb18", "comment": "Malware payload", "value": "ca6076e5e971b175c746b839bb07a2c07466c8e295b9e661c01c8e9f99bbd0c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755897, "uuid": "d11d4113-c665-4540-96d2-b2307e37c89d", "comment": "Malware payload", "value": "1651428812c2840dcdf3a6dd9a823a3bc91caa40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755897, "uuid": "30a16e03-e765-4cb3-924b-3bb90c06d306", "comment": "Malware payload", "value": "3e1babca254187cfc7599a58ccdedeb8061bb5a48ca638b59ef34608fdf7dd3c6f5c4cc7268e7b5f0b4e0f83a87e283a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755897, "uuid": "b656f3b8-86f3-4fd4-9720-dadfb3eef1c9", "value": "T18A55A45C45F3C345E09834F26F0F8E8249ADB9C61FA251828338BCBD3EE7E86554B995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755897, "uuid": "a5e77aac-9ddb-445d-8307-04a2cf71d803", "value": "3072:GDRSxlFu82FJxBfS9zS5dGWzkcvXygUiyiQgYKc9wiP8H0kJo90:GDEg827fOyd/0GbGf8H0ky9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755897, "uuid": "bb644dc7-c33f-4c99-a57f-38a4207accf9", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755897, "uuid": "93fb0484-42f8-472e-aaff-171437156ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755897, "uuid": "79ad5cf2-db18-41da-ad7a-8cd0235d6aef", "value": "SecuriteInfo.com.Win32.Evo-gen.27868.9930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ef4215-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751979, "uuid": "afcd935a-699e-4cb6-ab47-5d3d03fd9fe2", "comment": "Malware payload (Amadey)", "value": "671f6f2fff431418bf06f28eb868806c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751979, "uuid": "c27b8cc4-85a4-4b80-992e-8d92fbfc044a", "comment": "Malware payload (Amadey)", "value": "cae6e10f04ec6c4cc3a590d7a67d579c8a832aa4cd6c2086a188a267fb7843c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751979, "uuid": "f0341c99-4ea3-422c-9018-d0772083fd49", "comment": "Malware payload (Amadey)", "value": "8564dc8792340d40abadc0e25a8dbd53fe094a5e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751979, "uuid": "1d538d21-f0e1-401c-bd85-ad98934819c6", "comment": "Malware payload (Amadey)", "value": "957c379b037e7cfdb0703b85bb9a294462241f30d7719a5a15a3ca65903843991cc6eaa548bd780f567b66d47f2fff63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751979, "uuid": "1da4c1de-da70-43a2-939a-500575fc26af", "value": "T11C252323BBE48473D9B55B3058FB429716357CA20AB9931B3741EA8E1CB5EC4E87035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751979, "uuid": "11ae2b1b-c3de-4c4e-9290-39c292f6a203", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751979, "uuid": "42fbb1de-cb7c-4909-a522-74b58a13628e", "value": "24576:qyqwUagm3Fr+T9DA+vmvZy5wnwSkpOPE+vSjw2Wo+QYb:xq7mFr+WxgdSWODqj0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751979, "uuid": "2b603acb-735d-4c4b-a010-ab639e98f21c", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751979, "uuid": "1f2c824c-c827-4882-9268-d6b23d3c8e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751979, "uuid": "14da4f87-faec-428c-b7f4-b9ac3d698e66", "value": "listener535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85215a6b-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737190, "uuid": "2195ede7-f558-4663-b90d-777c81be24ab", "comment": "Malware payload (RedLineStealer)", "value": "f85418170118f4663ca73a3f3c81f84f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737190, "uuid": "abd32bda-9e7f-4ca7-95b5-b6ca0ff315cf", "comment": "Malware payload (RedLineStealer)", "value": "cb011d45c94cd0d9e2c95c252f3c3cf0de5eec4cf07e93b72488b8994e30f7b5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737190, "uuid": "33fcd929-b6bf-4731-bf28-cf62542f7839", "comment": "Malware payload (RedLineStealer)", "value": "acfc0612d44530826d697e98ffae237dfa4c2595", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737190, "uuid": "25d474ac-4221-4a08-bfde-076818a2efc9", "comment": "Malware payload (RedLineStealer)", "value": "d4a7ae88dd7bab0d45b45ed190078732dcc6497cd2121421957e706fd60ac75b5bd5d990d8cfce26bb3616ce07f315ca", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737190, "uuid": "5722eecf-56b8-45d2-851f-f240ca52f5f4", "value": "T167252356E2CE40B2D9F6577099FA12570B30BD609CB4463B2686A62E1C73FC5E83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737190, "uuid": "9510f747-a282-491b-91c2-c68b690d9508", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737190, "uuid": "f2f159f2-9f18-4684-b627-c78239e9fc07", "value": "24576:zyu9CUWYxqGZp7dsNSELhilsJii5tORRTRGTC98:GuYUNxqdNSElh5tOTTR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737190, "uuid": "f2399838-63d5-4c3f-a753-e107609be28d", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737190, "uuid": "0693e3e9-ccdb-4e37-a976-8f8ba9039330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737190, "uuid": "52e79591-575f-40a7-9eb7-70effa4bb207", "value": "35647185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9fa676-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752372, "uuid": "6833905c-b88c-49ba-84a6-570a5ecd96be", "comment": "Malware payload (RedLineStealer)", "value": "581026913ad722416f7644094188e68a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752372, "uuid": "ed065e84-70ed-4229-b9fa-fe60b39c444c", "comment": "Malware payload (RedLineStealer)", "value": "cb0d7efc51da225943743f0055cdf3584ad5d4f3a855150eb0bad8697e579433", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752372, "uuid": "bce02ea1-a9c3-4ee5-98c6-200246185a29", "comment": "Malware payload (RedLineStealer)", "value": "df366a2268e5373f407e73fc80c7f694d31db551", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752372, "uuid": "76f8f0b5-7ebf-4934-9e58-d5e74819c975", "comment": "Malware payload (RedLineStealer)", "value": "7aca4ef5c82e5c74220bbe7358465a019fc773ddfb50daa9dc1fb4b66a52eb5f6a410d56e4ad8e89326f47cace364c6b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752372, "uuid": "fc4af698-61c6-4984-8f40-23be9827176a", "value": "T1B025230BABED4025C5B11BB009FA0683173B7CF98DA856AB2745ED611DF2544ACB1B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752372, "uuid": "d5c5d0e0-aa68-4a2a-bca6-1fe1501c87bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752372, "uuid": "fe431a48-dfaa-4cd6-a8d9-a722563349ad", "value": "24576:1yJAzsS6ggVpLLy2qFYDJi1se/qenD6ezp9sXp9G8iZvKwIe:QJLSiVpS2q2i1seCenuezQXiZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752372, "uuid": "ceb45e9a-0837-4c5d-8258-9893d832048d", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752372, "uuid": "709ddbe1-446b-4e22-bc2f-3e62e8605642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752372, "uuid": "7d70c8f5-0a4e-4ad6-8158-e1725487fd12", "value": "connector361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bf0fa4-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1684744272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744272, "uuid": "6ec96f53-7848-4bd5-8b88-cb78ffcb7894", "comment": "Malware payload (PureCrypter)", "value": "2d626782ee5216f18f05b8c2cdf320fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744272, "uuid": "985062c7-35b1-4697-ae2d-566ce27d64da", "comment": "Malware payload (PureCrypter)", "value": "cc171970c56e7cb26c9e4280f659724ea7da7717f1a6f950c8782a5241fd767c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744272, "uuid": "10d9f451-1350-44ab-af1f-58f54116dd5f", "comment": "Malware payload (PureCrypter)", "value": "41de2faeb0958341fa0cc4c983e7e9ae6ae14f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744272, "uuid": "050d829e-e00f-446d-a91c-3eb0049f8662", "comment": "Malware payload (PureCrypter)", "value": "3217719585fa27c648c6cce27e1ad2898e3fc5ad70ce24a9adf0a67c32c06f1f3f259fd57aab2957d5ec7a5a7141fda5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744272, "uuid": "f6724255-fa36-4134-9252-3e66fe6fd380", "value": "T1FF12EA22E7294233D9A80F7B9C6317C10376A706ED72E66FDD45500DAEB038D5A92BF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744272, "uuid": "a6261d9f-bbf6-45c2-b749-d33416ac2bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744272, "uuid": "b264587b-9668-4617-917e-fdb171a2108c", "value": "96:aSs40EkSffff1U6EjS3Pf0qw9V5uq+45L6T/Nh1pja0u1K3Wwlhmn90gRqFnU:aSsXEnffff1UvkPEhp5L6T/7vNdZUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744272, "uuid": "73be6ab0-2bce-49b1-af41-c3cf5d7e4cfe", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744272, "uuid": "9bb721a0-3799-4154-b1b2-89f13f0d9583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744272, "uuid": "d5f4febd-05ba-4d1e-9b73-4ef23f7f1c40", "value": "Printed File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34b2ace-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745964, "uuid": "8f3a1cb5-9f91-4d7f-ae75-7fb2fa76e19a", "comment": "Malware payload (RedLineStealer)", "value": "a34d4943ff9f315b2412fc1725a94090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745964, "uuid": "04302e9a-22cb-4569-bea9-ae0596658284", "comment": "Malware payload (RedLineStealer)", "value": "cc24a372dbb83bb829d20bb1089d094839812576990218c0508dd4f12208eca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745964, "uuid": "298c53c1-248d-4d29-b6dc-cb487d80c439", "comment": "Malware payload (RedLineStealer)", "value": "2033e843e6da3ba6c0af7643b197b2719c4ee48d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745964, "uuid": "f4e157b1-33c1-434d-977c-82495adb04db", "comment": "Malware payload (RedLineStealer)", "value": "6b71f5d51f1a28394f311a73e8686033054ee129c4e55df1ae3ef64888e6b0ee992ae6c7e1bcecd6c7ccae9db541b9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745964, "uuid": "d2c958f5-ab8c-4ef2-8e22-f598aef02764", "value": "T174252317FAE94133C8B1277058F702C70732BDA19EFA932E2389D8564DB2690A931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745964, "uuid": "e8c4e7ef-3ef5-486f-bb4f-570046617065", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745964, "uuid": "94edd16f-8391-42a7-94b6-c0015ec58249", "value": "24576:1y0dfU+oQ9E1Jz8I1iqxNcl6yQPew67gE+T8Ea+zX:Q0dM+VIJzjiqxNcl2F67T+6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745964, "uuid": "75fa3876-a8ea-4a6f-bb00-b94a74e7eb12", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745964, "uuid": "447480cb-b75a-4b6e-9326-5bf182b5709f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745964, "uuid": "28037928-c798-485c-9b17-cfec8c4c150c", "value": "a34d4943ff9f315b2412fc1725a94090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec0f489-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762546, "uuid": "45ff12ec-2898-442e-a361-f22e18622662", "comment": "Malware payload (SnakeKeylogger)", "value": "dff8b06af1a3115472ad6b3667ce5375", "object_relation": "md5", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762546, "uuid": "9ff68d69-cc90-4dd3-9486-19acbb51f2e2", "comment": "Malware payload (SnakeKeylogger)", "value": "cc51d10e5165cb6ba234e1ac9b831d9ba93c8cf678a12890ff712386a8346398", "object_relation": "sha256", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762546, "uuid": "f140eced-f09f-43f2-9e92-82f6ed21bab6", "comment": "Malware payload (SnakeKeylogger)", "value": "a460bb11f03735e991a0b0d57f18730d02d4a7f8", "object_relation": "sha1", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762546, "uuid": "f917f5ae-a2c8-4fa5-8d42-ae2cebf4d7a5", "comment": "Malware payload (SnakeKeylogger)", "value": "d3f8b4b653a8d7e506ee9253d2a33717b757655355917c18aed2fdb32cee16ba2bb81cdabc3a29258a02be69d3626203", "object_relation": "sha3-384", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762546, "uuid": "751d1a12-7cb5-48c6-a11f-67dd188ce62c", "value": "T1E5058C4137747A62F46A73FD011987CCCB78A4873026E12A5FA375D212D3B7A762E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762546, "uuid": "460ff5a2-ec32-4bc9-8f0a-bbf60dd26c9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762546, "uuid": "5481445a-2c3e-4114-badb-92151b8e304f", "value": "12288:StXbVPp44fdxovryHBuk6jwJUS2Skawj+PIwQeUntO+v+SCq:uXJPpLfduGHAk6jwDlNQ+PIwQ7I+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762546, "uuid": "33230938-e010-470f-9e01-b79673a2ba46", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762546, "uuid": "c7402b2b-f9b1-4726-bbee-dc99795c1686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762546, "uuid": "f74a88e7-40dc-48ad-9f86-58ba0460a2dd", "value": "CaixaBank _ banca digital CaixaBankNow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3f5f39-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752209, "uuid": "9620cbaa-98da-4ab7-ab52-ebfbc5ce77f9", "comment": "Malware payload (RedLineStealer)", "value": "7f2b02f78d35dc2cb68708bc06d28c49", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752209, "uuid": "94b741c9-1c2e-41be-a50c-92651f80714b", "comment": "Malware payload (RedLineStealer)", "value": "cc85fedfecc84773cf0b2d18bca46d9bf7ba56e549780e0ca2acfa06d705fb08", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752209, "uuid": "48b02a16-45f6-4c40-bff2-7bc3956bf333", "comment": "Malware payload (RedLineStealer)", "value": "c404fe857d2541eeafd19cd1e947b5accd82bd33", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752209, "uuid": "fd0f937d-d481-4265-aa06-189956fd42ab", "comment": "Malware payload (RedLineStealer)", "value": "9ff8ecbb2efcdecce0773e65e2fcecaaa495cb4c649cacebaad23cc00a5b22f55df85f750d689cede1b7e8f2e566c368", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752209, "uuid": "42871098-47b5-4736-99d4-e8de46d43aea", "value": "T150252293A2E54073C6B813B428FA46D70E39FDA2C972829B3740951F2D317D9B471BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752209, "uuid": "9690eff5-97ec-4172-bc51-0244fcee0f7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752209, "uuid": "68b0fd06-d5e5-4e64-bdfb-6796db7c38b7", "value": "24576:pymY474KIuc4vs8yiPXUx13nPL1qK8Z4Tt6DsaLXJ6:cmp0KPo8yiPEx15qRZ4T3aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752209, "uuid": "6dab7b35-b183-4443-9705-15f3ae2df4d8", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752209, "uuid": "967169b1-ca18-4881-ae88-b6ccf7885aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752209, "uuid": "883305f0-6453-4bce-a5de-7e04fc761bb4", "value": "234433512822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b93b3c-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684751787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751787, "uuid": "551dd710-3f18-4222-b033-574223ce8b87", "comment": "Malware payload (RedLineStealer)", "value": "2abb5dc877dc68cec17e58d0ba6f53fb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751787, "uuid": "f943f024-9bf1-4d80-8d48-3e8927c5a276", "comment": "Malware payload (RedLineStealer)", "value": "cccc9bf8279ac600bc8c699421c6395f79876ccf40146facaf255f80c488965f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751787, "uuid": "996de8b0-5463-4862-8218-872f014e210e", "comment": "Malware payload (RedLineStealer)", "value": "0bb6c2dfba15a2a5b0e2c9a5e9e6ec401371ffaa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751787, "uuid": "5aeb5cbd-35aa-426b-85f1-6851ab625251", "comment": "Malware payload (RedLineStealer)", "value": "2a1dda5fb64757ddcc5a116fe7a3ca458bfcc71fdef78fb928c83a80f779869ac4de1e1c62c9f4e7bf0ae9cc43929434", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751787, "uuid": "b5a11334-9ba4-4cb2-afc8-ba5ba4bb96ec", "value": "T109252321A6E99077E1314B7959FB03931F3B7CE14D6943AA1B8697080D722C4BD31BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751787, "uuid": "92c6f810-45d5-4fff-b1ab-4bdc8421d4f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751787, "uuid": "0e9d713f-8b72-4171-98d8-7fe0f8b1cfb0", "value": "12288:0Mrny90GXT9JIX+xiWq2pjtvuno/xrTvWM8mUod5KV4KkUJx2Ahc634kyu3Kgyfm:jypXNxrq2phvuSnvNUY4k6R3tyffRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751787, "uuid": "78b3c845-a805-42ed-be05-9deaac19fb39", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751787, "uuid": "01f5f522-7fbe-4813-a831-7f2b72948dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751787, "uuid": "b7eb032e-d8ed-4a91-9d14-e4661740216a", "value": "353512840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f4c938-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752383, "uuid": "60b5d500-afb1-42ad-bbf9-35857db77fee", "comment": "Malware payload (RedLineStealer)", "value": "1b255c4d43caed1df123db533ef04a93", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752383, "uuid": "1aa90f22-753e-4c8e-8f83-6f76efb7c9ba", "comment": "Malware payload (RedLineStealer)", "value": "cd0ae2275912fff15496cb0dd74e38884240e82b2cdc15e22e991e40bda9b5cf", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752383, "uuid": "058f51d3-5f39-46ff-81a4-bf488162ab6a", "comment": "Malware payload (RedLineStealer)", "value": "ca3a812f2f7113a49d004d4a5c25e34547bb58fc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752383, "uuid": "54e9e66f-fa9c-49c2-8358-f9c565c0ecf1", "comment": "Malware payload (RedLineStealer)", "value": "f6f7ebaf1872cb6d6175e49acf99d9af3a8284f2a1375cb75a35f62fc4649a8284fd2e63a9fd1d768ad1f7f771d981a0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752383, "uuid": "af8c8c13-4e42-4b43-b77d-6d86a6446695", "value": "T172252247A3E55473D6B017B04AF722D74E39BCE28F3482AA2B49885F2E735C85532736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752383, "uuid": "60d0af4b-45ea-45cd-bb4d-0da5163daa91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752383, "uuid": "f35b6a8c-2018-41c6-8425-626f32118d53", "value": "24576:wqy19h6nYA2vWCLWuHduGQgUX1eT5ilCEdJISzL0:wxJ6YQUWugGGetilzdJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752383, "uuid": "9e0322da-b94b-4e71-b4f3-f4039d109cc6", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752383, "uuid": "087a2ac9-f776-4332-983a-f79b9030d484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752383, "uuid": "44570e52-ea76-4655-a031-5fa7e190e569", "value": "converter236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200bfc9c-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763649, "uuid": "0ef630d4-4148-4cc0-9e7f-8f2b9deb9d08", "comment": "Malware payload (Mirai)", "value": "55fe47ca1505c6ca2cec2c68d94867ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763649, "uuid": "67351943-55e5-40b1-bf94-7de48686366e", "comment": "Malware payload (Mirai)", "value": "cd27113b10948e3520ad3cedeb08314a72acfdd446968e09fa6c432658b0848f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763649, "uuid": "075e798c-2ab7-471b-9ec5-7d46b957a19d", "comment": "Malware payload (Mirai)", "value": "d7ceec98535b8d1f00c5a41e855c0d7acfbae719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763649, "uuid": "af9fe169-9a4c-4b70-8f6b-55d1024ed65e", "comment": "Malware payload (Mirai)", "value": "2d48da0665b48f539048560cf9def8c8ad18421acc9413be203deff1fde4ab7631fc437e24786403772e9e8fe501ee50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763649, "uuid": "ae72bfe5-c0c7-4d39-b9bd-67d1b52ff217", "value": "T15AC2E1006115F0F5CB744EB0977A4B825B9A80B5D1B9B23CF116AEF955818CC7B7E783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763649, "uuid": "7b972901-3767-4c80-853a-82c8201e91d7", "value": "768:5kucNpgSBeOyjG4VRQiLTPM8OdCV/2jV8Ps3Uoznh:5kucNpgSBJ4TTWI258Cznh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763649, "uuid": "5b3530ef-a91d-40cc-834b-8f8de27e77aa", "value": 27940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763649, "uuid": "ccdc482e-2a9b-4dab-8a58-19f37404b3b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763649, "uuid": "0cd63059-553d-4751-9de6-ca361120a403", "value": "55fe47ca1505c6ca2cec2c68d94867ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cc878d-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762603, "uuid": "a2344724-646c-4065-b5ee-a509055947c2", "comment": "Malware payload (SnakeKeylogger)", "value": "af914a6c5120088cce1e6b507b7712b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762603, "uuid": "1908aa78-734e-44b8-ada3-4b1291403a5f", "comment": "Malware payload (SnakeKeylogger)", "value": "ce5cd95b8fa530b0b8abf93e5e373a6ad04e56173a702a0ae8ff4751bea38adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762603, "uuid": "43dcba65-6e71-42be-bd77-7f11834f996a", "comment": "Malware payload (SnakeKeylogger)", "value": "fa2afdb63ce8cd56b964026caca8d7b8a46a2e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762603, "uuid": "b2784d83-4e46-47c6-ac6f-82b1578cefdc", "comment": "Malware payload (SnakeKeylogger)", "value": "14ee7bf552fb276f5cae40b824cab54351895b369fc77307632e308315a87eeb660f34720425ff040c086e3ef1cb2c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762603, "uuid": "7674ff35-025a-44c9-b449-78a280f569fc", "value": "T1C6E47B9633B57621F87D73FD01196388CB38B44A2062E11A1F5A39D546E37EB770A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762603, "uuid": "07dedb70-44d9-48e8-8829-8cc6927b9858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762603, "uuid": "4e7308e6-2dea-4068-82e1-deb197d685fa", "value": "12288:fvV+s1bSQT6tjjdB4GXOmuIMTqXtLM3IcpeRgtn+4watCXwAKgu562IdQQJvIB5T:ftSPuIMTgxyLYREgyCXLKY2NQZqZgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762603, "uuid": "5205e26c-70f2-4697-8b12-872901b82055", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762603, "uuid": "80953ffd-fb77-41f7-9f9c-8396310eddb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762603, "uuid": "b2a55979-71cd-420f-8099-23ba6c0f145b", "value": "Confirmaci\u00f3n de recibo de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc6e9ae-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779560, "uuid": "fca30fbf-1348-4a17-a265-72c82d908e33", "comment": "Malware payload (AgentTesla)", "value": "0f6ac15ff17ab49e64f770ae9ee81e85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779560, "uuid": "3ebacb72-e58f-4bf0-ab29-2a638c0ad438", "comment": "Malware payload (AgentTesla)", "value": "ceed05621c2de1d23ce22a9f2dfedf5891b5222abaf013c47acde6defdae5a50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779560, "uuid": "41ee4044-7d3c-4a81-8972-c728cc8f4ca3", "comment": "Malware payload (AgentTesla)", "value": "8a34c6a3a98a433de7683cedd2e052ed32bec7b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779560, "uuid": "205c2024-c48a-4b3e-9b95-6ead579d10ad", "comment": "Malware payload (AgentTesla)", "value": "385440536c952e1d1c2036c846eefc0c8441cc1845d8de89d990eaa5115d1a7080508181abedf832e690f80653cd83c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779560, "uuid": "fb8b5349-5c88-45ea-a2d2-1d800af6ce09", "value": "T198E4F1C16A989D10E69A5FB55AB6F23403742C65EB27C30E24F42C5FBC66B827B017D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779560, "uuid": "ae35654b-ab12-4e1a-b3ff-e33a2a62da4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779560, "uuid": "2fe04f12-ff40-4da5-b020-da7eb4d1e408", "value": "12288:mtPx0YPX/NqPslTaM38GjjY4Jn5Bd8LmmvWhc2fkfCyB91:mtqHPs/3e46vO2IyB91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779560, "uuid": "fa616b7b-a4ce-44b5-bb82-5ef74d8a6db3", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779560, "uuid": "3df262f6-5e54-4cf1-8cfe-29a0afdeb4a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779560, "uuid": "b486c41e-0bf1-4240-8e6f-9165ca5b9994", "value": "FeNdmWxJWfnThMV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715dfcd4-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684747894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747894, "uuid": "e048e701-7d2e-403a-89e3-5090dece34d8", "comment": "Malware payload (RedLineStealer)", "value": "dc344817229a39dc42b6d261c5873d54", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747894, "uuid": "a7df4d53-422c-42c1-8d43-8fa004f6e0b2", "comment": "Malware payload (RedLineStealer)", "value": "cf00b997495428cb3f06cca60072d3c3aff60db3785b3117b139bfe2fff3d0a3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747894, "uuid": "f6515194-9cb9-4fd8-8271-566676f600df", "comment": "Malware payload (RedLineStealer)", "value": "808ad6f58de471ae3fa4a3e08b50c0318ba3f6a0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747894, "uuid": "fb423845-c734-4410-8e34-fbf773c47513", "comment": "Malware payload (RedLineStealer)", "value": "909b5e125d17bc75e56526daf07b17234b04a0d279a95c7b15d2adafa827adac18e590604a21f3b7f75a42ee8ec0f9bc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747894, "uuid": "a4b5ba23-5ec5-4b03-b728-544b3ef7a801", "value": "T128E3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747894, "uuid": "eae2fce1-c15b-43de-98c5-64c5252c627d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747894, "uuid": "2d8cd0c0-f939-4e94-95ff-4d1614cb3f9c", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747894, "uuid": "c41e5724-5bc0-4d37-bb2c-87cf62f9998d", "value": 149532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747894, "uuid": "42a7a335-d1e4-4ca8-b74c-9d6e0ef2388d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747894, "uuid": "28c611c6-6ee8-4d42-82ff-c8c6df7ba26d", "value": "connector979.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c509e6f8-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684735149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735149, "uuid": "b1bca00c-6626-4443-8624-76fa8215a365", "comment": "Malware payload (Mirai)", "value": "4af372411867102ac758ffb971b27ac3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735149, "uuid": "d6d9f54e-e5b4-4a81-a8ad-e71583370821", "comment": "Malware payload (Mirai)", "value": "d0188e8a46a68363e7852e6a61b2bb65b461458c175764c735292be9da020d36", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735149, "uuid": "907a46a4-52b5-4394-ae22-5b149c7d59e3", "comment": "Malware payload (Mirai)", "value": "b61e782e3bbe4ceb805103cc036488932e628efd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735149, "uuid": "0be6b87a-b1b2-4e59-8808-83d265857886", "comment": "Malware payload (Mirai)", "value": "a0d23a393c03d07c534fa0338ed0df7900b880462ac0362ea1c72db1b22f7d3467307564c587db4856df65cfe038f58f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735149, "uuid": "fba26cb3-561e-428c-908c-b5c892f3e0d2", "value": "T1CE330907F681C0FDC49AC174476BBA3AD93771ED0238F2A67BE4EA223D96E611D19C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735149, "uuid": "0d2c52f7-0a3c-48ae-a313-b7b057d030ad", "value": "1536:Ru31CxXVpHlCrxsNnVfvj5F+HT2r4DaEXzd0OCUjCYS:Y1sXV5lCKNVfvj5oz0GaEDOVUjCYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684735149, "uuid": "d0813848-3833-41ea-a5b6-02b8feadae03", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684735149, "uuid": "63098d15-de57-42b5-a3d2-31ededd8e06e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735149, "uuid": "e8ce7815-4284-4334-a493-b3751023f66b", "value": "4af372411867102ac758ffb971b27ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93364c42-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684752675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752675, "uuid": "507c3f7e-b04f-4207-a644-e47342b9cd4f", "comment": "Malware payload (AgentTesla)", "value": "e6f169881026691f580f27fa906f9d33", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752675, "uuid": "d1814b8a-833e-4ea1-ac4d-2d98efe77d3b", "comment": "Malware payload (AgentTesla)", "value": "d0230c1943a512ac68d022126957425cd69d0f44053b108f1c5931041a6ec129", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752675, "uuid": "535a8e5c-13a0-481d-aef6-81c2d73d0e19", "comment": "Malware payload (AgentTesla)", "value": "9d314c828f753b646e4d98c976eee1a5de5bf715", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752675, "uuid": "b0720ad4-063f-4044-8228-0afd42a258d3", "comment": "Malware payload (AgentTesla)", "value": "e89a7cce2f833874e899671ff38681a74c834b2cef0ece3548d080b09b3b57a3aa5ba0712d020450175894c1c055da7e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752675, "uuid": "2a37f89c-4f51-438f-a4ef-87d9e78c69e4", "value": "T176B423B35DD30C920C5E7B7B03A0435C0A8D879AD27FB75A3A689A1E218F1F5E91DD60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752675, "uuid": "b487c6da-d678-4182-a830-4132c71cd1c3", "value": "12288:EINYCnP1Pk0Kk6GQ3ktm6HKYequcin/WG/VLTVEJ:EIF9cv3kMpqE+GZVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752675, "uuid": "0ea8a9ce-1eb5-4231-a64c-afaa3935d818", "value": 542705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752675, "uuid": "c66451a0-0891-40af-9d40-723e0ec0e04a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752675, "uuid": "013f5fd9-93bd-45e1-8965-87a1cca6748f", "value": "PO 4000101479.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb94f88b-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752340, "uuid": "785e4d58-d441-40fa-a79d-3ba3b3c9be9f", "comment": "Malware payload (RedLineStealer)", "value": "b558b990b7b4bf3eab1cdae6acf3e671", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752340, "uuid": "38c62e20-5201-446f-84fd-3ae1b2e55be5", "comment": "Malware payload (RedLineStealer)", "value": "d0a067219aa88db2bac277bd9cd4f2fd2f8233ae3da468cf1f4211f2c426b79b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752340, "uuid": "4e8a85ce-859b-4b0b-bffe-e63ea344c222", "comment": "Malware payload (RedLineStealer)", "value": "0146751b28701687f02302a2ae6dd9fd4c991835", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752340, "uuid": "f37f57ed-0d93-44bf-89fe-c63a79e5515d", "comment": "Malware payload (RedLineStealer)", "value": "375ba8bfc00b3720e0008254356d53a07612f2fe87b3cf64625d3eb60718390ffd5e1a2d8d8448c98485df9230243233", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752340, "uuid": "07d31cee-479e-429f-bb78-e9eaa74ed289", "value": "T15A252316ABCC6567D5B4073024FE03875631BCE15EF8836A3145EA4F1DA3296E87237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752340, "uuid": "e5731ac7-87a1-4728-864d-b8358324898e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752340, "uuid": "159a6b93-5b82-4dfb-8230-edbc66959205", "value": "24576:wyKc9hS3JAC6vJ+2Zptm/FZcuwXRaFmUT+R4gPwgiWn:3XsKwkptm/F6u4gmUT+R9PwgiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752340, "uuid": "e10827d9-fb0d-4e49-aa51-e3c80a0992d1", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752340, "uuid": "5b29c981-32f2-4254-859b-788becf0ff47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752340, "uuid": "728fde50-b656-440f-b38c-3d2e1d45db85", "value": "backup819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76e0951-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752414, "uuid": "76755915-aa7c-400d-9340-962e04ba949b", "comment": "Malware payload (RedLineStealer)", "value": "9e796e2f122a33e3d1ac3c84428eb212", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752414, "uuid": "43d9e134-ad17-4645-8be9-e49ad07494c0", "comment": "Malware payload (RedLineStealer)", "value": "d0a75fbbf6b2d1f04b1c0bf6f52b0c3b2d71ed5599d5e28311224a46ec6f4a0d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752414, "uuid": "9c31a689-b820-49f9-9a25-f94911916080", "comment": "Malware payload (RedLineStealer)", "value": "6257ca3d8cc02e2a6f090a12a2da8b8e1ed0eeee", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752414, "uuid": "dba3958d-d33b-4865-9f1a-c64e9543a97b", "comment": "Malware payload (RedLineStealer)", "value": "4b7ab215a03eddac9302d0ecfe7082b5d4b6edc9af474bd99dc628d6fe746b7116e0f52125ec783c7df74ad493c0a062", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752414, "uuid": "7528efb1-2784-41da-bcf3-0490bd4ed70f", "value": "T105252303B6E99472ED716B3158F603A30B35BDB0CE6A415A37809847ADB37C1B9B1367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752414, "uuid": "6140ec5a-58f9-4d00-a1fd-c8259bf311b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752414, "uuid": "8e12bf8f-11f0-4c57-971d-10e6f576b860", "value": "24576:ly/0PV2HfHnqRad41cejgSOzzXp/KewVl5+yH7:AzHfHnqRadujZmp/Kxlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752414, "uuid": "c40c2fb5-f517-4394-8376-b3de9a5477f5", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752414, "uuid": "e471a4d0-79d6-4f78-85cb-15c77a18f203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752414, "uuid": "c0baa3b9-f59b-409a-84ce-007f2bcc0ccc", "value": "engine338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148ba53b-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752463, "uuid": "c6de8723-d3e3-4803-91af-b494b2b3ec84", "comment": "Malware payload (RedLineStealer)", "value": "05a6f2c1a6e50a35cff1414ea549d186", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752463, "uuid": "66ab0e00-81be-4032-b8ca-8425af61939b", "comment": "Malware payload (RedLineStealer)", "value": "d10867e0c60084e8ff9e129bcd0b6c0a9c4e4fb51f1b7cb559bcd19a7d8406fd", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752463, "uuid": "ea2ca495-c2b0-45e8-abea-a317dad9f962", "comment": "Malware payload (RedLineStealer)", "value": "ea348ba18cbcb5d53b0e02763291604f68302402", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752463, "uuid": "2ee6ca18-0eff-4503-a3cb-a28d58ee2db9", "comment": "Malware payload (RedLineStealer)", "value": "05b9b434429e4d8a5e505d888d9de5dc2d09816ba848cb8a123bbe8c0715f91dcbb60255806f4d777891cf115b66a020", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752463, "uuid": "34ce5b5f-d41f-46bc-9e00-e3e578debc2e", "value": "T1C8252303A7ECD463EC76777108F607C30636BDA089B5821F3766A99B4C32AA49931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752463, "uuid": "694d9432-49e5-456b-8798-3487ab5eb619", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752463, "uuid": "ea38f5a9-0456-48c9-87d6-93d88cdb7187", "value": "24576:6ybXom2xPgxYxyHFqs+u9r1l5VHjItHjmgMfckv0sKapb:Bb4x5gkAqs+u93DItHjKEkv0sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752463, "uuid": "3d434a40-0280-4f95-b360-f5a690b40e5d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752463, "uuid": "41cdcd80-923b-4619-bcc4-73bb76983e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752463, "uuid": "c9b4e9f9-bba8-43c6-b4b3-d433082ec668", "value": "installer662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa938177-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684744688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744688, "uuid": "eb672cc0-e422-4dfc-ac6d-eb6137a9898a", "comment": "Malware payload (RedLineStealer)", "value": "41a723792e06dead70eea84c25b9c5b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744688, "uuid": "6553e3d2-8b39-49b9-9029-e776f97f0c3b", "comment": "Malware payload (RedLineStealer)", "value": "d120f86810729718538a4afeacb0c1af96953e565cfe2fa5006c9dc823f8f274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744688, "uuid": "134f33ff-8d47-4e9f-9f5c-f7ea1b7faece", "comment": "Malware payload (RedLineStealer)", "value": "95fdce4c9d4443b3e187687530cdd8c150cf884e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744688, "uuid": "d176ca6c-8049-4320-9485-e2091787bbed", "comment": "Malware payload (RedLineStealer)", "value": "882cbc8158b939b174017aa0742fb4b27e6ef66f9aa4b2325de906fb967925d61838f4103dcbf7b44fcf3480d49fde17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744688, "uuid": "9ff61125-1550-4947-aff0-0a93961dd72e", "value": "T1A58533452F0ACB63CF26F1B420C7FC74DBEC888E56E812495913E68B15FC4762C9B5A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744688, "uuid": "426fd5dd-e80f-4f34-8046-c11bd2bd6108", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744688, "uuid": "c09326d2-f21f-4a5c-bdf0-98141c3010fe", "value": "49152:2PbIEtePMnXOoO9G1Gx/soLRN1pHbMx4Ge5LLDtyM6vPp:2APMXO9mGZzLnHbNx5DtyM6Hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744688, "uuid": "a2e19d21-f702-4094-b904-3aa1d0e41c74", "value": 1855488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744688, "uuid": "046f864f-6e09-4563-9077-287c2dfd2b1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744688, "uuid": "b67842c2-12ce-4663-9f80-4f59b8edc305", "value": "41a723792e06dead70eea84c25b9c5b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3176d573-f873-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684740915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740915, "uuid": "71019e65-743c-42dd-9a70-c5f28ac13446", "comment": "Malware payload (Loki)", "value": "c66381bf6c218f7a2b195ff66eb1bad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740915, "uuid": "a834f349-06a5-4a8f-9182-b09bf4298e17", "comment": "Malware payload (Loki)", "value": "d3f08a55d341c62fc5ae5c69aecb7a97ec514c11649bd2d77d187bd30b87d066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740915, "uuid": "72b675d4-6e4c-444b-8866-c44ad3bb716e", "comment": "Malware payload (Loki)", "value": "34ad140fb519329d1ff73512f0c87dc0061e2297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740915, "uuid": "d3d6d782-b416-4c4f-af8d-1f474fa9e174", "comment": "Malware payload (Loki)", "value": "c4cf2f509ed36c9ec2b11603cc07e8e3ba030f80d56a39258a247df4aae80347e8e27024e361042a1a4ba109bd3c3644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740915, "uuid": "5774dffa-6fb7-4fc9-815d-e96290d29aa8", "value": "T113629501A775673EFC906F36EB731290023DA6067CD2A65EDC8CA34C5D7161DE792AB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740915, "uuid": "1418cddb-c38b-4fed-8b63-263f8fa05d91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740915, "uuid": "2318c781-2509-410b-8ee8-1aaa4ba7f1a8", "value": "384:jedffffdRZuRXlp5LMT/bF89WH6gFxjrEvIOldYQ85LKzY:CLRZuRXdQ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684740915, "uuid": "dc666821-eb24-4dcf-8c8a-d30c5fe07502", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684740915, "uuid": "76a5e258-3a4e-4cc7-a077-447ba8890df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740915, "uuid": "d95d81fa-cf54-4a58-8fce-b3dfc79f1db0", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363b203d-f8cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684778719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684778719, "uuid": "d5d8b383-b3e7-481f-a891-b8c9931ea1b2", "comment": "Malware payload (njrat)", "value": "6de672bc660428ff23b25403974d361f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684778719, "uuid": "840a02ea-ef68-4ccb-a938-5dee4d8c490f", "comment": "Malware payload (njrat)", "value": "d54a696e1092ef4fc7fc44792723d88eb040947bf646d47ebe79108f873e3361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684778719, "uuid": "769bf9ae-d70c-49cc-a56e-4a73e943f786", "comment": "Malware payload (njrat)", "value": "f4ef362df643c095f9066533f09c558437ecf5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684778719, "uuid": "044e3a8e-e4af-465c-93ee-4005aeac31ee", "comment": "Malware payload (njrat)", "value": "9d12f0e917dc3bde942f1c37fe85c7b7d0dc64c5f871b2c2d96debf04c4c22a8d6bab80421453e47bbea38626a4bfb4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684778719, "uuid": "9692a41f-d326-432a-977b-d79704a1c668", "value": "T19CC2395D3BA08176C2EF2BB406B2DB2502B2E2074A27DB5F4CD840FA5B777C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684778719, "uuid": "46f26c09-dcae-497f-a871-3b5e5100d637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684778719, "uuid": "5f219ceb-e2cc-4ca3-a592-3874c6c30a53", "value": "384:gLd6haZIVi/dMkt1cpDkjetHzCYe/4Y2OzRLTm3yilqr63sbztVvGf:+w0IVi/dMc1uT5e/4sEEVvGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684778719, "uuid": "6e9e4c4a-79f5-4fbb-ad80-911b0ea508bb", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684778719, "uuid": "114335bd-32f8-4ab8-bfdc-cf4f93c32c0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684778719, "uuid": "5824f8e2-c94f-4d1a-99ff-2e01532448a5", "value": "bMJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b59c4b-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777235, "uuid": "3657ddc6-afdf-40d3-b865-a66c0f58886e", "comment": "Malware payload", "value": "cea31b82dbd4c7f4a7ccec8bcb33292c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777235, "uuid": "77e21649-39f2-4df8-93c7-3e2302f8bea7", "comment": "Malware payload", "value": "d5a596c31a932e2c3d2b9afcf4282406d9a1af1c2d716f6a0da14c5915f2b40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777235, "uuid": "bbcbc0f2-c515-40a8-aa7d-312acaa45809", "comment": "Malware payload", "value": "70223955ddd3a37f337d500326233d41c1f593d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777235, "uuid": "981a227d-08c1-4b72-83cc-89c083b66341", "comment": "Malware payload", "value": "3952025e329ed99cac3a72a36cee10ef56490844faf725b62b1a2edc2bccb08fc1e11b00db593fc5578c9571b3a37e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777235, "uuid": "eadd1811-93b8-432d-abe5-9e0d5d99cf64", "value": "T15D755C26F2B19433C1232679DC1F66ACAA27FE501E2C64463FE91D4C5F7A782741A1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777235, "uuid": "dcb33cae-efd0-47ef-94a8-219f1b54158d", "value": "12288:p8Xh7H7W5KEkdhzo9KF9feOm6elUkuZaykL:pghuoNdpReYe6vZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777235, "uuid": "a5b7611a-13ac-4818-bb0b-f1c0bdedf75f", "value": 1550848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777235, "uuid": "e4541565-b80b-4cb7-9414-063f839e4b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777235, "uuid": "1f963db0-b8cb-4b5e-b438-abf6010db635", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.2957.23882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a996c45-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744286, "uuid": "a1f846b7-cd8b-46eb-bbcd-483ca75ddcb3", "comment": "Malware payload (SnakeKeylogger)", "value": "2e4204589fdd093148b7fa9bbda5faed", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744286, "uuid": "90591fc7-49f7-47d0-917d-7e21e9b4844f", "comment": "Malware payload (SnakeKeylogger)", "value": "d5fb7c58f108718a330c35036d0a00a59752980c9e1e4be03958f563e50db7bf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744286, "uuid": "2178e4df-9e20-43d1-871b-d34e022ebbc9", "comment": "Malware payload (SnakeKeylogger)", "value": "74bed7e16415846be3727e6f4fc1a338ff28129d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744286, "uuid": "91e82576-8072-4efa-8651-440bf66a0cff", "comment": "Malware payload (SnakeKeylogger)", "value": "f3ce94ea2056d958da92878a3f04630466d91dfa3ff0f9fdb890bcbac1bb9507a91608fb5b51e37aa140617bf9a244f1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744286, "uuid": "8d9dc305-08cb-41dc-a581-69b3284265c1", "value": "T1FEC423D371E83C2D80D87D3906242706754ED26FFC3AB7B7AF61CA16526DA8BC422725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744286, "uuid": "814396ed-f52e-41d3-842f-84874d1c088f", "value": "12288:Vk0TQwe1bwHKI64hBVYu5JwvH6zYtHix2DVwUhnW85gJwvH6zYtHix2DVwUhnW8u:G0TQn1bahTYuUS4H5wgnWUS4H5wgnWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744286, "uuid": "99f459c4-d005-40ed-a199-3f5cf06409b2", "value": 576286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744286, "uuid": "d514cea7-2234-49df-8895-271ad775646c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744286, "uuid": "d40c32fd-3bfe-468f-9eec-2316ecb8c5bc", "value": "987654345678SK.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e76eb22-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752211, "uuid": "f097a362-fe6b-4c59-af47-b55183677625", "comment": "Malware payload (RedLineStealer)", "value": "dd4fe7acc8a404711b8fa08e49c75514", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752211, "uuid": "d84fe489-2de8-4c5f-ade2-ee4fe5e17be6", "comment": "Malware payload (RedLineStealer)", "value": "d69159f413249e2aa4d565c768f915e72a15fb780a1a50c233fafdbcc3d2e2de", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752211, "uuid": "f27ca24c-09de-4fe8-88f1-8a7c974f2ad4", "comment": "Malware payload (RedLineStealer)", "value": "acce75b31aa0eefda0b11e7516c477e13d179697", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752211, "uuid": "a1d582c7-d2eb-4b6e-a649-ce1336dc4164", "comment": "Malware payload (RedLineStealer)", "value": "ec398256bebbb6c10d91ce670269e2cd6565e0314be40f2ce5481a00f0899e00368c4fb081b690ac8dc4659ec6168e0d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752211, "uuid": "63169e64-5b3a-4421-aa5c-57aab6a3b4f0", "value": "T10925236267F5B033EAB01B7004F643A30A367DA4893443AB3785ED9E4C736C86876776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752211, "uuid": "23e834f5-4b3c-41d8-aebd-80ce314fbc49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752211, "uuid": "b001c50a-93b5-48ec-8b37-5e229ec79618", "value": "24576:PyUvghzXeXMKqluCh6bUUBpQh/WB9epKVobp8V:ap0XVqlJh6bUUBpQcHagob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752211, "uuid": "b5b17b34-c4fe-4be7-89fd-fd59b8242cc0", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752211, "uuid": "406ff761-430a-42c9-ae89-4902741c00ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752211, "uuid": "5a8d64a3-d3d6-4e11-89cc-c07a1af66bf7", "value": "24468244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e09d6c-f880-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684746833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746833, "uuid": "92923416-a6ba-4c67-b438-08a8d9a7aece", "comment": "Malware payload (RedLineStealer)", "value": "5f95a41ddc2d718ad143a34d077fbf62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746833, "uuid": "45dc68d0-7672-40f9-b3dc-89c1f9ed44c8", "comment": "Malware payload (RedLineStealer)", "value": "d6b8e3a14e9600c7bf74608c1a9502b39fe8997f1e0dc84189a0576d90aadd53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746833, "uuid": "535d2020-12db-4535-869a-8125adf00406", "comment": "Malware payload (RedLineStealer)", "value": "9bef2309fee3fe7989f7e6126b084e18cc1c1c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746833, "uuid": "1cd88fc7-322c-4601-99f5-75d7c65d48e1", "comment": "Malware payload (RedLineStealer)", "value": "a2ff759cb23df57b515744e0919b720c9b1004e394a17f34008a736c35743a863544c800d8a2d309dbdc6fb768cb1b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746833, "uuid": "d7561105-5bf6-4901-a8b5-fdc7c5621839", "value": "T154B49C2FB1857D06FDDB48B380D672F18F53BDE3A53A96A938847E0C2D67B130969205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746833, "uuid": "7877dc62-3548-4da6-8b6a-d69fede2546c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746833, "uuid": "c3759732-c7de-402d-a5bc-33067a7eba10", "value": "6144:zAQFi/K5I4yCdj5aICyy9BK0Jtu3fA3H/rnPbRP6ueTluI1ignqD2D3u6HzEm7z:D0wI4HdHleTDRPku4Wb6Hnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684746833, "uuid": "96e5216f-9680-4a04-8998-cdd926ba030c", "value": 523424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684746833, "uuid": "c98b6a82-6246-45b3-8871-e99b503806ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746833, "uuid": "6aaa37ac-8286-4e8e-8582-433094a6733e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d56bd74-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737203, "uuid": "0fb07dfa-21ad-4228-aeca-aa8f40f07fbd", "comment": "Malware payload (Amadey)", "value": "2bfe5d3b99dbf23c411035d55e935c10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737203, "uuid": "1d45e5dc-3bb6-40b5-b0bd-9461eb607e0e", "comment": "Malware payload (Amadey)", "value": "d707e1fffca0562b44c23264a12ba9fb22694eb9a8385afcca0e47baa21fcd36", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737203, "uuid": "210626da-2a35-4c0b-a5c8-34ae61ae640e", "comment": "Malware payload (Amadey)", "value": "b69c05e44b5ce4d2444efe276b4fac130a8e64ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737203, "uuid": "f43b1fb9-154c-4dad-bdd7-c354253c500a", "comment": "Malware payload (Amadey)", "value": "08a6e261df89385eb6c4dc56f780331d0947783b0672d68baad4624a21cc5ff61e9389487415f31843a2f138c2016d8c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737203, "uuid": "305a217c-5407-42c8-83de-d9d08fd4cf3e", "value": "T12D252317B5E48573DEB46B7088F612970B35FC918CF4927F2391995A0CB2A48D6B03BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737203, "uuid": "4a716868-546f-4df9-94ce-3fe5e12cd267", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737203, "uuid": "f0a2ea97-8b54-4b1b-8491-4897a7d973ad", "value": "12288:yMrPy90qUxyB33EjLzisqbeOSCMZ/YF3hbQ046kIM5B0ix9AOxR9vBhcYN3vKKAZ:9y2yB33g2sq2C8/q3hk04b8Qzp4Z20F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737203, "uuid": "26b0d25f-7254-4c0f-a95c-218515e14c98", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737203, "uuid": "ba30018e-4179-4381-a850-b021526d02c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737203, "uuid": "8269597a-5367-4604-b7a7-f53e40de3b77", "value": "423629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c27ae5-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777218, "uuid": "35f74d0c-b857-46a9-be41-8b6bc8c6c370", "comment": "Malware payload", "value": "afaad7fa7f8ff51251210a09d0335c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777218, "uuid": "3d59eaca-a6f1-4983-8620-1650e714a59b", "comment": "Malware payload", "value": "d849dfd49847e5f32313a2bc3137f4e9666b0d2ef8bc6e28dbb363bd6eae48da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777218, "uuid": "a4371651-cca7-42a4-9d60-21510d908165", "comment": "Malware payload", "value": "913fd3c8a020950aa3c28c303c9b0384cfc1064e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777218, "uuid": "96b329d6-8a43-461b-945f-a747e6bcee22", "comment": "Malware payload", "value": "e0eed250fe564090bfb68f317da1a26d85e07f38a7c7ce3f32bbebc4f401476981a15bb247927a23a67a16ffc35d8973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777218, "uuid": "da7b9d9b-501a-4615-b5eb-41f6fbd28db9", "value": "T1D7825A83F3E3C4B5D2A305B29E07339F37736620455AEE4787241F992D31355AB0AA6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777218, "uuid": "d66428dc-669d-426e-9431-e25a76341b62", "value": "49be075b8cf6157a5c555fd6b0970ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777218, "uuid": "fbfdafea-69c3-44ef-8119-b4515a5218a8", "value": "384:wUlYt+AP7wRpcOZII3yGzEnZTl9KvWxpwTkIBV2o0BLj:/QrknLEZh9KvsY3co0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777218, "uuid": "ae44e542-07d6-4960-a712-c142da2b3b56", "value": 19200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777218, "uuid": "83618907-6a36-4c65-a143-bbe5145a3aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777218, "uuid": "85266728-01fd-4efe-8f1b-7e684b20eb4d", "value": "SecuriteInfo.com.BScope.Trojan.BtcMine.8688.7377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14185e2e-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763629, "uuid": "f83eab09-0ff3-4008-9221-ab04d30cad88", "comment": "Malware payload (Mirai)", "value": "59e52c9fbf3037abfdea5f2f089d3589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763629, "uuid": "702452d2-552f-44fa-983b-4437e1e20077", "comment": "Malware payload (Mirai)", "value": "d99a0d470754618eb54447e035540cc7f326e5d21210f6aea282067fa1cae5d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763629, "uuid": "88e00648-4316-4500-9a26-09e538d322dc", "comment": "Malware payload (Mirai)", "value": "d5d7618b7d79f805ce84d61018e7efd73ebb1500", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763629, "uuid": "4296561f-66b0-4363-acf6-dd9109dcf1e8", "comment": "Malware payload (Mirai)", "value": "18a93d211da7e1d3bf09ae1ee18deaa33d35d34329d29f4d97a31b5feb82a021ca4b742e5aa1a1a1523d4a7513d55e44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763629, "uuid": "4b5aa07a-fc5e-45ee-ad8a-488786fb6b9c", "value": "T14722CFFA5603ACF7C1688E7313229FD74E9664F6B4972B4F05500A4802DDB65F2A8287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763629, "uuid": "34aea3a5-1926-45e2-944b-7ca47f17e457", "value": "192:sOVnyIwLkB/ZzkqTKKjERKRMp+Nz030F/FmJcjcREAPgEE7hXK7CpAcpW191PoCx:RVnyIr/Zzkq2+RxNz5PqcMPgT7ha7CpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763629, "uuid": "96d2cc9d-e3a7-491e-88fa-a5da8039d8ca", "value": 10712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763629, "uuid": "5290cce8-c801-4a65-8b70-c0967dafac6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763629, "uuid": "a059882d-bc83-497c-92ce-4eb10038d995", "value": "59e52c9fbf3037abfdea5f2f089d3589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b15f810-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752662, "uuid": "a50ffadf-3a41-4ff6-b430-cc462a978b41", "comment": "Malware payload (Formbook)", "value": "a6790aab537e228ccb75011ab7ffb7a9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752662, "uuid": "bfea5486-fcd9-492b-bd64-3675bfa2e9cc", "comment": "Malware payload (Formbook)", "value": "d9df83faf6f18a8bc5acedde2002c1c91d4ebcb3a9ea0903b3514aa2eca69b9e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752662, "uuid": "ba0b0247-4f9a-4260-a709-f213213f74c6", "comment": "Malware payload (Formbook)", "value": "55fb0c22bde61ba95a81d6ac1771d4a54e2e3d5b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752662, "uuid": "adff8fc4-a60b-471f-b8d7-60e8c6091fee", "comment": "Malware payload (Formbook)", "value": "94d765917fb709190695437506a2e8b03d979e5d9a1168a65dd5d15d3826c0b5b6030ace785a120ff2f22bcd9f053917", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752662, "uuid": "bc249e21-9e9c-48b2-a0eb-633a4af250aa", "value": "T1B274237C17C0F6DE8CD9B5C4F6760B9B8F29AC5F4BB2002A653E6F1581ED1710BA0A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752662, "uuid": "fd64c26a-7b3a-4184-85c4-0b9588767a7c", "value": "6144:AY9kfNpfJAm6l4gd7XLhbFD85VxO9r97oetKZzgwuXxdu8A:QlAm6uODtbFDHViLghhUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752662, "uuid": "2b59337a-cdcb-4e3f-9835-ad8e4206eb70", "value": 341091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752662, "uuid": "1510cbf8-ac6c-45f4-84d8-7d258fe77c9c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752662, "uuid": "dd198c1f-37de-4c04-b097-2ce2b59c0235", "value": "Filosofer.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c170f072-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684762631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762631, "uuid": "dfac9f2e-b7ed-4a10-99e2-55777e009fce", "comment": "Malware payload (GCleaner)", "value": "17986865d0c907506da3bf87931bd77e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762631, "uuid": "c01332f4-9bfd-495f-9541-62c0e8f77717", "comment": "Malware payload (GCleaner)", "value": "d9f9b82651d039a2ac1bcdc1bfe2c1f1eb5c122966db9955725ec730754a47d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762631, "uuid": "57393873-896f-47c1-8535-38e3baab16b2", "comment": "Malware payload (GCleaner)", "value": "dfb5526fe28167e578d617e8503163de23979d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762631, "uuid": "4c9b02f6-8651-4e76-a5ae-ace8f5f42ef0", "comment": "Malware payload (GCleaner)", "value": "aae0388f425ea74c31e7f0a19e14aaa2a2c08a0ce4e91f0587691909a9c914568db78e5f8a8705c87be9ae3b9024becc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762631, "uuid": "8ddc32da-4e23-4348-b0ed-71026d93c496", "value": "T19B54E12236D4C032F16225744AB2CAB64B27B8364BB55ECB3BE1577D5F322D19E74306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762631, "uuid": "f71b7ecb-85a5-4edd-b5ae-999850c98281", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762631, "uuid": "77805833-1402-4fc5-bbbd-2ca8127e89fd", "value": "6144:DSkL89XnEOdalLWMfmHIKCAdSEr4/j1Jlc3xHzz9Vom9:DZLmn1QhfmfXS+Um3xHzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762631, "uuid": "2348edbe-2a53-4d24-be07-484084b39f65", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762631, "uuid": "f5bd7e2b-a8af-4ea3-b953-7ac9e4a7e26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762631, "uuid": "3a81434f-93fc-4d90-8c63-9baa6a8a14fd", "value": "17986865d0c907506da3bf87931bd77e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa3b62c-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684745770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745770, "uuid": "6503c3bb-349a-402c-aacf-a11fe6ec11ce", "comment": "Malware payload (GCleaner)", "value": "e11fa6c1322b5bd0dfe6495748ed5077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745770, "uuid": "9a5bebe3-ef77-4a92-81b8-27ab257db82f", "comment": "Malware payload (GCleaner)", "value": "da11e94b2fa207cd98fae4fa981ef21700835be3f936de95b57772b55fd3caf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745770, "uuid": "d738df97-f22c-4be7-ba7b-24ea18ab14e3", "comment": "Malware payload (GCleaner)", "value": "1d6103372071cfa245eb441e2bbbbdd8b7ebb2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745770, "uuid": "530452d0-033f-4c1a-b9e1-8255225d5c34", "comment": "Malware payload (GCleaner)", "value": "69a174337da775e32d110414956d7547df1787d863750160acaeb4ccb63587d9c460c1f272eb2ffd32e4224b6bfc5767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745770, "uuid": "2d1a7a9d-a097-4e8a-a634-f407aef6a1b9", "value": "T12CA533D1E3ED4231E073C6B1B82795B1A5777A1A8A27911C3D0A5E2F492B71F942F383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745770, "uuid": "3e69ed4d-747e-4858-a172-ab6fe0e4a361", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745770, "uuid": "8a099388-1e7f-4cc1-8833-8d915a35e129", "value": "49152:RiVJ2sC3PxbXxlQdsxKZUsVUfF9DqIlsbv/iBCvJ6am/s8wuZ:RiiskPVcrT+7qDbdIamk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745770, "uuid": "46f2619e-b4c7-4942-b6d5-3bbec3bea04b", "value": 2145406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745770, "uuid": "9f318829-09ee-4731-b02b-724dbcfa1cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745770, "uuid": "40baa004-5886-457c-914a-ba183e4fb891", "value": "e11fa6c1322b5bd0dfe6495748ed5077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce8d8c4-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755886, "uuid": "14a21631-ca57-4f2b-8810-4f9dbd4a694f", "comment": "Malware payload", "value": "5ba7487b338dd0b063dd6ed7822f25da", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755886, "uuid": "b66a8528-520f-4f60-9c66-05ad8e45df01", "comment": "Malware payload", "value": "db6f93f8ce2517014b8f47058a2a401461b55a2bf8fd3d4601459eb15b8e0ed5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755886, "uuid": "73e18c14-d8bf-422f-94e5-dd31129fca43", "comment": "Malware payload", "value": "5562f593513b282ec520950f9ed3b753ba6892df", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755886, "uuid": "14e7d4dc-70ce-4b15-9725-2adab62c7c4c", "comment": "Malware payload", "value": "4d0ac36b5176fd09d17de4e959ac4d537382569dbc759761dbf117c09aa90a0b1a1fdf41dbd58387782682a6a3971e97", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755886, "uuid": "f6660859-bdfd-4bde-8bf4-1e4b1a174229", "value": "T116C39152F252C61BCB9957310CDADBF5B674BD128E0A861B3246BB3E3DB7360DA16340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755886, "uuid": "185fd28a-e5d8-4d9d-a65f-229ecd645d15", "value": "3072:q5u5AakoEUHks0sl4RLivCrDbsjNw2cM0NtJQpgRLaR6:t7HjfNwu0RQoLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755886, "uuid": "34a9a3aa-d1a3-4207-8430-88d1ea4b1adc", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755886, "uuid": "18aa1d72-cecd-4550-82e5-f96d2a80bbca", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755886, "uuid": "d6c26989-c38e-4d9d-8c24-d3418c0a42a3", "value": "SecuriteInfo.com.HEUR.22305.31534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9604db03-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1684752680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752680, "uuid": "61593a67-5adf-4b1d-afb2-54c1aadfc37c", "comment": "Malware payload (DarkCloud)", "value": "b679cb085aff07fb0a91b59e2649c435", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752680, "uuid": "9213c7b1-7f88-4ba4-a3eb-e2b6ae9cb69a", "comment": "Malware payload (DarkCloud)", "value": "dbbc0d4b29507597745e2316b8bc8696e1a822d4375a094eb9a266f48071e4aa", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752680, "uuid": "e0c75e94-735a-4322-8bf3-57a5c61e902f", "comment": "Malware payload (DarkCloud)", "value": "6289e13e69cc602a3e2ccd0b0a430e54b61ac3ec", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752680, "uuid": "e27a3c5d-c05f-4bc3-b053-8deebf7c3d04", "comment": "Malware payload (DarkCloud)", "value": "e4fe4a6b9fac56d5e936cb82838a86583264317e82eb4fb76f3ec5872c08f588ee1fa4a349fbbf9e87b27f690c35aec2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752680, "uuid": "2bc9fc29-80cc-4e78-98ae-d267da00be6d", "value": "T19925BD5233B57621F4BD73FD00196388CB39B44A2022E22A2F563AD546D37EB771A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752680, "uuid": "e2248928-f2a4-48a1-a7b2-4db6a322bafd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752680, "uuid": "826d8e0c-6f4e-439f-8c40-5f559d86da0a", "value": "24576:jtIAuLop2vS9uo5frpVB+O08dhvAxkkK2vqN/:qAO6YctvVzv8K2v8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752680, "uuid": "d241c26c-d659-4c5c-bb90-6d9efba6fb18", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752680, "uuid": "455024a4-2d46-4e1d-b9f6-9ad02ae2ef1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752680, "uuid": "0dd02f5a-3d7c-4687-9063-0da49a09632f", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7b336e-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737449, "uuid": "ec10feb3-bc6e-4d72-bbfb-11ec636d321d", "comment": "Malware payload (Amadey)", "value": "97c1c0b7d9860d9d5d5da584415b92bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737449, "uuid": "58a3ec4b-c870-413c-a40c-ddbf60492677", "comment": "Malware payload (Amadey)", "value": "dd30b2c728177173c76d17160d9f7536d0b2dd1c5bdbf4610ed01a4d57f98199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737449, "uuid": "75fddd48-2a88-4bc8-a7c1-d5e7438893d0", "comment": "Malware payload (Amadey)", "value": "c7928d42018bba6b95fb185509b5b76f44decce2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737449, "uuid": "42d7effd-ab3b-412a-9c10-0479edea024e", "comment": "Malware payload (Amadey)", "value": "7ea15f4567b30d826dea84060854d420c0e9e09e80a8193e936730086d1ded79fd3def68ce03d641b188b454e583fbb0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737449, "uuid": "1cc4e14f-d542-470f-85d9-cfed631e7dfa", "value": "T13B252316FBCC9037D8B2377988F603930935FCA59E7483962B14F81B2DB25A96931367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737449, "uuid": "f1e47947-3418-4bc9-9d2f-5826733ef7d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737449, "uuid": "d7a0453c-03ba-46f1-823b-7891a11ad01c", "value": "24576:Ayl+GtbHPhhq38dHojajhypqgZd1bKPP2/82Iyn/+sYniGU:H0GlHPhhq38fYP23mx2FniG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737449, "uuid": "51e30d4a-fc1a-4752-a9aa-7bbe65658db5", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737449, "uuid": "bc81fbe8-4049-4f78-812b-e8b1dc87e899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737449, "uuid": "bc946eab-a58f-42de-b21d-964ed7e87c3d", "value": "extractor953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de38cf57-f8b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684767404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767404, "uuid": "96f5e49b-2359-4398-a269-b0b6be29937e", "comment": "Malware payload", "value": "931bacac5a5e4e986498a41b7b82e919", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767404, "uuid": "3c17233a-5567-4e81-b508-181139d2fe41", "comment": "Malware payload", "value": "dd74e5612e0737ad447e3e6d17e6c7968572da7d4747a47bbfefb74739a2bcf6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767404, "uuid": "efbaea0b-77ad-41ff-bf7a-758748dbf35b", "comment": "Malware payload", "value": "ac400e076850b5315910df377d6e68a329877fea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684767404, "uuid": "cfb3c288-2a1b-4826-bbe3-026b56a2908e", "comment": "Malware payload", "value": "2ca6100441706fa88b85dd9d82e1590bb3c9797edc2b9b1bb282beb1d9f7ce23de98d04e865e48d24148912c340dbc21", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767404, "uuid": "37b7d413-5838-44d5-9e3d-90e91c7b173e", "value": "T1C9B33D804F5914A2076B6F2E7771A4A5CBAE0F798294558BF07F7251BBEE90ECCC1630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767404, "uuid": "c90199f9-0fb1-4bf0-8a01-24be3efca252", "value": "1536:pz3QaKA4sas/qivjCaOAJrxdYEoq/FQl3NcOnxFvEWJXZPAf:qy4sxOAxxKEoSFQZNvxVpAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684767404, "uuid": "8da28990-d4ff-45e1-acd9-4970a8778b1f", "value": 117933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684767404, "uuid": "886e3c80-32ee-498a-ac70-95c482f80aac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684767404, "uuid": "4a110ea1-6d8f-4048-8dce-75165bbae5be", "value": "Jgvjewh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8123fb24-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737613, "uuid": "016b73d6-d84f-4cae-a699-e89d89c65ae3", "comment": "Malware payload (Amadey)", "value": "fb33ba7d0fc60d702c59f5f82dc3ffd6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737613, "uuid": "5954c171-2d16-4034-97c4-d87ca6a9e4eb", "comment": "Malware payload (Amadey)", "value": "ddc0ba7027e5d33da0d0d33c402eda0bde5fc88b3eef8527f1dcbe5bcfa8b518", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737613, "uuid": "61aacdd1-340c-4ad9-99cf-a5b498e3a6a0", "comment": "Malware payload (Amadey)", "value": "540097c5db23dc89e5bdd22d2e81c8009781e450", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737613, "uuid": "043cf6f1-8d28-49e9-b3ba-aaccdf937a8c", "comment": "Malware payload (Amadey)", "value": "5a1689abeb5094d716aedff140f9991d418d7016811809e668434311f152c1571b18d9abeae1b42d3ca2400a3c27b262", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737613, "uuid": "36173939-5cdb-46ad-994e-9dc8dc3437c8", "value": "T11F252317ABD4C4A3EC79373068F613931771BD71AA74A91F2B45688F4C72AC0683276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737613, "uuid": "b74ad653-6975-4e34-afc3-c6062d09a9aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737613, "uuid": "275bc808-47e8-4a43-b1f7-0a2c3c61bdcb", "value": "24576:SyoZN7osqgE/3W/MEsquxBZp1+xwBKdDbzejFL7A:5i7jqzIHzwUzejFL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737613, "uuid": "5a81db49-5f0b-4c84-8b01-73d3e40c3e26", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737613, "uuid": "55d79a96-8b0a-4026-acb7-593513025a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737613, "uuid": "b4672f67-12a9-4f41-958f-4aacaa42d310", "value": "readme870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5a6f99-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684744856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744856, "uuid": "ad1c4f7d-2587-440b-b87e-adef01b6f4f8", "comment": "Malware payload (GCleaner)", "value": "109cf8ec6281abcb8091d58543edf2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744856, "uuid": "e98423b4-fe07-4c1b-b00d-1b999e789dfe", "comment": "Malware payload (GCleaner)", "value": "dea05b5053f634393bb7c50d4a544fb1cfa75546f694b05dcabdd7ebf2400410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744856, "uuid": "43911b78-e8cc-44b8-9e40-2ce4aeeb4076", "comment": "Malware payload (GCleaner)", "value": "a07c6fb5960905a8dc1a36600000b0076d59d6fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744856, "uuid": "97cd07a6-aa8e-46ec-a396-2cee36cb86c3", "comment": "Malware payload (GCleaner)", "value": "02a2c78be3cdb4ba9ea2c7c461946413eeef26695cf6376bc022a3ce7ded046017bcf40ba301d84dcb24f33f6d1f806e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744856, "uuid": "db571f44-9bff-4141-88fb-0323795cf8f9", "value": "T1E284BF82B293EC79E96516314D3AC6F8252EF8514F2827C772943B7B1D312E2D6B7342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744856, "uuid": "813be136-2b11-4f75-b660-85b6fc374688", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744856, "uuid": "5111f1cb-68d5-414b-998a-ace6abb08899", "value": "6144:gGSclNu2O3kvqL/Iz5Yov3VfGFp10Spv5MTXT:gultQkvO/AvFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744856, "uuid": "de86b1e2-ffa9-44e9-bf42-a66ffd779a03", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744856, "uuid": "252ed842-5094-442c-b14c-d21e30875c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744856, "uuid": "13bd3b62-afd6-4025-bac4-a843507e27eb", "value": "109cf8ec6281abcb8091d58543edf2a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c0ee43-f894-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684755070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755070, "uuid": "acb0f048-aa18-4418-a30d-7c086dca8afa", "comment": "Malware payload (Mirai)", "value": "eae3731a9c2bf333499a0b4eb0b72dbe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755070, "uuid": "73f00171-0fd2-4cc8-ad67-fd4ad1c1cbab", "comment": "Malware payload (Mirai)", "value": "dffb31311e22e5cf804b010bfab84944de6bdf596f3bdad5e5fd57fde68329ad", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755070, "uuid": "f4109ca2-447c-4961-be3a-3fef6efea38f", "comment": "Malware payload (Mirai)", "value": "d13ac38936f6b46fd72b005a8a3a178a518721b5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755070, "uuid": "8c0228c2-b463-44ca-947a-60022c412cba", "comment": "Malware payload (Mirai)", "value": "7add776097440b3e259753950485475b5e5818e997be0255d3665b98f283a7a6e15bfddcd48dfed4785f6fd06cababef", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755070, "uuid": "84491a87-dc23-4647-96d4-60f825f75937", "value": "T16C734B0375C589FCC188D13446AB3536C826F57D1336B19B23C9BF262C4FEA05EAE59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755070, "uuid": "34cc758b-c9a4-487f-8ff9-e466386f61e0", "value": "1536:3BpP9zScO1NvdkwlUbzG/Nrzn2Nx3QTm/uKBfMw8hMba32DH:3nP9xO3vdFlUu/tzn2Nx3QLKBfMw8aTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755070, "uuid": "403af49b-6620-4942-a036-bd8e77b1cc32", "value": 75680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755070, "uuid": "7e4c94c8-9d01-4dd3-ba1a-e687c07a4d30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755070, "uuid": "c642f53e-0371-4513-91df-83562ef695f5", "value": "eae3731a9c2bf333499a0b4eb0b72dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb2882c-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737313, "uuid": "cce9f6f8-cfa1-44ff-9bdf-399a32bd61c6", "comment": "Malware payload (RedLineStealer)", "value": "9fb06e1bf84eb7edfd17d405d47e819c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737313, "uuid": "3bc97697-da38-4b7d-9ec9-464d2dbfd7e3", "comment": "Malware payload (RedLineStealer)", "value": "e06320493354197ecbc5687ba4f854004bfaaf54f27be1fa0bbc31cff3803bff", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737313, "uuid": "4d30ad97-ab2f-408e-994f-9cfae75fcc9d", "comment": "Malware payload (RedLineStealer)", "value": "518687422b8d3567675ec8dc7f4bfb9f9a02c8e7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737313, "uuid": "d9686a96-9a7e-415c-8531-c933fe15eb49", "comment": "Malware payload (RedLineStealer)", "value": "05da2b0d2c47c72584f15729ce17152e0fec8396a94d642a7048681d68f6767e216cc1d0cf214a06bcc0311ac05f0a07", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737313, "uuid": "c6b2e1d4-5397-42de-8ee1-81a5e445634e", "value": "T13B252307FAC89472CDB46BB06CF711930B3ABDE3AEB4511A17416DA95CB26D46A30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737313, "uuid": "30dfc14f-e319-4d29-bf0c-d4039e2ece3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737313, "uuid": "46098d8f-2a56-4924-9813-c73f566893d2", "value": "24576:9y1EOlvq/HIieqCXwzmOFPJjYHe9ts3zMHUGqnb/bIr:Y+Wvq/HIieqZZFPBYHea3Gqnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737313, "uuid": "2d47711a-717c-4334-ae04-12728477defb", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737313, "uuid": "ea0a256b-3dca-4bd8-b410-992d749ea479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737313, "uuid": "5ca82ce9-01c7-498a-a177-fee85b68500e", "value": "Launcher397.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29c2d67-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777236, "uuid": "f3423844-e737-44bf-933f-7470fd981103", "comment": "Malware payload", "value": "f03988766c2bac30f0654c4bbbc771dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777236, "uuid": "736ee5db-ced7-447e-9924-22f3a2675837", "comment": "Malware payload", "value": "e0ef179f29d2bbfb4ff431c87fd905b1e62c92f7549cfc449f19d23c53869a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777236, "uuid": "3454c034-4696-4513-ac29-a0bb8113217e", "comment": "Malware payload", "value": "305d97e9455a1ce90367e6a6a2abfccd81d2570c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777236, "uuid": "b0697af6-ff3b-4e72-85d7-30d08e251b8d", "comment": "Malware payload", "value": "52bb6ebc30cf61d9e9c69a06fc278d415b2c665ee51a94b5a4cad86defcce1b86852f50c2afb44f6862907f7c9af73c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777236, "uuid": "bb14aed3-93b5-4071-8478-637e6707d585", "value": "T13BD2D7A73347D460E69018B4ABA5D081A56F7DD4CD9781073AE2BF9FC4F1318EA01E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777236, "uuid": "86147676-dfa3-4621-8449-f77e998d97f2", "value": "192:7G9oPuFN+hGY/KS2nxrKHsYR1bI4M4XiZHOVk+3IEMQ:qo2eHss79XiZHOVk+4EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777236, "uuid": "bca6a61b-2a38-4e06-bd46-6c98fec5b3ab", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777236, "uuid": "f9e972db-fc80-4acc-b515-d32c0b02f6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777236, "uuid": "89e2e38b-f374-451c-90ee-f1c7f95ee93f", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen2.22138.5567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d7baa8-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752354, "uuid": "ed4ccb42-9184-4a24-aa40-b12c478c9418", "comment": "Malware payload (RedLineStealer)", "value": "2a980bd16ae31f52e093851b226be5ae", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752354, "uuid": "34b9b4b5-8f62-4aa4-be5d-d28a11062380", "comment": "Malware payload (RedLineStealer)", "value": "e1bf75bec218c0c6fb1bc4f0fd8c7838f02f742107759a297a43a1da90687a1c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752354, "uuid": "0d748093-4f39-4e21-933f-190cd8e19cee", "comment": "Malware payload (RedLineStealer)", "value": "0a49cbc6d3af6ee9290a4c98beaa25b912da63d0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752354, "uuid": "bf925488-e523-4191-9ce3-89bda55ed770", "comment": "Malware payload (RedLineStealer)", "value": "7ef8ace2539be4e8aa6303ee2385c74199e14279cde4e4c241cd02c4ab750d68137134d70ca6da7a40ce6870bbd2f441", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752354, "uuid": "b5d02e86-bfa5-4d50-9722-917c83e40243", "value": "T154252311B6F8D172E8B13BB098F61BC716327C619EF482AD7B96589B0C711C0B57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752354, "uuid": "3cc2b740-11dc-44f4-9559-3eaa4d9a7841", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752354, "uuid": "76dae69a-bd98-4e15-a44e-0378d9082c06", "value": "24576:YyQ5nzpLMCFnMUBev8H4TS/nwDYZjkKAQ/IR2t3xNTM5lu:fQ5nz5M5UFH4TSYDYZwKAQOEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752354, "uuid": "46b49ee6-8452-40ab-8ec6-68a74b51a1e9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752354, "uuid": "27111329-7be6-4528-bf40-cbae9b04e64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752354, "uuid": "ac000898-0200-405b-9437-b2f51726f14c", "value": "calculator954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411edd14-f87f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1684746095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746095, "uuid": "dc94f90e-0e99-4810-838f-275be0d094c5", "comment": "Malware payload (LgoogLoader)", "value": "f7e9556d67931ffa5910fef7fceb4d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746095, "uuid": "69b9091a-20f7-4614-b793-7fed390ff9cb", "comment": "Malware payload (LgoogLoader)", "value": "e1ededbeab9ac5f59c4f4c8e019a0db44b406a25f72bc0ce19425452778834ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746095, "uuid": "a444e79b-02a6-4da1-b07d-e5b6d7355de6", "comment": "Malware payload (LgoogLoader)", "value": "6fdf975f3f5aaca8a80f52124a21d8021caa55d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684746095, "uuid": "9ed30211-21f5-48e7-828a-ae779ea18e6f", "comment": "Malware payload (LgoogLoader)", "value": "dc5d04b0c631560568236a2c141532362f3881a9e9463caa77ae54f2d13d171960f1f9619c83c10bd451c1be51e6254b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746095, "uuid": "0e3c557e-4d94-414a-96ee-e66583a6e921", "value": "T172B4CD85378A021FC0D569327C840CFF95736673B78D5AA12CE0ADB6F1E77EA8A01E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746095, "uuid": "53e760d4-25bc-4a59-adaf-ed8a81788e32", "value": "12288:SJiPJp9cuzwn2lZDOqzAXglqwceF1OGzfakP:SAiWKgQwRLhftP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684746095, "uuid": "4a2226fe-deeb-4fc7-afde-49be15a3b414", "value": 505704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684746095, "uuid": "aecdf22f-4dac-4e84-9205-3816e3ff99ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684746095, "uuid": "5a000975-f99b-4118-a6c0-4d07b560a6fd", "value": "f7e9556d67931ffa5910fef7fceb4d23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a69cb35-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755909, "uuid": "12bf31c7-c4e5-4e8c-923e-957f5445b0d8", "comment": "Malware payload", "value": "9aa8c4921ab1f794475d08e8131dd69b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755909, "uuid": "6619eb18-d7df-4e01-b99c-7758c41c6faa", "comment": "Malware payload", "value": "e2361d5cb58de33b17a4ae77bef937d3153efb3877975bae6116436575fb7a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755909, "uuid": "a9f386c3-14d1-4dbd-8d6b-3888b6842403", "comment": "Malware payload", "value": "01360c0c73ce9fb590482c5ab7752da673911110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755909, "uuid": "25081905-ebc7-488b-8b28-f2fa9951ed00", "comment": "Malware payload", "value": "121a6ecfc1d3c55681891ae31aed2e3aaa3671f2da5e4e73f06b3efd011b8c71f6b99a7798b67e50a22cc7d2b7b39ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755909, "uuid": "b95bab49-bb5e-4c61-9311-ad5e786f78a5", "value": "T150544C01F641943AF96331B6C8AE4EB999A89E644F0170C7A3C97F3DDBB16E27931107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755909, "uuid": "24f1350b-46da-40b2-a5eb-62ed9095c5f5", "value": "c2009e6ec8f38b440644001aeb5861e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755909, "uuid": "4b6e734b-bc7c-42bd-b9dc-2e3aadc92951", "value": "6144:GjGxIXlE9VzbKqgPFyVlY+SOLBmZBJp4OF5T:GCqXlqlKqgPFyVlYNO4Zfp4gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755909, "uuid": "352bb3f3-b7bd-4089-a1d2-2e4dcc9ea30f", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755909, "uuid": "044898cc-3736-47e3-95cf-4c21a3f2775b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755909, "uuid": "6ed2762d-c92a-4840-a72d-05d754b57c44", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.16897.30564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ee6eac-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752270, "uuid": "44409f91-5dc1-4dd0-8fcb-09d0ea8cbe37", "comment": "Malware payload (RedLineStealer)", "value": "ed4bc3feb2cb33f2aa022476f7cf6e64", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752270, "uuid": "ba453eec-3aad-496d-a9b3-23f616a940e0", "comment": "Malware payload (RedLineStealer)", "value": "e3b8141fa760a78e94db1c9d67eb79658fb62919dd40cd5d30de3298695472d4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752270, "uuid": "2149bc72-e7f9-406a-bc2a-7f79aa5520f4", "comment": "Malware payload (RedLineStealer)", "value": "dd6e5b539c274872e7100a1705577dbec0fec018", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752270, "uuid": "e455972d-697c-4ad4-abd2-0da158b396ba", "comment": "Malware payload (RedLineStealer)", "value": "8fd4dd75883cf117d8644df0fd1afad3cef1ef1126050fe6c43a8c7b021713b72e924c2451c24acbb5b0934296c29a58", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752270, "uuid": "595500e4-3d9a-4119-ad54-f803c84de2e1", "value": "T1942523026AE81167ECF56F705CF716830926BC90DE70A27F3682A45E1D73A90B4B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752270, "uuid": "167bdcb3-4397-4dcf-8a07-105235e851ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752270, "uuid": "2f7dd313-eaa6-4372-89e0-10b20f9a7561", "value": "24576:GysoweHrMJPqewC7sZamhMscfLvGTbKsQTu1JWNMf:VsYLMJPqewCAMvfLv0XQTu1JWNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752270, "uuid": "abf24acb-b89f-48cb-9578-24dfc2c41612", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752270, "uuid": "ec0bd74d-098b-421a-8505-e3dc5ebefe78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752270, "uuid": "8271f03a-8e74-435b-8e94-770ac87fc91c", "value": "62263263716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63c45fc-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684752841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752841, "uuid": "78bd0f12-1d88-4aba-b563-b1d0342bf922", "comment": "Malware payload (Formbook)", "value": "bb4d2f0b16f742bf5ff00767ed94a1ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752841, "uuid": "4bddeddd-0917-4111-b5d2-d0c0ad0eb2e5", "comment": "Malware payload (Formbook)", "value": "e3d4fccd07d41f7c76da4a4602079ac0883174b59ebb2f8b4c497e703b9a46c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752841, "uuid": "82a25b63-3837-42e3-899b-1c5215063e99", "comment": "Malware payload (Formbook)", "value": "1a77b0d798fac9d49afddbfb4fe1f17cf849c7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752841, "uuid": "d9a2f02a-c5e8-4cd4-83e2-ee741bca7832", "comment": "Malware payload (Formbook)", "value": "fa87d52311ec7443249d86c6551abe9862b2c50fb3ab442f867ad66588c93bc506175451fb2bb9915ac78fcccc5743a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752841, "uuid": "67083c69-9048-40b3-a719-8095df97e85a", "value": "T1253413007BD5C17BE8574A32AE3A5D7A6FE99A210C7C931753844B5D3ABA241F80FB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752841, "uuid": "160f7ebd-586c-473b-a74b-f56a15368ff9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752841, "uuid": "2fbc3fbe-37ea-4841-9fb5-18329352dbb3", "value": "6144:PYa60BI/9SkHuSatx1jGNTsqMmKiaH4LnGsFv:PY6BnkHWH5GLmrcGsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752841, "uuid": "749a3237-3f78-44bb-ab5b-940c689bc532", "value": 242297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752841, "uuid": "eae58453-c84b-441d-bd67-c20a6f6e78f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752841, "uuid": "af41ec52-6287-4301-9fb6-d827500110bb", "value": "PO-13228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa95be2-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684762593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762593, "uuid": "d6398212-1529-4b70-812e-b6297f9ed598", "comment": "Malware payload (SnakeKeylogger)", "value": "194b506fbf82fe9b77deb5c19fb55328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762593, "uuid": "16c6c5db-68f6-4cab-a9a8-7cf774bc286f", "comment": "Malware payload (SnakeKeylogger)", "value": "e45030071efb40774095252901b94b14010a11daad0c3009e3bfe5a01c2fb869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762593, "uuid": "e619b7cb-e0db-4be3-aa0d-4f4371779096", "comment": "Malware payload (SnakeKeylogger)", "value": "bbbff08a317a03ac157debb3a27993de72538542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762593, "uuid": "bd7e082e-1ad2-40d1-b2a1-5df1e88bc3f2", "comment": "Malware payload (SnakeKeylogger)", "value": "76a18b1157ee140aaa072ea7106f97beb0e069a5cec424e32b1f26a47960cf67a6eda724b616dc18d0a5db20219eb83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762593, "uuid": "3da4441b-2a90-44ce-8d12-c5b38830cdec", "value": "T1BD34F1107B697B29D61A67F59FF5202143B2EE077121E3984D4720CF0E36F58B62ACA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762593, "uuid": "96ae0d47-2f3d-4c90-bc3f-cf680123f853", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762593, "uuid": "aea8f181-dfc0-4bb2-aaf5-0edb8cb6878f", "value": "3072:SKuBCFu2f+kKA+YpqkRY5QLzFk/ZPBr4zISCCPhrSHQQbTuzf6XC+iNRK+MY:sBsL+mzqkRY5QLZk/ZPJ4zOwQQbK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762593, "uuid": "775554aa-2450-4322-9865-685991c18675", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762593, "uuid": "44c40050-0aad-4ad7-a76d-0c49137f593b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762593, "uuid": "5dd5aa70-c599-422d-95f9-48c8a2e77076", "value": "TGHQ000800000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8a6a35-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684744911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744911, "uuid": "14db52c2-5626-44f4-b7ca-286b9630777a", "comment": "Malware payload", "value": "5e8c06644329c4e07c5aa489642d00da", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744911, "uuid": "4b3da4eb-8385-417b-aefa-ae459fb914fc", "comment": "Malware payload", "value": "e4bf3482d26d267d085cf99152a07e15e026fd809c4636e938a615a6d29e2c2c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744911, "uuid": "c31595ee-2347-445d-b5f7-57ec9efd637a", "comment": "Malware payload", "value": "996d8a67ee41f6d8ef1f83dab9737cd60f933a54", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744911, "uuid": "f6174684-f754-42ec-8020-5f63bfb1ffa2", "comment": "Malware payload", "value": "f8f3af301706867d8cd0a2dfa311c7b1a050a713e039fc5083fcaf642d65d9c541dc7c9c33fbfe619aecdf988c726437", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744911, "uuid": "24146b9e-6bee-4c66-b094-fd8cd485f109", "value": "T154848B136548AE8BD205C3F47F8B3C5D770A7E21A6C536D6326CF74E2B3462A988711E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744911, "uuid": "3641aa58-0b83-424c-953b-84132642a844", "value": "6144:CaFJkKXiDU7w5LsJT/qGRaFJkKXiDU7w5LyT+T/qGL0I+5TRasCiJURvpErVtQXj:CaFiKXKmh/haFiKXKAI/oIsa46ELkftF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744911, "uuid": "8e0c460e-58c8-454c-8e98-e039b376f016", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744911, "uuid": "1c1cbd4c-e5d8-4e17-89ee-d47e8b8fdc24", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744911, "uuid": "b9d701bc-24e4-49b7-ace3-845d1d4aeddd", "value": "payment proof.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f562821-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684779593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779593, "uuid": "c2c15815-9d3b-4a12-bdc0-7b4c143b580a", "comment": "Malware payload (AgentTesla)", "value": "6ac3540dde29feb71ecdf59cacc27c89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779593, "uuid": "437e56cc-f945-44de-a940-3714f1ab5453", "comment": "Malware payload (AgentTesla)", "value": "e5134d502b62ac76c8ba7c2bb7e729b348e6573d0829ce22777874d30cfc9fb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779593, "uuid": "79141ac3-0410-45e1-ae58-9c1f26b8273f", "comment": "Malware payload (AgentTesla)", "value": "13aee316cabf0dbde22aaa14e0a1cbf73225abcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779593, "uuid": "41065711-ebb8-48ad-9e9e-eb61a22aec3c", "comment": "Malware payload (AgentTesla)", "value": "baf98c50bbcd627acfc24478afd2cab50e603c654602e76cd284a02c4b326bd59b643268e3af28f5533f2830fe852274", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779593, "uuid": "969d0a1a-3189-4375-bf34-d46eb5bc3615", "value": "T138F49D9133B5DF16D87D83FF46F0908D0BB879067026E21A5F9735D27270BA62A48B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779593, "uuid": "ec9bebee-2c4e-4919-8538-3c169e381dfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779593, "uuid": "cb7b3fe6-893b-4271-a3c8-ab185654d6b5", "value": "12288:YDX91NxfD6mq0GESdEIhMyLV46cA+8Yon6Df8x5ZIyvi6oeZY:YR1NxfLG5EYxxVM8IDfYBql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779593, "uuid": "07c5e46a-5654-431b-aaaa-ff469393b05e", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779593, "uuid": "0a5d4e17-e398-4d7d-9f32-988c00a638ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779593, "uuid": "843f58a4-48e8-4540-89d4-462cd7baaac0", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523cb658-f893-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684754714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754714, "uuid": "6703dfa6-63cd-4532-b3b4-2434f7d21355", "comment": "Malware payload (Loki)", "value": "461435a0209320befa140d18ed5db575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754714, "uuid": "d7bfaa16-65a2-4d83-ac50-af3a5a0cbf73", "comment": "Malware payload (Loki)", "value": "e523dd1e51303c2be9fe5cccef1960524a5b6de9bb2aeab9e4e4cfc94c86db32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754714, "uuid": "41624588-37f5-459a-a2a4-3eeffc18fc71", "comment": "Malware payload (Loki)", "value": "d858aa46e07657eb836cb554d86710a5ca6d4cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754714, "uuid": "593d4ffd-3363-4a39-bd2d-a30d00f27742", "comment": "Malware payload (Loki)", "value": "1be4df2ff8fda79422999e78a288c1a7bd18024e0b29d89359913a9d4d3acd095d229967724ad0fc2daefaf2571d1cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754714, "uuid": "d334fb04-8f73-4b9e-9fe8-dd3c0e68b87e", "value": "T1F6D47A5633B57621F47D73FE01146388CB38B04A2052E22A1F9A7AD556E37EB770A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754714, "uuid": "07f18e2e-77ee-4416-a922-11af2a42a7cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754714, "uuid": "4a783422-e031-41d0-8fd0-8e4c5e5a122b", "value": "12288:PvV+s1bSQT6tjjdB40qlhueo7lCDRLKRQksHjVRJEaLx6sohHZBgqWwzAi:PtpDuewlCDlwzIjJEkxHc5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684754714, "uuid": "a2461323-f107-495b-8746-633c5cea699a", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684754714, "uuid": "7839bfac-1c11-4df2-8702-205c8c224b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754714, "uuid": "d0885ab7-d3f1-4c46-a65e-b4b0aa8e4c6d", "value": "PROFORMA INV 110853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bae6655-f8f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684795505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795505, "uuid": "77e8e769-b344-47f1-b81e-460ecb37149d", "comment": "Malware payload", "value": "cf3ca5f1fa359ce0647c1a561991d9e3", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795505, "uuid": "6272aed3-6954-4283-9fb0-537088eb44f8", "comment": "Malware payload", "value": "e5361beadbc83b6b1ec9a2ca69626ba99bf2eabe863d4934d7b8a80ad718ec3e", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795505, "uuid": "07c23141-b228-49ac-8fc4-0badde83ea6c", "comment": "Malware payload", "value": "609b0229c7300c378c45fa14af244dc126f00c07", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684795505, "uuid": "ee1119b4-e2ad-47d4-bf06-bf58d3353080", "comment": "Malware payload", "value": "86ec0c94bad42f9922d97f3f1bb14c1bc8b62d7b6eb7bd4033ca4ed72ce442ba327b9479a40c7fac7365c39fe0641feb", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795505, "uuid": "56ec3d5b-6d48-436f-ba94-530498593d61", "value": "T1602633C4B7EB0ADE54C5A71E0E6288B9A48BD21E158CE2170F7592E62F47333CE1D65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795505, "uuid": "c70824a0-d6c8-4287-90ee-a625b179f712", "value": "98304:LskECK6BLV3kTcEiJZd5yiXRXVSmSGKU5pxNbsbfU7L29bU8IsYyZWX/:L1M69uoJZ1XRlQ9KpxNbsbfUSvcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684795505, "uuid": "0c9226c8-e7ee-4ed9-bf4d-f4cb9b706d4b", "value": 4590925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684795505, "uuid": "9d2df7bf-bc2f-4b77-9b31-b693a7fdb424", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684795505, "uuid": "156124d3-4f01-4dee-aecd-ef9bc69b5208", "value": "Praxair-Prostar-Platinum-Regulator-Operating-Manual.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80eed693-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752215, "uuid": "386d674d-a3a1-47d7-81d8-26bfbdb6ea18", "comment": "Malware payload (RedLineStealer)", "value": "7161b8c2dc604d8d916889000d1c4965", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752215, "uuid": "dd1de35d-8a7c-476c-bd1c-3623448d9f95", "comment": "Malware payload (RedLineStealer)", "value": "e55399731bc9aca5fb039fd80c4b83755634409c86638f358d7fec1a2cc8a03a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752215, "uuid": "55edae42-4726-443f-9519-5bd1728c2b64", "comment": "Malware payload (RedLineStealer)", "value": "a4f0d1f619eadfd690b9ace1adf2cbc2449bdd7a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752215, "uuid": "6e106214-0624-4604-9cca-4fd94c3e21a1", "comment": "Malware payload (RedLineStealer)", "value": "8ea1c928d0063843a0d5f87e2f3650e6d0d9757b5c5979f7e432c5f1412c947b65950717284f7b688c99d10e4302b987", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752215, "uuid": "f95d5f06-b9bb-4588-b3ac-6ae3ec615deb", "value": "T1E2252313B7C880A6DE75377048FA02571A72BDB19D34C36B3B85EA4B5D32AE0243A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752215, "uuid": "cd0bd685-d7bb-495c-aeb7-9da9dfa0575b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752215, "uuid": "f848baa9-48e9-4ae0-8386-4d0cdb534a08", "value": "24576:uygHQeZgQLf4Yqq8RgmP/fnLcP1tVVtOrijj:9gHNlLfpqV7P/c1tDws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752215, "uuid": "3567229a-f5e0-45fa-8216-09361afcce41", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752215, "uuid": "e41e5d78-07ea-4d03-916f-548291c21d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752215, "uuid": "6192a86a-b162-4c28-9804-ec9cf09fbf3d", "value": "24468931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfd7e9b-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737500, "uuid": "bc353c9c-eb60-4c65-9a26-870ad52e32d1", "comment": "Malware payload (RedLineStealer)", "value": "b02386b29c0a810bf806fd67ea944a0b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737500, "uuid": "f36dc7fc-43ab-45d8-b08c-c485d811079a", "comment": "Malware payload (RedLineStealer)", "value": "e5867e714f31cfb3e1acea39c3592abdd396e2139cd180f6204e5979fb16f40e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737500, "uuid": "f9b63cdd-9b11-4242-8fc8-2a7cabbac4a6", "comment": "Malware payload (RedLineStealer)", "value": "c3795a9c704a5b920d2bee34d85b94971c690c85", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737500, "uuid": "1ae78c4f-6712-4312-9a39-f02231e1ce42", "comment": "Malware payload (RedLineStealer)", "value": "b22dea538b715dbeca59fb1c669ec5597f3cdf1d73da66e94d8114369c4e4487b2f2aa27487adff66f61c6c1f0c02a2e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737500, "uuid": "f1430f6f-1609-4d2b-9b8e-b2605a5844f8", "value": "T19D252312B7E89022E8B62B3018F703E726357D7199B4835E334ADB4A19736C5F5317AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737500, "uuid": "3770907f-a2d3-49b4-94d3-d0b72019ab9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737500, "uuid": "94e07a9c-b8ec-4348-94fb-04a44010641b", "value": "24576:Dyaf4LNELsbwHNfd+flANltVUt4yWQEtVQcfImQhU:WNLCLsEHNfd9NltVeoQErQ+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737500, "uuid": "e76d4ded-09d8-4cba-940f-3b3e8743b463", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737500, "uuid": "46152aeb-afd4-4c9d-800a-0021185a506b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737500, "uuid": "ea080ff8-104b-425e-9a91-35d1b79f39ce", "value": "monitor343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9605dbd3-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684751821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751821, "uuid": "9caf681e-c96f-4a64-88a9-7dc5c711df7d", "comment": "Malware payload (RedLineStealer)", "value": "c71c27eb3046928402fe2bf4b62ebcae", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751821, "uuid": "393d0491-3e5e-41a7-bb59-d862815bfe6c", "comment": "Malware payload (RedLineStealer)", "value": "e5e3e1d8ad8b6a6b8ec83fd40639031f0b5c7b0b8622606bd5626141967860bd", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751821, "uuid": "c9a3514f-293a-44f6-89fe-11c55971be13", "comment": "Malware payload (RedLineStealer)", "value": "8bd07d3296d1684da4c1b8cacc0d9437926f90e2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751821, "uuid": "bcdd8233-a6eb-4ed3-9fab-b35260bc4500", "comment": "Malware payload (RedLineStealer)", "value": "b9361329bb897193dc26c67547a45c53a849d52550670d4639dcafadc1e44e5a131d9eae7922bc87f5293fd14b6b7e80", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751821, "uuid": "f61f5199-2060-4647-87bb-95ee3f7c22cf", "value": "T10F252312EBE8C4B2E5F907309CF712C30A39BD939D68919B2345596A2C73BC4A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751821, "uuid": "1bfe3962-3bc6-439b-b595-be478a0d81f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751821, "uuid": "0bfd26c9-3186-4bcc-a2e7-69651e828793", "value": "24576:kyMWhmsRoN4Avg/lYKiEWJBqo/x6OaC2qbuhLrlmeBHf7FK:zMWhnMM/+Kp0RluhfAer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751821, "uuid": "c7ab7ee7-b63a-4f0e-9e0d-e897b15905b1", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751821, "uuid": "42046c64-c3d1-4330-8730-81539feed454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751821, "uuid": "804e8af1-15fd-4645-8623-6c9725d7eff0", "value": "62263263967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00cea2c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752294, "uuid": "5385a541-3e4e-4331-9686-d22ec7393128", "comment": "Malware payload (RedLineStealer)", "value": "ec17d6ab47c9f62304b5a3344295323f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752294, "uuid": "057f930f-3289-4fed-a5ad-4e17b2a8ea25", "comment": "Malware payload (RedLineStealer)", "value": "e620a7fe222cfae8267806ee2380227dc3709d3bfb8adec2e09dde30af7dabe1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752294, "uuid": "93f7f580-d022-4bad-9b7f-50ad7f8daf7c", "comment": "Malware payload (RedLineStealer)", "value": "cad1cca91444ce77a7ca6500ba0d3fd7eb5d706d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752294, "uuid": "9f920db7-1e2f-4f61-af7c-6d5fdd3ec65b", "comment": "Malware payload (RedLineStealer)", "value": "e2c4e9206ccac5bbdab9f667be0e7d84ec74016b5638f915be7f171dff82f1c8fda12a96e1fb8a0bada33a233ab8c429", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752294, "uuid": "2e20705c-e1a5-4729-9138-f68399f35762", "value": "T1A5252326ABD95072CA752BB068F60B931A34FCF54979835F3782EC6A1D721C0587272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752294, "uuid": "8727ab5a-2b53-4fd0-bf13-a9033eabed16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752294, "uuid": "3ac565bd-6ee7-4ed3-bd54-f76e60f5fab1", "value": "24576:SyTxIznaNb7hMuC5rP4qQSAy3Swb1lzIgTXUg7OGVCkBdDMN:5TWzaNb7h1C1P4qGng3PTYGQGdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752294, "uuid": "ba184e1b-0758-4f66-abdb-96b919c0b175", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752294, "uuid": "88ab413f-8338-4b5f-96bf-654de70f6b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752294, "uuid": "846ceaea-04a9-4799-bceb-84d4c3a0b109", "value": "CloudCheatsSetup611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68aecc4-f8a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684762640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762640, "uuid": "ef26f7d5-229f-4d66-903f-b348efce41df", "comment": "Malware payload (RedLineStealer)", "value": "67894f3f4fac62ed9a5edb1c8ea34657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762640, "uuid": "30f69d34-97fc-4b2f-97f4-06aca2aa4268", "comment": "Malware payload (RedLineStealer)", "value": "e69fda0d6717ada069c2b046aecb4df755b0ace581da4ce3f34d78246567dfc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762640, "uuid": "46d0667c-9d0f-4974-9276-d25d996776d6", "comment": "Malware payload (RedLineStealer)", "value": "b71b67faae1f409000cc8246ff77658ab964de47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684762640, "uuid": "b9ca84b2-4cb8-49a1-8d21-4ba3475a9ee8", "comment": "Malware payload (RedLineStealer)", "value": "972dba3a6b56ec65463cd40a3528c0c0a8d6f10bfa2c592def1233ce18969c07d738ddf616e59524951e47434bfae104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762640, "uuid": "83b00fef-fc33-4038-861f-f549fd80c592", "value": "T1AB25234263E8D4A7DA7517B0DCF706E30A34BCE14EA491AB3341D58E18B3AE5D834B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762640, "uuid": "7af0e3e1-e934-458b-a2b7-cd3c5bc268c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762640, "uuid": "3a96cf33-271b-41f5-94b6-1a32ec967656", "value": "24576:8ygkETr33nv9XTr21g+XZb/OBqX6wcC0:rgjTL1rG5Dmqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684762640, "uuid": "db59fb03-2c3b-4ffd-85e2-f64cf72a5137", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684762640, "uuid": "df2fc9b9-7550-4afd-a6e0-1b7f096ccc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684762640, "uuid": "56e67630-ac2e-4da7-ba73-363105ed33cd", "value": "67894f3f4fac62ed9a5edb1c8ea34657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a725ddd-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752446, "uuid": "0b7ca4da-c071-40a5-894b-75c51d17faf7", "comment": "Malware payload (RedLineStealer)", "value": "6b7074e4876f6a2fb240ca3f30348067", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752446, "uuid": "c146c3a3-93c4-4e08-822f-6794c1a0eb82", "comment": "Malware payload (RedLineStealer)", "value": "e740f8d6e2db57fdc5a228cd016eb405b0d40b04127e6fbed10e6e2409d2e2e5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752446, "uuid": "a2e90354-4f83-4e94-9d28-8a25b20f1fb1", "comment": "Malware payload (RedLineStealer)", "value": "20c0f8bfdd842aad025b28998315b26ec04e2c4b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752446, "uuid": "9320c9ca-a06d-4da7-94f2-c72721717e78", "comment": "Malware payload (RedLineStealer)", "value": "6ddfb463b6db19d3a0a90c095c52862ff00a4a672802d3d5b95256f12f3dadd773c4ea0ceda8e9bf88b4a3267a39ca39", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752446, "uuid": "b03d4cc3-f84f-4054-98c8-2794285e1f59", "value": "T10925230ABBCC5172D9A277B55CFA01930A78BDA08D64936F3B0986160CB3ED455F333A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752446, "uuid": "1ccfd889-7bde-4c1b-9180-186ed834f8f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752446, "uuid": "9648bf06-d2a6-4086-8d66-0354db04530f", "value": "24576:5ysnlmvdYbtIDuRlJXqXM/qDhaLJGdA0BT/5rrZLTSFwX5JRtniU7s:sMlTbCo7XqXCq9aLJOvBT/5/ZL+F45XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752446, "uuid": "03efd6e6-315b-42cb-bac9-9544a2601f3e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752446, "uuid": "909bd860-46a7-4881-a106-67cd69f7c5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752446, "uuid": "bb2c7e42-8ce2-459f-9f7b-012f5e11f685", "value": "graphics960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bea81d-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684763655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763655, "uuid": "a3e1f4e7-e3ba-4a8d-b0ce-45e8a78455d6", "comment": "Malware payload (Mirai)", "value": "52886b2d9645c2512bcf69f1cd243112", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763655, "uuid": "94448b8a-9264-4fd1-8f80-c72b06693919", "comment": "Malware payload (Mirai)", "value": "e7810ff30c20f436e48d66658b909401cf77c6bf0bc15a5ef70245d57a65df0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763655, "uuid": "1bb9e5cd-6ae8-4a29-951f-86c8833ca3f9", "comment": "Malware payload (Mirai)", "value": "a988ba117c3f555a1925a85fab359b2d093d3106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763655, "uuid": "06976de9-cb14-42da-97a7-cc6af355552d", "comment": "Malware payload (Mirai)", "value": "3c0e1b096d4665303d9db7b24f2fd3a251d24e30596014b860390748ce7e4078a476266096a50ef2f67109ad6e654b72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763655, "uuid": "94c87dbd-c940-4b42-a465-37f0135b08d5", "value": "T104B2E0F6D181032BC606E37FB7BFCF2908885CE1A199536BF7979CE109AA0516FB5440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763655, "uuid": "94a8ba4e-3e32-4a9b-88ac-ebdf6f163116", "value": "384:MD1jYoT+oRsUM2abX25Q6vgE/LIcvJsyvUrr8TBnqQX/V2fFTmCLR46HSiqNUaVf:ejN6y2FEj1xvHBnqsYFSCLR4INqNhCJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763655, "uuid": "42cf9fe4-0c69-476f-a025-567b9f5f96aa", "value": 24400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763655, "uuid": "9a129b34-b507-435e-ad4d-bddafcc1d313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763655, "uuid": "77405a57-09bf-440e-8ca4-264bcdaa7aba", "value": "52886b2d9645c2512bcf69f1cd243112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6253ee0b-f8c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684774498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774498, "uuid": "a1f803ff-15b6-4273-a3c6-326b2d498ae6", "comment": "Malware payload (AgentTesla)", "value": "2c3c0bd218b8ea139e490e68b529b1ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774498, "uuid": "053b1be6-3637-4aeb-99d7-863f44116c55", "comment": "Malware payload (AgentTesla)", "value": "e78333be3402a8425c18a63f6938fa2f861c877e362d6c679079c17d6ee18dd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774498, "uuid": "40520de6-b1c6-4522-948d-07cb7e11187a", "comment": "Malware payload (AgentTesla)", "value": "f76281b7315fc17621ebcdbedb61816d39595ec5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684774498, "uuid": "d4af2cf8-f664-4905-af72-b0f2b45b095b", "comment": "Malware payload (AgentTesla)", "value": "8fd6cb746b7e288864fd3d462ba725eab9372e7ce9bbee1146c52452e5f2398d115bae9c176309f7c58dd2e479e1ea9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774498, "uuid": "9f7c8fe5-4608-4ae8-be05-3025facf0cf2", "value": "T188F49E9533B5DF26D47D83FF06F0908D0BB8B5067022E21A5F9775D27270BA62A48B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774498, "uuid": "f717ea45-96c6-4770-9233-623b85eea64e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774498, "uuid": "5e9011a9-fae4-47e2-85bd-b69bc36063be", "value": "12288:0DX91uYfT3t5Zb/FzFPkG4HLiy5df8A9ipC4PMe9P6MHGlc5YwpcJTX7:0R1uYfJ559d4Hdj8miETetHGO5YYcJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684774498, "uuid": "7a5c702a-aa8f-4d2e-9d9e-acbf88bc5ccc", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684774498, "uuid": "a7168741-a879-4228-abb4-5af2df435a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684774498, "uuid": "61391f77-6cd5-43bf-bc45-b7fb9d98d8d5", "value": "PO-23000326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b6b561-f87e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684745962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745962, "uuid": "f2624540-2884-47a2-964a-dc5ca10654aa", "comment": "Malware payload (RedLineStealer)", "value": "794b4b0f83f073959e305ef7c2dbc904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745962, "uuid": "f05db7af-377b-484d-a023-753779350641", "comment": "Malware payload (RedLineStealer)", "value": "e8164952e21dfd67b6833cfa83a321069a4d89b5593d54f639deefeee08f14ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745962, "uuid": "cf8bfabd-e216-485c-b538-7967a828bcd9", "comment": "Malware payload (RedLineStealer)", "value": "574ef1c0bd59e1d647a04049770adaaaf48d3680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745962, "uuid": "52e18a81-ca75-4e23-b4ad-68f259a71517", "comment": "Malware payload (RedLineStealer)", "value": "6cdb6856194cdcd2966dda9b6b858ce052c513dd952947c8cdd460f508342035257a42b1451fb23a83361ba6185381b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745962, "uuid": "b92fc677-25aa-4ec1-9836-7a0253d9734d", "value": "T1E52522139AD94036D9F123709CF616CB6A76BCA04DB0E31B6BC5892D4E73740A177B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745962, "uuid": "6c4ccd64-9c8e-4d4f-aa94-bc66cf75af74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745962, "uuid": "fd0900b6-51ca-4969-b94a-a6d9bfe18761", "value": "24576:3ypV8I61AeWXqeRtb/ph0VqI0khdflUnZs00Vx2C/F:Cu1AeWXqQtb/phCqIDh9lUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745962, "uuid": "b305fb70-e2b5-4215-8f51-ab43948492ca", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745962, "uuid": "1b524855-c8eb-4dc2-88d2-fe0a0d2e05f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745962, "uuid": "bf2144e9-3651-47d5-a253-f1d1db24cefe", "value": "794b4b0f83f073959e305ef7c2dbc904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dfaf1e-f865-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684735156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735156, "uuid": "764e73a0-badb-47bd-90ea-65e979d6f0cd", "comment": "Malware payload (Mirai)", "value": "2bb28a2683a552fbcb7c8871a9821470", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735156, "uuid": "edd6a900-dbf5-4694-9954-b6d5e0c8955a", "comment": "Malware payload (Mirai)", "value": "e840315f365377541d062a6c0e353bc6f6c3e7c32c53cc4b325127fb8680de9c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735156, "uuid": "d6c62aff-3d7d-4065-90ae-e6ea88687790", "comment": "Malware payload (Mirai)", "value": "d7a1bde5653bedda2ed1c05637ef89918d25e8a0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684735156, "uuid": "8e2b7283-7482-4294-9ae9-abc66113763f", "comment": "Malware payload (Mirai)", "value": "ae91ffc13ee2f53502702cd259b46556113d2b30f95dee0e40dacfa7bcdb4490a33e6fd3c01679311f939a92d633c84f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735156, "uuid": "33771e6b-1caf-423d-b799-e2ae3f1d9d79", "value": "T139534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735156, "uuid": "58fd40e1-fce8-4060-aa89-59883579b74b", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQvLiKimfFoktCe3fYRMB:WShU3q7cEDlCK/0DX9i8Fok06fYRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684735156, "uuid": "08687f0a-6f1c-4239-9624-727190c9802d", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684735156, "uuid": "232e8aba-b075-430c-8d04-e8e44653e546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684735156, "uuid": "39bd4913-1c7f-4eff-9b63-7dcddb0d3e12", "value": "2bb28a2683a552fbcb7c8871a9821470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5810c50-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752411, "uuid": "7e2c0c1d-20ac-43a6-b586-7bbbc17be944", "comment": "Malware payload (RedLineStealer)", "value": "726e6c79084929ceb1528de5b4fa2d15", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752411, "uuid": "f79eae2b-78c0-4b83-9656-f10c0ee82313", "comment": "Malware payload (RedLineStealer)", "value": "e898a11e0052d19c22932e556600527e0d7aeb628453c0114d0a12625813d81d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752411, "uuid": "46294114-1633-461c-b669-2711442aec7f", "comment": "Malware payload (RedLineStealer)", "value": "d5387fd57f7e288a597d7a84163313a5bd963862", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752411, "uuid": "cedbdb20-b66d-4509-a770-32291726d93d", "comment": "Malware payload (RedLineStealer)", "value": "f265200097d5226842a2e0028ba50f689e5436890d1902f1fd656dd20a2276990f39fb8357d56b31dd1f21f4928fcd68", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752411, "uuid": "39057961-b78a-4025-9450-654543d553f4", "value": "T10A25220362C89036ECB537B554FB829B1734BEF298B8532A37A4691F59714C0E8393B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752411, "uuid": "cd62710c-f8cf-4b4b-9dad-c388aece3ad5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752411, "uuid": "2729db13-f09f-4697-81da-020929315dcb", "value": "12288:tMrDy902rMc2TEkec9MuLBGRqGfaBJ82ZA0czqn2nI809g4vVhGTT0li9Cxy5nf/:2yG2JDqxXZAtg2ny97CXLcyTDcIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752411, "uuid": "b440c18e-4e73-4b04-a025-9a8795b3e612", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752411, "uuid": "03271d6f-ef5a-4517-bf7d-4ed61e6346f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752411, "uuid": "d8f89dd7-2458-4c09-8af7-ab76292c4233", "value": "encrypt617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96cd2c6-f8f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684794937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684794937, "uuid": "896894c4-02cc-4111-8876-96f9dfedbc2f", "comment": "Malware payload", "value": "027dc4d4e59c57fbfb583a8e69c4d768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684794937, "uuid": "99b02663-f002-4093-93bd-66ea708dc309", "comment": "Malware payload", "value": "e9b7c7b03d379e1399e3611040fc5c5a0af3085d438689fd468acda5fdd6bf54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684794937, "uuid": "425f9fc2-7823-44c4-a5fc-4a2fc9d38248", "comment": "Malware payload", "value": "4d01901537113bf7dca3d4062576ebc1e14ee7a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684794937, "uuid": "3ae8a6b9-3eb1-4e29-8fe2-caa12be4b871", "comment": "Malware payload", "value": "7dbc091d914625e994de49c59a5280da86c09defcae7c971114aa1a72befe510b9152007c1c5058886f0222ab11a3ca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684794937, "uuid": "12e689cd-af4a-4120-b6f4-49af81752b88", "value": "T1B154E12236868076E22711308EB1C6A25B7BBC724B7199C73BD5577E0F317C2EA7435A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684794937, "uuid": "53cda02f-1a91-4337-a14f-4ceb9aeedb37", "value": "1c8b7141d44e96dcc8c22d3bfdac433c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684794937, "uuid": "d42e661a-075b-4b3c-b609-97eed6b39aeb", "value": "6144:+56ZH95/1MeZ++hS/rE4X8xYI++IeO03PbxU:+od5/1ZZDATtXPAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684794937, "uuid": "73627792-fc8b-4dcf-86d1-9f4ce68433cb", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684794937, "uuid": "6fcc3ded-4dde-4c3e-92a3-19c65e0137ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684794937, "uuid": "f9c3e671-8064-4202-82a7-65957fccfba5", "value": "027dc4d4e59c57fbfb583a8e69c4d768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bd4912-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752337, "uuid": "e82d576a-cc88-43a5-879f-1540fa86d117", "comment": "Malware payload (RedLineStealer)", "value": "c00d22720440e111c13ee3a0ae993fd2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752337, "uuid": "c820798f-0fb8-4313-9904-080553fb5d8b", "comment": "Malware payload (RedLineStealer)", "value": "e9f33822b834102ff741cd7af04980265873d0a8624979bfa2ec6718fb6f3bf8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752337, "uuid": "c8e48655-2adc-4097-b53c-c17aeabc1987", "comment": "Malware payload (RedLineStealer)", "value": "1a1e94f6a9cab190372dc0fa2229e83565c2b7f3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752337, "uuid": "8b1fdf27-555f-4a88-8d2f-5c9e3dc05e43", "comment": "Malware payload (RedLineStealer)", "value": "a911942bef01e3452dbdadf70b1b5f6721873cb7bc7dcd255daca8b4e3685634cd15378de21b1569261fadf0bcb64c31", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752337, "uuid": "2ec540a1-7ca3-4586-979f-2378148021fd", "value": "T1DE25231362C8A4B5DCAD7771ACF702431F3EBCB58D39832B27898E511872694E87375A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752337, "uuid": "4d8ec4d0-91e6-4f25-8ef9-aabd769a444d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752337, "uuid": "36ba6b31-6abf-4a19-93b0-087bff76be65", "value": "24576:wy3i+JLYZv00OzL2q7WX83hcSyt+wHyzCDHu+uNSR0T2WdAR+Eh4:33izZvjAL2qLqSAZ7u3NSReAcEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752337, "uuid": "b2f8e7fc-7c76-4e14-821f-8ab1efdf2c1e", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752337, "uuid": "da8fd26a-ccf6-4e05-9e12-71b71e69abe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752337, "uuid": "439e24b9-ae55-4e6e-a100-240fdddc67ca", "value": "backup540.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0d74f3-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752314, "uuid": "3387cf57-93a8-4d93-a3eb-7ee09da18b34", "comment": "Malware payload (RedLineStealer)", "value": "46ba80ac4b5f50f53407b2df9b794d8c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752314, "uuid": "f24555cd-44d0-41d7-8243-1da6c82ac5bf", "comment": "Malware payload (RedLineStealer)", "value": "ea4577b234e1938f566fd52574455e3fe0412c4dbcd1cf04058f50c3cf0b88fe", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752314, "uuid": "a9727ee1-7932-42c9-8b38-196d1ac84db8", "comment": "Malware payload (RedLineStealer)", "value": "ba63e0a2e94a84f1342fcd9d58aa7613de8aa1ec", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752314, "uuid": "544887fc-874b-4c08-ae8c-9e898efe75ee", "comment": "Malware payload (RedLineStealer)", "value": "0fc912ba832bffca9510f332cc9b902c351cfe7653d152b8e171c3c662680e1efc8351aa855b96fd95d49eb157d610c3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752314, "uuid": "934cd692-7ac8-44f7-ac4c-da4cbd5cdf03", "value": "T139252312B7D58033EEB9273114F713D30B3A7D9189A9D26B37069E4D1DB3994A8723A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752314, "uuid": "6eb5c217-122f-482b-bdba-56f90772b530", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752314, "uuid": "f49fd898-0c3e-4f6d-ae2d-ed24c29bef40", "value": "12288:aMrJy90jySSD0NgrRD57kA4aAuvpjY8UqbGBWIKzsEQT1vX9+6k4rOekn1zSm84Y:zyeLgrRDdhAUNGXwIKIEsf5r8/D16Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752314, "uuid": "72dcfb8e-8f28-4c0c-8637-5e5c8c1e1f24", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752314, "uuid": "689bcb1f-252b-484c-b471-9f5141f5d920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752314, "uuid": "da72e2c3-39d1-4705-a2c4-7ec3fdffa649", "value": "Unlock270.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd23906-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752262, "uuid": "44f93974-d9d4-4464-b15b-9678be011097", "comment": "Malware payload (RedLineStealer)", "value": "f00ef01c93695715da87670b3475cb0a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752262, "uuid": "c82d9f8d-0f9b-4cb8-8d82-dbebb312c215", "comment": "Malware payload (RedLineStealer)", "value": "ea7edd7594ef16ea11487639cfc93a82bc63e976829c553385a5c2d7ea224ca1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752262, "uuid": "ab49a92d-b7a7-4ab9-b538-7e64d9257e0d", "comment": "Malware payload (RedLineStealer)", "value": "a17117a536d3023de2fa5d6139267ab56bd5580f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752262, "uuid": "b0b70790-e5fb-4b74-9ccd-74c78cf70770", "comment": "Malware payload (RedLineStealer)", "value": "9c0c499cc07652a8f425b177ce58b77ab47547b460a9af3b0850f62231074a8a2c7436988b1d58e17e544c7735c64459", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752262, "uuid": "d1af5844-e61b-4766-a4b1-33c7abdf3b2a", "value": "T1DFE3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752262, "uuid": "bafd800f-6fa1-46a8-b233-f0400cb4c440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752262, "uuid": "27856fc7-e987-40f6-b303-24be85ffe838", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752262, "uuid": "28e808cd-df70-4371-9b12-68272e04dd46", "value": 148662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752262, "uuid": "3b4081dc-91ca-44e8-a78a-6aee38bcdd48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752262, "uuid": "4d3fcdd7-1452-4fc2-ac84-71001d573091", "value": "4724828.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1870577e-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752469, "uuid": "044b79d0-0bc7-4e44-8c8b-8f88e32cbf33", "comment": "Malware payload (RedLineStealer)", "value": "966a96bbf4a721512a8b5ea7e7157cb2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752469, "uuid": "7e077759-bd5d-49fb-a997-8b186b516c00", "comment": "Malware payload (RedLineStealer)", "value": "ec61a2a077049a25fa21a8b42c9cf16442a332b06c33caa84a47029e7b10b709", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752469, "uuid": "07dc92e5-c19e-4116-8ea1-1752e6bde937", "comment": "Malware payload (RedLineStealer)", "value": "a3ae7e5c10a94d62e4697abeb45beb820eda38aa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752469, "uuid": "d45ac10d-0fdc-4562-bb69-7bc500995027", "comment": "Malware payload (RedLineStealer)", "value": "678ea8ab72b51db69c4c17688ab44f64ab067f97a94160ed40bfebf26fa7b59afeeeb26ba72d117b6b488557394829d3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752469, "uuid": "cc29c6ee-4822-4c99-a4c6-6bcf23278594", "value": "T1A725230376C98171ECB9673058F102D70736BCA15A79834F23EAA89A5C73AC5687277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752469, "uuid": "6dcefdfa-5f4a-4d27-af62-a1983e5d54a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752469, "uuid": "8be3095b-b028-46cb-ad23-41e41778b2d8", "value": "24576:Dy30y/j1m2qydNp/q675o2bQptexkOBp1JRR:W30yLZqqTJO2bqtexkCp1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752469, "uuid": "0530ced4-7306-4f8e-82a5-1324b32091ff", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752469, "uuid": "2cc8f828-1ff1-4643-9b37-1a2fd1b3f46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752469, "uuid": "32a62689-183b-4370-b6e9-219411b02a86", "value": "islauncher855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fc7489-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737644, "uuid": "b213562a-269d-4044-a1bf-b2134ac43e12", "comment": "Malware payload (RedLineStealer)", "value": "1fa40c47c535612e09f4befcad486aca", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737644, "uuid": "a12bf8f9-83b3-45d4-b22f-22be47c8dde2", "comment": "Malware payload (RedLineStealer)", "value": "ecd14d9a546313c6d22973e3efdaabbf7ff7398024d5639e9432df77f643f4f4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737644, "uuid": "757f0481-c7e6-4403-9f43-09cb6361e405", "comment": "Malware payload (RedLineStealer)", "value": "794d0d7017e2caa47d4d6fd13bfee72b45d4b56a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737644, "uuid": "0332ffab-67f1-410f-9734-aaccecb88060", "comment": "Malware payload (RedLineStealer)", "value": "173ef2e6cdb9c0bebd508ee934013bab7c8ec1da0867862c28cbce148ae1989415bc6787334b01d7d7d55d16549cdb33", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737644, "uuid": "00724ae1-8d27-4393-98b0-2cc6def582f8", "value": "T1F8252313A7E44231DCE0273058F312831E32FD525E758B6B1E99E9479EB3998A872377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737644, "uuid": "9bbc8461-f7a4-4770-b656-3602b6ffc2b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737644, "uuid": "a60e31d2-6638-475b-ac08-a5e30d0bd0df", "value": "24576:jyx32HaUDrIgiy904qlHmIY6GavE2VREkIYlani708ct/S:2xwIFyG4qtmzBas2lIYV70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737644, "uuid": "c1884ac4-b183-45bb-ae69-7657c19c335b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737644, "uuid": "a738bfb7-998f-4040-85af-c5c47834c252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737644, "uuid": "e21e417c-4de0-4c5b-8bd8-2187043c8df9", "value": "router506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89568788-f87d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684745357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745357, "uuid": "8498a215-85df-43af-8bb9-327111e0bace", "comment": "Malware payload (AgentTesla)", "value": "0e6c81f971bca13e4de6ca132773b452", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745357, "uuid": "d8e352ea-18cb-43dc-87d6-1393a896efb6", "comment": "Malware payload (AgentTesla)", "value": "ed2545b248f94a1f550bfa2b0806d90d37dc74db24569f3fe2440d5cb8710d02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745357, "uuid": "96925fcf-b700-43c6-bb0e-a996dc8aaafe", "comment": "Malware payload (AgentTesla)", "value": "be7f2955fc95f321e5e1b9a4d978a7b6fc91cc96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684745357, "uuid": "e982f4eb-9c8f-4336-99ce-f7fec00b87fd", "comment": "Malware payload (AgentTesla)", "value": "b32854d576d34376370adba6427d3df51ad65e0d6eb783454eab468527bab9b1bd932e077b957392845bb5e7b5bf131a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745357, "uuid": "5e3e1a14-dff9-488a-a754-d61fd246fadc", "value": "T144E423AEBA53C43DF31CA732A032A64426C86215D737987C3B73C72985BD76B47849C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745357, "uuid": "1db28748-53e4-45fa-9ce8-056f6085e109", "value": "12288:ZBAIJ6+9lycR+SdH+ifelUZW6IJeZ6H+ifelUZW6IJeZ1:Zj9lycvehoIJeZ6ehoIJeZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684745357, "uuid": "3afb2272-1c55-4fa4-8eb5-d19887120483", "value": 684408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684745357, "uuid": "6edafca1-e89e-4669-85de-d043567d3ca4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684745357, "uuid": "3d34bb7b-1db0-4451-b7ae-11e7b7877980", "value": "RGH098765567000.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbce2bc9-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777225, "uuid": "5025d5f9-8511-4bbd-993b-3f4bd008170d", "comment": "Malware payload", "value": "20832b351d5cae6e0ac38808536cd31a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777225, "uuid": "1ba2cff4-81a7-4c75-b699-72535e331ac9", "comment": "Malware payload", "value": "ed76e8e90d30a455486f100612059f8921d1eebf3663685cd70d8dd66941b889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777225, "uuid": "d91a7318-66a8-46a6-9199-e605975e2b68", "comment": "Malware payload", "value": "16d67cb511f002a1b372192d1d196ed4e8c96960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777225, "uuid": "08a0db7c-8169-4704-90c2-449ab6cc50bc", "comment": "Malware payload", "value": "68e68b1724cac70712ecfbf6512b34c3a0fa7309ad687b2b4d9a7c2288493ef3981bb652fcdfaf750db0e8cb0754fc03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777225, "uuid": "d3aa2b06-668f-4e90-aabc-9808b76f8e8c", "value": "T104F422D3B850E8C4D4848939D5758DF82214FDB7EE7A6E7B14C03CAABC734827A1946B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777225, "uuid": "191acb26-e4f6-4f50-94a2-58e7383544aa", "value": "0dd917efec0cec4d5f8264f7a4ddb60f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777225, "uuid": "69022c18-d994-43a0-b301-3707e951e4c2", "value": "12288:p+vpqqGBB0V1xG5nqA0t2Pyw5XA53c05M9wcpw2DC0XZCyVvJ:EBq7Wmqv2Pywqu05M9pLlvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777225, "uuid": "8a47b438-0856-4a73-8571-31ecb0a581fb", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777225, "uuid": "f9ee9cd3-4688-49b4-bd44-12541eb6fede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777225, "uuid": "62eabf64-e756-4457-9e36-f00e38669c29", "value": "SecuriteInfo.com.PAK_Generic.002.29154.23977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f5c85-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751892, "uuid": "5e8c348c-e417-49ee-ae4d-4e29b414fcb2", "comment": "Malware payload (Amadey)", "value": "4145cd57f6ac7798ce318c498eef0963", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751892, "uuid": "46d776f2-c196-45ee-ae2b-28e0ca0d06a6", "comment": "Malware payload (Amadey)", "value": "eded2595e47d6d51ccc3b7dd48fb869647d03e0edd6c05e63a58b8872a7f3d72", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751892, "uuid": "f31c6baf-b4df-4d77-90ec-94bb88c16397", "comment": "Malware payload (Amadey)", "value": "27f243974039ca87eeba21a849d8c3bb1d26f607", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751892, "uuid": "300f536f-691c-459c-81da-3bae40abc943", "comment": "Malware payload (Amadey)", "value": "e1467dcee716f16e4121c6a6f936af68b82b56d029bea3d165a75596a1173e01cf86623c3e41a7e30ce3179534efc2ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751892, "uuid": "b0ca4399-373f-49ac-88b9-8676cd7da1df", "value": "T11F252322FED18933D9F417B058F607870F3A7C620AB9D71B2389895A1CB15C2E97176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751892, "uuid": "4fecab0a-c948-41a9-ac6f-e0d3bf2057e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751892, "uuid": "0d21fd22-58ce-43b8-bac8-6bb35fd84679", "value": "24576:LyJ9kHnmoCJZdOBd/bKPkvY72pLLDLKHZaHt+zcBmAGTYDU8Wr1vHB:+XkHmoCHdOB5mupLLS5IQYgAGTYDUJtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751892, "uuid": "478c6c85-854f-40a9-b08a-6aed57ecf592", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751892, "uuid": "28a3bfec-70b6-4d8b-a4a7-cbb4d7c0ffb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751892, "uuid": "7e3c4fdc-4e71-4cba-bf77-08020ba0f4a3", "value": "controller373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75193633-f884-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684748330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748330, "uuid": "bdef773d-40ab-4c19-8209-5767da1ad5ff", "comment": "Malware payload (Formbook)", "value": "68709ebdc8c71fd1d0888b2b9a903aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748330, "uuid": "60d09a27-2d89-46b8-8db0-e6be9731c889", "comment": "Malware payload (Formbook)", "value": "ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748330, "uuid": "14747761-cbd1-41c0-bfe9-7d8889411b5e", "comment": "Malware payload (Formbook)", "value": "b0cd55fd33a1ec4d2f5996c8d8e015356b21d188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748330, "uuid": "09aa8ba5-c261-496a-bc6d-d4006cbd490e", "comment": "Malware payload (Formbook)", "value": "90566a2caa51d1bf34249f73ceafabac36b0baa93c28a6ac47b1de3463568b49d741d88867f34f42087aad0be898b2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748330, "uuid": "edcca0f5-e008-478a-8bae-d9dafddad4c3", "value": "T1DB64E02237818072F16359300DB1CA768B3BB87297711ADB6BC45A7D4E727C2DA3A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748330, "uuid": "df276f03-7e2e-4a7f-a46d-4da311573522", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748330, "uuid": "96ef2545-b766-48b2-8f5a-53766690611e", "value": "6144:K+FDIsIRnnBvu/8xzCUTwTQOgGB5W7FdDomFyuNmlgbI:KkDIsMnROeZTSQWBogAAlgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748330, "uuid": "d9762f33-c27e-4f6f-8952-88b3330091dc", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748330, "uuid": "9e188862-aaf9-4edf-bf62-f2e218586e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748330, "uuid": "b254e281-d704-425b-b5fe-df1578077651", "value": "IMG-22052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6709aa-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752370, "uuid": "9ded996f-9dba-4a9f-99e4-40cf8429561a", "comment": "Malware payload (RedLineStealer)", "value": "1d596f97e75280599c27307adb88796a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752370, "uuid": "ef433c59-7677-40c1-be2b-e19adf3aef2d", "comment": "Malware payload (RedLineStealer)", "value": "ef496af81c2001854680cd934d9661e4657d11ef6262ccb21166c2d2aaacec13", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752370, "uuid": "79a7ca69-f728-4f97-b984-64d571af147c", "comment": "Malware payload (RedLineStealer)", "value": "2a4b49acb9f33b069fb1f972d17c27d61ab63301", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752370, "uuid": "8dd3f144-1b41-4167-8688-c57895301566", "comment": "Malware payload (RedLineStealer)", "value": "b81974bd82f195802ee94769ed4e5ce5e699981b018074a172d400bbc551b8cc668e3ef055526dd730297d30352290c4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752370, "uuid": "e0f64179-34d4-4d98-82db-84c9f782e113", "value": "T199252313E7D842B2EDB5373418F305871A76BD809EB04B6F29618D470D72A986D3973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752370, "uuid": "b33021fc-b6f1-4f71-89e3-4e25a97efa16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752370, "uuid": "930849d0-b0af-4f20-88fe-d94cfb26c8bc", "value": "24576:gyIeF5wSObmHqD8VVl/Hl6p0M0l1mIznPjBNDBTrfUT:n/zWmHqgVvvQqM0l1mIznPtNDBTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752370, "uuid": "8dbd1ddc-d4e4-4a59-bb70-5edb0910c952", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752370, "uuid": "247abfd6-985d-4e6c-a8bd-e5c28a5734b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752370, "uuid": "97ac9fc8-642b-4a38-b4fd-1ba5c921d707", "value": "config301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d06a13-f86c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684738239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738239, "uuid": "c3d6a673-99e8-40ab-8aae-6a33ba7b0452", "comment": "Malware payload (AveMariaRAT)", "value": "9c2ddb99cfb340a962c8bbf4590beb85", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738239, "uuid": "78215000-8450-4f32-aef5-bc7bf964551e", "comment": "Malware payload (AveMariaRAT)", "value": "ef5b814562290c60063075b290966060a79e0cc9e81cd6448d49af5c5879175f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738239, "uuid": "81c7d8f2-2d8d-4990-ac64-8770c5b56d15", "comment": "Malware payload (AveMariaRAT)", "value": "6f753a732528de928dbc9a824c1fbadfebbcc4c3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738239, "uuid": "4d9fd953-866a-4a6a-bab7-29b7635c4219", "comment": "Malware payload (AveMariaRAT)", "value": "d469f434372f248adb3ff0913ff7be2520da514674cdf75e90750a1f7fe23a0e52ffc9f07dca1add1301defead64f17c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738239, "uuid": "4afb56b0-8196-4997-a495-8c6a37293b04", "value": "T120D4F18126588C15F6AA5FB55AA3F27443B56C51EF27C30E64E06C8BBCA6B817F007D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738239, "uuid": "14d524a8-ab08-4dda-9c1b-c5a7588e4c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738239, "uuid": "b946a54b-ab7d-4b9c-be6c-9f180e4259e7", "value": "12288:zT9x0YPX/NqPsEkekhGYahMIGSa16niqErLwIexw9cAY:zTYHPshPhSezqy1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738239, "uuid": "13b47409-955c-4034-a329-318ed2e279ab", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738239, "uuid": "b79e5e37-72a7-4399-929b-e5fa82ad5e99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738239, "uuid": "e89c16f6-cbfe-4022-bfe8-a9e599368ca9", "value": "609-22-05-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72a94fd-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777217, "uuid": "09948469-ffa8-4671-a7f5-28dd4637b462", "comment": "Malware payload", "value": "4df589e1d0d37c53c409af08932d503d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777217, "uuid": "c87bd415-80cc-4e15-9c69-2f2297b0d405", "comment": "Malware payload", "value": "ef60313fe7494cd34d7413313063dcf09c19bee1223586189524c6634b4595f3", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777217, "uuid": "7a1d9b1b-195c-42fa-86bd-13e7ab8fef85", "comment": "Malware payload", "value": "2dbfedf7081a904644395e56c848cb16228896a0", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777217, "uuid": "efef818a-2a24-462a-857a-dc0965140cb1", "comment": "Malware payload", "value": "f3ff108cad65bcead37dd9b0adf7ad348fd68475de61d2c73dd96f96c8d4da183577bc95e1f11bc2e945c53fd780f122", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777217, "uuid": "f2045592-f65c-48c6-b34c-ca3cf1b39cfb", "value": "T103348215F1A0CD2FC6594B315DC6C7F9DB74FC62AE694323328ABB2E3D329809652B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777217, "uuid": "3c9bf7e0-554f-4259-9b31-85179b47612b", "value": "3072:M2de6wOo5r7PY4004SLqHr6qxM2D8bCsMQr/ySX7L+qt6WVfLlQmS17F:M2A/5fPY8J2Ha2wbUaLLlBiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777217, "uuid": "93b45e7d-8fa0-4d07-862f-d3f9875a7a1b", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777217, "uuid": "eb90dfe5-cbbc-437d-95df-d015d502ccf8", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777217, "uuid": "4161c4d8-27ca-4bf8-8029-f47f7ec8db83", "value": "SecuriteInfo.com.HEUR.21539.18793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9265ec11-f8e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684787893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787893, "uuid": "7be20f6a-17f7-4821-a813-b90947b974a0", "comment": "Malware payload", "value": "865d3491b6cc85f207443255e5e7431e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787893, "uuid": "721b6297-3e41-4ea8-aeca-0f93b479d8c6", "comment": "Malware payload", "value": "efdcb0067912e9a254be5c3d6f6d7fec22df943209ed0cc093aa8c788792390b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787893, "uuid": "a6143fa1-d366-49e9-a8ef-90a897a3aff9", "comment": "Malware payload", "value": "4b4677434247f8ca42776e7ee878032f8bb614f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684787893, "uuid": "01103dba-56ef-4eec-9b0d-acc7306945e1", "comment": "Malware payload", "value": "f80f3b9ca7b7a0bbe1bbce2730f66a599737b609dbecf4098c085aeda30029183bda0cc271c6f6b8de0de312dc179e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787893, "uuid": "06b0bd2f-21d3-4d96-a12a-08d31e406a4a", "value": "T15964E12276D5C071F217553449B1CAB28A6BBCF15BB19DCB27A11A6E4F343D1CAB830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787893, "uuid": "90feef9b-c85b-4bf2-af11-71d1d129038e", "value": "1c8b7141d44e96dcc8c22d3bfdac433c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787893, "uuid": "c8701c0b-9890-4eaf-9713-a5f7d320deb5", "value": "6144:RG28PIo3jdTTnOs0M1ZtaqcjFvGYOQ3b1sDv+:ADD3jd/tVrWvGKUv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684787893, "uuid": "d2dae0fc-d841-4467-a279-6c15d99947d2", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684787893, "uuid": "463b811e-d99c-4be1-8520-8731a720c000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684787893, "uuid": "85a9d0e9-0267-4028-ab64-2112f9976d7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8faed65b-f875-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684741932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684741932, "uuid": "bbf2991d-4ecc-44a8-9a10-f4593166b3e7", "comment": "Malware payload", "value": "662df7031e4ef2e71d8a4c4517e1d898", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684741932, "uuid": "6cf6e92d-9a07-4a4a-82ca-6a950d7cedb7", "comment": "Malware payload", "value": "f0098d02f5e9835e53806ad663b5a54ea5d922562c9ee1883173ce569da0a44c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684741932, "uuid": "afd798bf-a475-4d2d-9cfc-22b7403b14b5", "comment": "Malware payload", "value": "e45367a114da336d1f05e22e668c9f566cebde5f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684741932, "uuid": "714da1b1-e86a-472c-9fae-5934ca9eb63b", "comment": "Malware payload", "value": "6f44f768f1fcab7d50b544f719f5d95d85e644cf511232517f204ef98f4200c34f3250045be68b45a5d8be9b4ac5bea6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684741932, "uuid": "7bc00c6b-1d3d-4c07-8999-d638388e24dc", "value": "T1BFB2D1D338F44A78D3A516BFF3638EADA16C01EBC468F751CA943D8E795A841500387E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684741932, "uuid": "754a643f-e5aa-428f-9436-ab03f7d6c1e2", "value": "384:4mjcKmCvUF12tmwpsr4OhPi28Zytta6aicWPV4X640Ok7CtVy5qG8TKruytol/LM:4mKtTwpsrBhPsEttJhqXh7ZpFBHxPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684741932, "uuid": "be662d02-7413-4551-b934-64e964e111ef", "value": 25640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684741932, "uuid": "9f7e05bb-dd66-4bc8-bb40-561ae6573228", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684741932, "uuid": "83336a91-3dbc-4462-baea-146703ac1a5f", "value": "f0098d02f5e9835e53806ad663b5a54ea5d922562c9ee1883173ce569da0a44c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df80ed7c-f8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684766118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766118, "uuid": "f90e922b-9332-40a0-a15f-df98d0ae398d", "comment": "Malware payload", "value": "2d19f0e783c45caa6dddaddc202f74b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766118, "uuid": "d5011a05-e1b2-43a1-ba21-e65683f675aa", "comment": "Malware payload", "value": "f00d7885d3e0d7fdd74fa9b202fd9b80887276f994102dda2bfd21c80fa7f417", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766118, "uuid": "3fe5f185-9790-4625-b489-d51d44b5f287", "comment": "Malware payload", "value": "e7fe11a856fa157d559e166da0f2302827d420c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766118, "uuid": "787fd4f6-cda1-44d8-91d6-009198d9b577", "comment": "Malware payload", "value": "efa3de651e6a3a170881ed94549667c9f95b0c3b968b5fbbd21a084c3726e9558eb062e2c0c7b97dbc2a264f0ec7288c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766118, "uuid": "d41da84e-61ce-4c0e-bc04-13533d580046", "value": "T16CB30A804F5A24620B6B6E2A7671D4A9DB6D0F7682D4118BF06F3251FBEFD4ED8C1630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766118, "uuid": "a6ae821d-d4ba-45dd-a9c6-4dc79187367d", "value": "3072:ii4cxDC05bvlBxtx3ap11cYddNmTN0bwchPsjlRg9SHNKHG8LbPLkXPcjMl+1s41:ipIv38gN0EAs5RW3Loo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684766118, "uuid": "0112606e-43fb-4c94-80f6-571faaaf1ec1", "value": 113311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684766118, "uuid": "be13693e-61a6-41df-9935-ab61e1807750", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766118, "uuid": "ab35ea98-9eed-496d-8e25-257644466ca1", "value": "Uhnfjfby.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750f321f-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752195, "uuid": "feedf091-60fe-4e06-88cd-bed5675868b5", "comment": "Malware payload (RedLineStealer)", "value": "0b16556a7890ca0215281f1dd5f54dd9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752195, "uuid": "f16e5f48-7e7b-4d15-aa9e-1d04c6aae82d", "comment": "Malware payload (RedLineStealer)", "value": "f03f5984d9e27d7e6c6fbcae7b4b4ea50bda106db0649c91607359d0801cf41b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752195, "uuid": "051b7599-0a55-4d91-9adf-ea15640aeb6a", "comment": "Malware payload (RedLineStealer)", "value": "df8ec75eb2a59e64ba4d66da53a5f21b61822abc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752195, "uuid": "47e91d14-88d5-467e-ac8b-0e8adb8eeb93", "comment": "Malware payload (RedLineStealer)", "value": "840e0adc38e06e343bea5a3d09322f716072457b0bf08126728a5e45c6ee96d59c710c2b2527b1a7fe42de27993e2e89", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752195, "uuid": "f8a3d818-1a81-4429-87e1-2a9479c18c1f", "value": "T186252347A6E885B3D8B42B3004F213D70A76FC915B99C3573688B87F0DB3658A97136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752195, "uuid": "a4f2ee78-d595-4db8-9182-594f4c61a524", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752195, "uuid": "164f5e94-bc41-4910-ae44-40330c03533c", "value": "24576:Xyl+UvcH0dHtNuauyA6odkpzV4gRIZnoa2pxZDoVaE:icY5dHto+pzVP+ncpxZDoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752195, "uuid": "9ea056e9-17bf-4a45-b24d-e5f522f20490", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752195, "uuid": "6c0dd880-ec74-4bf9-afc4-fa5144c6835f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752195, "uuid": "43804508-bfeb-4814-aa56-a566a4660f13", "value": "1212324111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd847c78-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752344, "uuid": "07a9f922-6564-4a8b-9920-d0470565f363", "comment": "Malware payload (RedLineStealer)", "value": "6652ed823fd75a42e900d26da8287899", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752344, "uuid": "1b39c728-1571-4942-ae6b-4a4cd4393e81", "comment": "Malware payload (RedLineStealer)", "value": "f05da418fb0ff2eaf775d2d8402afc5a4299a248bb689edbe660b7850624940f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752344, "uuid": "f42a6249-a03f-43e9-979b-42343b892581", "comment": "Malware payload (RedLineStealer)", "value": "f4ffead01ffe8bb609dc31f218c684b7bbd05c80", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752344, "uuid": "2f649f11-ee2c-4fff-98c2-49edb97520d5", "comment": "Malware payload (RedLineStealer)", "value": "884425e5fe9b7656ce364237f5417a98c4a6c53ddb789c0a73b06d17eb2b076901fa04e9ddd9582f038321da7b51f275", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752344, "uuid": "f1efddf8-531a-4e44-8f7d-e4a4ab32dbfe", "value": "T1B9252266D6D81072DDB1237059F607A32B32FC709938939B335A384B5DB25C92632B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752344, "uuid": "6e0568ad-c660-47c8-9dc3-1b12a03a6c11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752344, "uuid": "dfbf2ce6-0f56-4245-9727-58557b2fb0e1", "value": "24576:JyWN8dUVmbumozyZ2qos2ljLcZ+GAMrj6JVd+Kfmft18+:8W4UkumfZ2qsdLg+5F3S18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752344, "uuid": "324b1feb-b657-44eb-8fcb-c2748e883bb1", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752344, "uuid": "7e7345ff-6a3b-44d3-ae49-b6404ce33b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752344, "uuid": "12c0417f-e3a2-4cac-817a-9223a9b3dadd", "value": "bitcoin180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89a89ef-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777219, "uuid": "736aa661-dd89-45d8-b49e-929cf79e9f3e", "comment": "Malware payload", "value": "0d6de3af48c1c6a6ade60b1ac21398b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777219, "uuid": "c1df4714-2b07-4de6-a970-2f8e09797b22", "comment": "Malware payload", "value": "f063132a9e96e60c42ff507a0a9b081f6c17d13d983048ced39675d3f2e7c513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777219, "uuid": "18dbb484-5f77-4ab6-a53d-0fc83d404618", "comment": "Malware payload", "value": "acdf6cda7a02272aa30334a9a0f69514d80f7d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777219, "uuid": "1cbd1c9f-cbe5-44df-8d4b-152f02575b92", "comment": "Malware payload", "value": "09b3e90c09fa5be6bd2bf43135ed61bc60d25db72dbd9fb2ee55cf15e56befbd8f99b4b58acca390360a06c41f68ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777219, "uuid": "857f204a-3961-4686-8ad5-75098cd289aa", "value": "T1E032C897F482C672D40B40BC1292C7B68E72E5336DA2985ECFA4D03AB857B31B55DB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777219, "uuid": "b8d41d66-7e53-4262-8374-6d93d6a6444c", "value": "229f7a9ccd83de766743102a71541489", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777219, "uuid": "81f12841-4000-45e6-aef0-750583c147ac", "value": "192:B0ayR5mC75jqNxd5jhQ2q4xBS9IWAPJGZhQkTNFcY:05NjqNxzjhY4xIPAMjQkToY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777219, "uuid": "f88b79ad-e45d-471d-989f-e0b4d02170a5", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777219, "uuid": "beda69ba-4e0e-4089-b49a-14d472d6d8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777219, "uuid": "1b6459df-705d-4ee7-94d7-9fd309bdb09c", "value": "SecuriteInfo.com.Exploit.Win32.Aluigi.gr.13189.25533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7120e7f-f890-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684753594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753594, "uuid": "892f8817-dec0-44b0-9250-471277a752ef", "comment": "Malware payload (Formbook)", "value": "065638a8d93b24ae2f7dd54c501e2e2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753594, "uuid": "1d15d07a-c0aa-41f3-afb1-2d8eb2475cd1", "comment": "Malware payload (Formbook)", "value": "f071e06b294ad94e6c83f6b35a9700b8cb3df225e76096730a38567de1c50450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753594, "uuid": "2dc4e36a-e4db-4195-89f4-d8cf9afdd44f", "comment": "Malware payload (Formbook)", "value": "49d57001227534632899f9feeb00f4b4e9a007d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753594, "uuid": "9c50c03e-2b02-44c3-a9bc-df861bbb1d4b", "comment": "Malware payload (Formbook)", "value": "6934630d67b82ac8e4ed5f3b18dad56aba64217c37268280ac685de5d67dc26a29248871e7b25ea9c1200b6a83c9695b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753594, "uuid": "1100a377-441b-4913-9fbf-568f919f7415", "value": "T1DCF48B5633B57621F87D33FD01156389CB38B44A2022E22A1F9A39D546E37EB771A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753594, "uuid": "1680aee1-ff5a-49c7-bac7-601058b46d9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753594, "uuid": "fc009085-d645-4f49-b83e-92b6a7ac9389", "value": "12288:TvV+s1bSQT6tjjdB4AA+ulmngD2Io0g1RsPIk04Byimud+Klb5HxjONY3dwDOOO:Ttu1um0V0CPV5qY3dw6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684753594, "uuid": "82cdb432-b342-4e9e-b2c4-910de3a366e7", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684753594, "uuid": "3bc56ec1-e8b9-4397-92d8-663dfdda3ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753594, "uuid": "43a0df7f-b841-4160-ac38-9deba0f01480", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d751cd-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752309, "uuid": "327ae665-b8d8-4cc8-90b7-34f649aa189b", "comment": "Malware payload (RedLineStealer)", "value": "5b5bc5bdcd150bc005e852265e4ca549", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752309, "uuid": "3c6284da-b72a-416b-8cdb-ee7986f13bfd", "comment": "Malware payload (RedLineStealer)", "value": "f12381b0db812064c4f4ad318e2a1b0ebbc43fe31c0cdf12c13dc2f75d2460a7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752309, "uuid": "7053938b-6bbb-4bde-9013-812ec7709f9a", "comment": "Malware payload (RedLineStealer)", "value": "c731d5cf8cc1d7b7340138508152df4b3b3e79a9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752309, "uuid": "6a46d62f-0dc8-4630-a362-7116cb1d24e4", "comment": "Malware payload (RedLineStealer)", "value": "24d0f6780955e0e566d6dca9e0f0262698c5c8f3a07729105e8d8ded0a91cb4ade9831a4c2726e2ebba3fbac4af183ad", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752309, "uuid": "1b71a0ce-663b-451e-b8de-d0b6382144ce", "value": "T1C0252312E6D484B2EE7A373069F602D70B3DFD648D398B1A376069694DB26C0F17076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752309, "uuid": "5becc544-0e97-440b-b12b-1173fdbabf07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752309, "uuid": "913dc173-1341-4c11-8917-4c0a000b51f8", "value": "24576:eywkKrhxsO8qrmRzKpBMM54RtbCwqaU6eOit4:t6XyqrmROPMM56ChaU6tit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752309, "uuid": "5e8d555e-acdc-4bab-a905-d835eee16344", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752309, "uuid": "fbdf80de-e4d0-4b8b-9aa1-0a881f9fe0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752309, "uuid": "484c2441-819b-42c9-8639-39d812ce5669", "value": "Temp133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8186848f-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752216, "uuid": "51cc4eca-1088-4f26-b23d-7f37d986919d", "comment": "Malware payload (RedLineStealer)", "value": "0e7fd4e7a0fd05c8208f27a3276eb042", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752216, "uuid": "772baf60-59dd-4e64-930c-3bfe9128fbf9", "comment": "Malware payload (RedLineStealer)", "value": "f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752216, "uuid": "dce59f95-4880-4456-94a6-5727c46c1e76", "comment": "Malware payload (RedLineStealer)", "value": "5a2d9c2b90969502e50b6b8229621faaabdada75", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752216, "uuid": "575b4142-1d14-4c38-afd7-f5d09bcbd35c", "comment": "Malware payload (RedLineStealer)", "value": "8b92eb9da6531f3d1a2fd6b58905861773cb22a0eb8e2a6025d36b2224db2aac2568e99aba200e9a224bc912ff416bb5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752216, "uuid": "75b7d7b7-feb3-42d6-9c8d-cde7d8d09cb6", "value": "T18C252357DBF400B2D9F527F008F717532A36BDA4AB64425F3981A91E4DB2B84B33235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752216, "uuid": "7e84ba88-6984-46f2-9329-89c05af9d4bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752216, "uuid": "ed014a29-eb7c-4cab-a4a6-782f8e156b16", "value": "24576:XyySBHEjgQGT0EBpKwggXzlQpjpRmcdJmTff:iyUH7QGv/1ggjloxETf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752216, "uuid": "8c89bc1d-2a56-46f3-aba7-10105d9bfb27", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752216, "uuid": "e037d530-7c5e-47ab-9dbe-640d7d01130e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752216, "uuid": "68bd065c-ffe3-4d4e-9c06-e386eb444663", "value": "245245254202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d2d307-f86a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684737292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737292, "uuid": "2d03e570-b964-4f5d-b1a3-bcd297ab898a", "comment": "Malware payload (RedLineStealer)", "value": "6e735cb04cded9744aa0b218ef88e329", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737292, "uuid": "b2b288fa-3d39-4cda-99e7-530ce1804b5d", "comment": "Malware payload (RedLineStealer)", "value": "f204c391099087203e68fadf9158ee376ff8f3f94e03d2954989999c5e60caa8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737292, "uuid": "09c21a6b-5044-417c-ae5b-391fedf7bfef", "comment": "Malware payload (RedLineStealer)", "value": "7cff3df387f4f2ccc8af19e43c3d69f1e140c982", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737292, "uuid": "2d0f6d8d-9a01-45b7-8eb6-d4811e4a2fb8", "comment": "Malware payload (RedLineStealer)", "value": "67871e2fefedfa699aeaa28df196988b5095fd70634bf3f1458f5c1209decd7a130ed5744d17b87078800eb424f6fbf6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737292, "uuid": "0bd9015b-a205-4e1f-ba8e-655eccde9a35", "value": "T18F252306AED95073EDF01B3018F707470B3BBDA1097492DE26761AEE4CB39A5AA70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737292, "uuid": "f8025f9d-bd46-4f60-83a4-9804b93acb36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737292, "uuid": "0029d6e9-5ee4-47c4-bf9f-2656ced4840e", "value": "24576:pyJKlN/vy18IjIBqdYPFfXUi9BCtzHr6:cJK/618IUMtoBCtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737292, "uuid": "611f5616-9486-4aac-835a-eb012048539e", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737292, "uuid": "c88eeae3-fb48-4f4c-932f-864c43dddea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737292, "uuid": "20f5a1b6-8ed3-43fc-be2e-a8562f927782", "value": "DiscoSetup930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e7dc49-f8c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684777221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777221, "uuid": "d0f5297e-7e3f-465b-af6a-2ee895b616b2", "comment": "Malware payload", "value": "6bbb708c0914e4b878e9806d61c36a2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777221, "uuid": "e48f31d6-2660-44aa-9dc5-7b8960cdd670", "comment": "Malware payload", "value": "f21868b220ab3f976dd80cd8ffef937cfe5ca844b18f76643c8407dd5ccdaf4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777221, "uuid": "591dcdc7-dc0f-40b0-a4a1-ba32d0930ad9", "comment": "Malware payload", "value": "1a622c78f7a4e3792bb00f6b810ca54d265def9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684777221, "uuid": "77ca7116-363f-4caf-867b-6390ec6c67d1", "comment": "Malware payload", "value": "1cb53e47584b262ee26f665c54ed852654dc5128b4d421d0ad109a116818656ec79ba6947b4e58128d12d1200e1246c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777221, "uuid": "d80c8c52-ceac-4a97-88a5-edee8d97f909", "value": "T1F16302909E8CAEE3D6436C33241D639B271558EED38643D1D9760E89453C0AB9FFC646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777221, "uuid": "fca6efd9-94c8-44b9-b345-2de45106d75d", "value": "557ac4a826ba1dfed2f6b10a55cd5bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777221, "uuid": "00a68f2f-0c57-4318-92b2-b1f523cf6901", "value": "1536:Me0cctKZTzqYH0gW5VIf4o10DJ1YM36HjT0p:F9ctMTzqYHUzIwuwJ7wjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684777221, "uuid": "85908777-aa39-49a6-88fb-82fced6606b8", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684777221, "uuid": "902c4b43-28d7-48be-950b-e391b2c5e1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684777221, "uuid": "2e3baec3-6573-4f03-919d-fea6a3ed1826", "value": "SecuriteInfo.com.Trojan.Crypt.21503.28544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3664ba4-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684748005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748005, "uuid": "4820fdf9-6db3-46a1-8e31-35e03c5a2716", "comment": "Malware payload (RedLineStealer)", "value": "87d1d923dd89dcf55febe8ee77e3f2b7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748005, "uuid": "50e1d19e-0860-46a8-ad9d-87c926aa0a17", "comment": "Malware payload (RedLineStealer)", "value": "f27f898569fda847223602a099ee3a3a14e81308bea5133a0f5315dc44413842", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748005, "uuid": "9a10bb44-bf13-4f07-b5ce-0ef524f01ff4", "comment": "Malware payload (RedLineStealer)", "value": "8bfa013e37159c13aaf69698dd88c87814ad2269", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748005, "uuid": "edbeb47d-f9d5-4dea-88d2-44eec954b39b", "comment": "Malware payload (RedLineStealer)", "value": "1c06906d1083bfd8bd36f39e7f95d8ce38d541ae31f44974979e6921c13953281de2797cf831ef6bd5f5d1bf961f8ddb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748005, "uuid": "d4da2aeb-2fad-49e4-b39a-bdc210df6b6d", "value": "T1DA252311ABE1C026E5F41B706DF707C30A33FCEA9978A76A3B82985A19B31406575F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748005, "uuid": "1efb93ed-a9b1-436d-be42-c02440cfc1cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748005, "uuid": "190726c0-4be5-4a81-96f0-5910e032c93f", "value": "24576:6ywbCOplCIPY09vUQxmUfocDMdhJ89UXDvFIJ2mBXDITTvSK2dE:BUCOplSQkUfVYd3B7mJ2jTTKnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748005, "uuid": "7ec904b3-cdbf-40bf-9289-cb44e8d1c8ba", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748005, "uuid": "f684dc12-21fc-4060-89dc-9736e3e09fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748005, "uuid": "4261aa0c-f2d7-459a-89ab-a632a6cd7c34", "value": "preview908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81362ce7-f8ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684780133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684780133, "uuid": "f05bf382-061c-4363-a7ac-5b0790153f32", "comment": "Malware payload", "value": "e522c89466007da3839891809688576e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "systembc.powershell", "colour": "#74B4CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684780133, "uuid": "24680918-f6f1-41ba-8d2a-12ec11c00a3f", "comment": "Malware payload", "value": "f2afd46cfef3883fc858ca7b7730d4d6ee56a7aedbdb1b1f7bda7dba054f489e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "systembc.powershell", "colour": "#74B4CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684780133, "uuid": "b31bafdc-6365-4ae8-a55c-05a3af6dd429", "comment": "Malware payload", "value": "e13afb4c3485e8627989939796b53e894d52b1d7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "systembc.powershell", "colour": "#74B4CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684780133, "uuid": "d8f38fe5-f357-4a76-970e-3e14235d688a", "comment": "Malware payload", "value": "2d28e65a4b44ad65408bf0c1b697bd10640dd28d7e7c867cbcaa59c979fdac8372867da4c191dd6c2ce7c4f12f03c9c0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "systembc.powershell", "colour": "#74B4CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684780133, "uuid": "cf43fa2d-f6db-4dfc-a1e5-ddfbd455f280", "value": "T17BF1A8175FFFBBB902839BF8CED99478E779483A33D9A814790DC484705499C40BE8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684780133, "uuid": "aad8ee7a-6fdd-448b-8313-7fd9c30cacf2", "value": "192:R56pQXAhsUs+cn7FiT/ib33NoRbT6IjrliyK:RwpQXAhsUs+2FiT/ib33NogIj4yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684780133, "uuid": "badf5cd4-8570-41a4-b2bf-a456c45220e8", "value": 8105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684780133, "uuid": "43f1a0e6-23c7-4529-b94d-e4b824bc2cef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684780133, "uuid": "60feeeb8-3027-42bc-bd0e-3c545e4383eb", "value": "soc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ead0967-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684744749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744749, "uuid": "2c99f165-0330-4ed9-8a4c-4759faf54c9d", "comment": "Malware payload (GCleaner)", "value": "5d97636008c540b5bec52d5b104d8132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744749, "uuid": "b6ffb31c-a458-4697-b673-1231c3c36660", "comment": "Malware payload (GCleaner)", "value": "f36c64728dbe6bb249cc14ac74d1b0fb0ba27394fe06b2622619413c12634e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744749, "uuid": "d03b9c69-e4c2-409a-addf-3e42d4ef4103", "comment": "Malware payload (GCleaner)", "value": "fd93aecf23361963cdb6f9799443ba5f3f381d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744749, "uuid": "3059e747-d1a3-44d7-8c0d-398f3d6415c5", "comment": "Malware payload (GCleaner)", "value": "12180bec8ead61e6f592b72a985c34913844afaa7fbbbe3638b0cce857a17bcd11b56b7581d8e9d691030c1a088c3db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744749, "uuid": "65dbdd62-70ec-442e-a8f1-28fb4ba21b7a", "value": "T15674BF3362D1EC31EA654631CD2AC2F8262EF8517F196BC736647F6B19311E2CA36742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744749, "uuid": "814de708-b86e-4d5d-a947-0f4a5f23671d", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744749, "uuid": "45e302fe-ff70-40e5-8183-ec9cc6a1c9a1", "value": "6144:HHjjHTDMpwGWcCGBdxO8fukvGkcI5kN0/8uk5gFVJwG4uTK:HTDTdZGfWo20Euk83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744749, "uuid": "58b8c000-18ca-497d-9246-96e1f8ef76f7", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744749, "uuid": "98dd31be-cb5c-473c-abe7-28b7da0057a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744749, "uuid": "5473316b-6a51-49b3-8f81-103877a86096", "value": "5d97636008c540b5bec52d5b104d8132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19aefa7-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752404, "uuid": "dc32bdaa-17d7-4119-835a-69ee5740cee6", "comment": "Malware payload (RedLineStealer)", "value": "28c0847bf4e0f0d2c57d9248684a4841", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752404, "uuid": "9b51572b-7295-4e8b-bca7-0e2daf1d1d23", "comment": "Malware payload (RedLineStealer)", "value": "f3958cff302ca951392b9452fb741f5580ed9b5beea041735e732ae9d6a3afb5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752404, "uuid": "e13b4a15-b217-49e8-adcc-c22649b6b63a", "comment": "Malware payload (RedLineStealer)", "value": "4e42b2c7fb212e68e7ce81dbd3574be7995fa23d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752404, "uuid": "73ba26c2-48d2-4faf-825b-f382819fe6d8", "comment": "Malware payload (RedLineStealer)", "value": "0752bb64c7214ac2af9ee698118448aad282e96da3238cd1148c74eb3dd3a4e4f14d3478b7094a6fa55df253f1c03e66", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752404, "uuid": "67708b5f-32b2-4af1-abbd-7afe64493f81", "value": "T1E4252327FAD955B2E938173118F606931F31BCE11D30979B338D996E4C72680A8B277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752404, "uuid": "f69cf9a0-cb6f-4331-9060-c761e0f888b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752404, "uuid": "f9efd9b5-839a-4e4e-a0fd-2232943d03c1", "value": "24576:SyItO/vlTeWMtqEPIdwXa/2ZlbrjHREW:5r/vlTeWMtq+AwXa+Z55E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752404, "uuid": "c0644090-8356-442f-b0ad-355ec17847b5", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752404, "uuid": "82f3a643-34d9-46e5-ba82-3869b03f928c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752404, "uuid": "10038c0d-a578-44ca-898c-4217f68976ef", "value": "downloader186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc7f4f8-f8a3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684761711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761711, "uuid": "a4916a0a-8e14-4f95-b201-5afb2beb5feb", "comment": "Malware payload (RemcosRAT)", "value": "c220056c58b75cabcdd02a60e77fe6ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761711, "uuid": "86467f16-d4d8-40ef-be4a-969399153d10", "comment": "Malware payload (RemcosRAT)", "value": "f3a3371dbbdf89fca72ec55ee13431692ddb09a0f66e17ee3f2caed32352ab4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761711, "uuid": "2f574870-c0c1-4541-a1e0-c4de1ad506dd", "comment": "Malware payload (RemcosRAT)", "value": "243b70253953a398c787905a503c3c9bd27b73c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684761711, "uuid": "fa5666e7-1490-42c4-8e37-e0f089f4c5c1", "comment": "Malware payload (RemcosRAT)", "value": "0443c235a87ce070b07886cc50bba68761e4b6d28215d3406641eac369c77a16bc1a8adc39eb5edd9b5abb31e98f816f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761711, "uuid": "72a6c6cf-a535-45b3-b817-e61f7b118088", "value": "T173158D52B2D29937C1633A344D5B5750B8397F601928748A6FE83FBC9F7A25138293F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761711, "uuid": "4c6fe905-888f-4007-b52a-2035f62d9b02", "value": "2a47bc7f7b8c911802f26218bdd23fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761711, "uuid": "ebdd7f1b-fa7d-4a3a-a448-026c6cc10a33", "value": "12288:PiG0CtrZ3HZX+pjqSDTdGluNIAOIQM6PLbHViwW5TpHJxLCRQZUts8NHDU:PiFCr7upjqSg4OIl6dw5Wm85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684761711, "uuid": "b74ee712-e66a-4f2e-8ef6-56e0e4784372", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684761711, "uuid": "88e90798-503a-4617-a615-98e6b2759810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684761711, "uuid": "07a32338-f18a-4a49-b321-5cf39b13189e", "value": "Invoice # 78600667766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79aa209-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752334, "uuid": "b2c574de-614b-40ba-9edc-46dd76d86a6d", "comment": "Malware payload (RedLineStealer)", "value": "98e90b98b55e836018b3ad82381064e7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752334, "uuid": "aeda8e72-fc55-43a0-8df6-8badcf57d0f9", "comment": "Malware payload (RedLineStealer)", "value": "f3e26a3811eb0df491fd6d357373513f951e83e0be1ceac2cfa0476ce9e5f9bc", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752334, "uuid": "dcde125e-fc1c-4ecc-9115-c767878749bb", "comment": "Malware payload (RedLineStealer)", "value": "88fd0d8d014ab882121b27c60ebd8ac9bfe1887a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752334, "uuid": "83454ec4-0d81-490b-8f88-062fd0575934", "comment": "Malware payload (RedLineStealer)", "value": "2d333ba871d007a3cd5b259b8029977af1717156e5c30f58435ed9baf03f2a4ac64ec6e21d6c68594e0bede692be1657", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752334, "uuid": "4dc4fa22-95f2-486d-9bd5-ccb6bb0f9293", "value": "T1F025236399D88036D5B53BB0A4F603C30A36BD209E75539B17C9AD2F6832E516137B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752334, "uuid": "9d351290-8d71-435e-a560-8418c83df01b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752334, "uuid": "6cd73d5b-3ae9-4c84-8eb3-8ea48e5b931c", "value": "24576:/ys7ivxKudqGB0aZ+PFofyMp2xNPZyoPQX/7l+y:KpfdqGB6PFoffpUSYm/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752334, "uuid": "0a55e8ca-95b6-427f-bd11-4a899b8eaffd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752334, "uuid": "86168187-cda6-4dee-a783-df32adb84eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752334, "uuid": "7bd7e789-9f2c-418a-9381-b7e3e35d9fdb", "value": "audio405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250f5583-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752490, "uuid": "864def2c-904b-4c36-bdcd-9a98475a7e21", "comment": "Malware payload (RedLineStealer)", "value": "d1ec4bbcae4d5a2ef98b753cc19b4ea2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752490, "uuid": "dd5cd7ae-7cd4-4873-89d9-7b7091ac9922", "comment": "Malware payload (RedLineStealer)", "value": "f444d539d69d0c13fd3681310938aea22d91797dafe8f6a26d838eca8acff534", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752490, "uuid": "d38ee6c9-eccd-43da-bb02-aa5d13888dbd", "comment": "Malware payload (RedLineStealer)", "value": "957fe2b31f221522ac5b259b097766dfd6db1ec5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752490, "uuid": "aba30bae-78c1-40b0-95e4-c07fc481698e", "comment": "Malware payload (RedLineStealer)", "value": "70f81cbf11bb86e7a35da40571db978f4ac6ff3715fc68e769bc087482ad9e84e1959c8038da020f6d1a465a8e78fc76", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752490, "uuid": "2e748f5a-df14-44a2-886c-6be384f96f19", "value": "T18F2522027AD8A076D8342F7059F61A930B3ABEB1D67C836B6352785B5C73782587037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752490, "uuid": "efbadeac-af11-4404-8c6f-329428150732", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752490, "uuid": "8487d74e-16a7-4fea-92c6-f17634649329", "value": "24576:Pyn4/O6FL5Hf2oqNELnPOSbrM8ZbDvDcGi2x:aiVh5Hf2oqOP9blDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752490, "uuid": "afd88548-76b6-4b96-9c32-10e61bdf5e68", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752490, "uuid": "ade6b8eb-385b-42a3-97ac-da7979acc440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752490, "uuid": "c00fce1c-4747-4be3-87c8-f01efd546c48", "value": "manager929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a3bbe1-f87b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684744281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744281, "uuid": "5676a3d5-43b9-4514-8e83-f1a0e7887837", "comment": "Malware payload (SnakeKeylogger)", "value": "c7dd9baa8edc8390acae1409db63a5f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744281, "uuid": "5b8bc0ca-02eb-4b38-b111-0174ac7d230b", "comment": "Malware payload (SnakeKeylogger)", "value": "f471bb104b1ae05e5e786e5f17577f5a199d36b2e39dc6b9c4a5ead9e54960d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744281, "uuid": "88a007a8-d68b-4732-b52b-1d4bb606ca3f", "comment": "Malware payload (SnakeKeylogger)", "value": "0549b987268a417a3cded255c691c1b06d9bcab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744281, "uuid": "aabdf0bb-8e9a-4af3-a116-455f244777ee", "comment": "Malware payload (SnakeKeylogger)", "value": "548ed7562f9c8afc9d93d82d8768d1ea6eab4e0fc74cf3e4382a140f78b596465e10779b6b6a4d2eda58384608f41c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744281, "uuid": "a8150429-cab6-4d0a-8712-75446c2a02ac", "value": "T11E34F1056BAB2F0DD4BE8BF5ABB2384843E74D465051E35A0D4B34CE4E23F942556F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744281, "uuid": "b07cb634-e2bd-45a6-abf3-4e563bbe106d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744281, "uuid": "e9eba08c-48e4-40b4-9461-261f24c26780", "value": "3072:+R/CFu2f+gKbye2cV6mpb5uck0X19PPF1wabhGM6ejQQbThzf6XC+f6OK+oXH:QsL+Ny2V6mpb5Rp9gEkM6vQshK+oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744281, "uuid": "51cc906f-0caf-4515-b048-5bb926601511", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744281, "uuid": "40e50a2a-fdcd-42aa-8b0f-4002e45d0c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744281, "uuid": "96ae8538-5537-4676-965e-539019f1bbf0", "value": "987654345678SK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea036c3e-f88f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BumbleBee)", "timestamp": 1684753250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753250, "uuid": "d31cae0a-9367-4e19-a977-0b29bba586d7", "comment": "Malware payload (BumbleBee)", "value": "31b79a35dfd2cd8f59e7a070bc78347c", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753250, "uuid": "86b54054-8a07-498e-b069-4de67d62bbc2", "comment": "Malware payload (BumbleBee)", "value": "f476854936fba61ab407be730d4b96d4cf47eb9ba568c22fbde3807d48ae14f4", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753250, "uuid": "4d2c3753-6f3d-4933-a244-8bbd209aa33a", "comment": "Malware payload (BumbleBee)", "value": "e3b0c27e84244a70a9e8094560823a114f69b2c2", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684753250, "uuid": "dabe4fe3-24ab-4757-9aa5-1da6c565c81b", "comment": "Malware payload (BumbleBee)", "value": "885bdebce9b0441860a9f67abb39040523c063d5d79bdfe8570708ca707a8719033c0af4340149851280dc87ecaa4dd9", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753250, "uuid": "e6e2ab3e-6600-44d1-b1ee-c6d89a10872a", "value": "T1EF45F011E2920FF9D472927A816B262FBB307E5C4714D377ABC0D2377D927E05B1AA60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753250, "uuid": "fee9d0f1-167e-4b5f-84e3-09193ce75654", "value": "47e01530ad43ec939d1c47709a80a5c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753250, "uuid": "862509de-88a8-42b3-be8d-1ce1f9076684", "value": "24576:3e7b256IJI5tQO48+LnlOSN9QlIlnxXpcmL4fyYzJ9d:mhoP8+ZOS7lnxXC3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684753250, "uuid": "83b91ba7-5858-496a-aec7-3f382d0c9992", "value": 1223176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684753250, "uuid": "80cea006-fd9b-4453-b4a7-8ad922c01226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684753250, "uuid": "9183feb8-2a9d-4eb3-a9b7-704cf25df1ff", "value": "31b79a35_f476854936fba61ab407be730d4b96d4cf47eb9ba568c22fbde3807d48ae14f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420651ac-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684747815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747815, "uuid": "83057ddd-8c50-41c0-af09-db4ef09d361e", "comment": "Malware payload (Amadey)", "value": "53ddfea8b518d5dcb6e1db29b8405187", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747815, "uuid": "18b259c0-4338-4681-8544-a1cc2f13144a", "comment": "Malware payload (Amadey)", "value": "f4f258cc129269bff283373addadd07eb257016cf1912b8eb203cda37db53ad5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747815, "uuid": "c4408881-289a-4328-bd8b-21a1acf308d0", "comment": "Malware payload (Amadey)", "value": "e1a29fe0a77d1ffde01aba0f4e28b2278364fc34", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684747815, "uuid": "33cddf5d-5e7e-4db1-a1ad-142cc499c9f9", "comment": "Malware payload (Amadey)", "value": "1cde49fb89ebcd73a687536fa1128221edbbd42501d265a50e676550365b14a8d0a98f74b376b2a6f33abc1eacf13e67", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747815, "uuid": "2aea0167-eabd-4df4-b860-c4074b30fe47", "value": "T1AE252302B6E68073CDB42BB059F902971F76FCA69D74422F378858156C7238CB4B676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747815, "uuid": "2889e04d-6304-4b7c-b855-d8a2e90e54e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747815, "uuid": "623ae37a-a7b3-40e2-b733-ba99c89cee1a", "value": "24576:uyxv06EtwLPwXTszCJHg3DCbInaUPj/O12wUEnyZK:9B06EmSTJGCb0pPDOBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684747815, "uuid": "e03e1e68-c7b6-4ef2-af7e-631359aed61c", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684747815, "uuid": "3ffc938f-b162-4deb-a1f2-4aa0f309265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684747815, "uuid": "f92dbce4-8519-4edf-9ab3-82e8ed0039f1", "value": "26324190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bd8c29-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752327, "uuid": "2de7e93b-7778-46c3-a5ce-cda089959a7f", "comment": "Malware payload (RedLineStealer)", "value": "8e359d5eba290a6f161d14a7e03a1e56", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752327, "uuid": "68a7b53b-dfce-4055-8283-76c3d22cb2ec", "comment": "Malware payload (RedLineStealer)", "value": "f64af089cd787541f646cb352f6807942dac5a69e804dedb5c53e86148ff3c5d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752327, "uuid": "9f9277fc-1a5a-48fd-945c-83210fc14a94", "comment": "Malware payload (RedLineStealer)", "value": "2c81e063db0d3d182dc09c28ce52b61ef9cf5548", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752327, "uuid": "684482fb-13b4-4a3f-8bc3-e2eef00066c3", "comment": "Malware payload (RedLineStealer)", "value": "2327fcdfb2fa33fb78c978df8ad7380f12eff59c2a4b0133aec08d2a7a459b26bc5b63a2369c4f25b8cb344ac4afb380", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752327, "uuid": "1a3b1f91-1072-43c5-b3ae-ce31b7df6271", "value": "T1C32523057AD88875E8B83B7008F307831B76FDA19EB4572F674519AA88333919871F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752327, "uuid": "7c600394-4f2f-467f-8051-d9fd55cb42fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752327, "uuid": "77a807c1-fe01-4908-922d-918eddb0c93d", "value": "24576:oyDjxXk+Af46PqxaZwyhlk+oGLJeQs3V+MG9DRwGgGm+:vDjxU+AA6PqwxMQAV+j6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752327, "uuid": "6fbef157-2657-4a06-885b-a95345591731", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752327, "uuid": "0460bc74-5ed1-4361-8494-7fd5f6b73d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752327, "uuid": "712cf347-8413-4b53-aa3f-fab233670e2a", "value": "agent733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23deec11-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752488, "uuid": "3825e6a0-0dfd-4746-a77e-122389cb0432", "comment": "Malware payload (RedLineStealer)", "value": "da0589e49def16530a74e373652cf602", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752488, "uuid": "55a7b4d7-f3f0-42c3-96f5-1db6af827362", "comment": "Malware payload (RedLineStealer)", "value": "f6bccd9b9bf7064e247df9533a10126f5a3dd280327581342a1e0d106abd087f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752488, "uuid": "5a4ed1ab-ea37-4e38-b49d-4b6b7826ea8c", "comment": "Malware payload (RedLineStealer)", "value": "3e011b083bdc43110731ba3bf7e8d5189473fe53", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752488, "uuid": "7d89d266-4d0d-4384-bcfe-047045eef22c", "comment": "Malware payload (RedLineStealer)", "value": "0adb031dd2892456d60f68e728fe424d41950aa36ce5f8aac3d5ae00baacf784ed3d25f72a53fbaf9ea56af11c03f882", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752488, "uuid": "86f45738-884b-4cc6-9757-c7c70c1e58fc", "value": "T1C725230766D8406BE9716B709CFA67C30A3A7DE298B413BF63959C1E0D622C0E571B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752488, "uuid": "e65cb76d-e3d5-4671-8da4-8acc684f7932", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752488, "uuid": "06141dbb-e17a-464b-91c3-bbeaf934a8bd", "value": "24576:1yqu6DbP/GftbpD0gxj+D54llE+FDRcPTrF4/9dK:QIDCftbymFllE+FDR2TrF4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752488, "uuid": "2e3ccd76-40a2-45a1-9070-5751a4c2965c", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752488, "uuid": "bebb7937-94c9-4c40-9b00-1963e3f036a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752488, "uuid": "e6ddea92-e2d8-4ab9-a3d0-7de3b9167382", "value": "manager574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584e38b6-f8e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684788654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788654, "uuid": "ecc91818-0f6c-454d-8e41-58d792702bd7", "comment": "Malware payload", "value": "c971d338280167dd42c5d7db490e6959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788654, "uuid": "3652ae8e-0377-4444-9252-ad4ac94c3908", "comment": "Malware payload", "value": "f6d88155531e834b9911075088d819b8c5de463bd62ec014b5e0276c543c087b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788654, "uuid": "d5d32c0b-dcdf-44b5-a89a-f37f55b4aad0", "comment": "Malware payload", "value": "f06f1bf9a80b6bd12eb7c581689a474d413130c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684788654, "uuid": "f0c7ec26-21ab-443d-b45d-d5a0af273531", "comment": "Malware payload", "value": "aa760a807d68bc4fedc3ed709a717d88993e76abff25d97a2a6ea692033cef99eb773821d2a9b1b45a4f3ae9db908476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788654, "uuid": "eab1e70b-d0d3-4e4e-b0b3-7021a6fabda2", "value": "T187948513AECB406AE0F75BBC4218AE7552F605A02923F0A36FECEACD46D3455F521B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788654, "uuid": "89f88d27-be33-4f0f-af0a-fe7ba296d00a", "value": "10e9c84f5f1d079cf0dea90c24ccb626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788654, "uuid": "071c289b-b553-44b2-9070-7cc960ac8380", "value": "6144:ng61LJeqb0Yyrjn572f1e1fqMLCJ9o5XTTV:RJeK0dFfiUCJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684788654, "uuid": "f7addeaf-6016-4430-ad1d-bf3638276636", "value": 416536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684788654, "uuid": "c59119c5-5382-4e53-8d21-ad59dc2c8c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684788654, "uuid": "ba99fded-cea5-4701-8ac8-65620b45845e", "value": "Laucnher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a2754a-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752295, "uuid": "dbfbf635-aac5-4f93-9203-961dbc60a9a1", "comment": "Malware payload (RedLineStealer)", "value": "7a39b542485284327965fa3fef6bafd7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752295, "uuid": "dfdf512e-f3f1-44fe-beaa-34624ba1df48", "comment": "Malware payload (RedLineStealer)", "value": "f79374366ed445f70eab86f85b7cb0da12ceb8967f0cc5bfe32100cc632b5f73", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752295, "uuid": "303c9e87-6cbc-4d02-a924-4e235f82b487", "comment": "Malware payload (RedLineStealer)", "value": "d10ad2d1bd3151e8e133072013b0a56dcd679964", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752295, "uuid": "a4bd6e2e-ab00-47cc-aa93-76809efcf625", "comment": "Malware payload (RedLineStealer)", "value": "78e9884900326b8dff4a204b5ed44a9ff9a3d922898056a2d0d5e57af8e36029a735fd888384b25bbe9ad2142b60c5e7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752295, "uuid": "ed6a71e3-5701-43ee-8d06-beccf77f5a75", "value": "T10D252316EBD981A2DD313B7048F643830B3ABEA09D7983673785695F1D332806536B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752295, "uuid": "564eaa5d-2e7c-4745-8f62-96d24cae454f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752295, "uuid": "36732ade-e740-40a8-b7c8-21dde568cb1d", "value": "24576:Wy3rd1U3pYUb4qKESUMRAVuxtvPzCCQC3V02AKtSWCDJ:l3rd1gpYi4qHJ9ViF7F02AKMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752295, "uuid": "3c38b756-4dba-44f2-8381-8964da907c74", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752295, "uuid": "c30ee317-b311-43d9-94f1-297bf7fc1703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752295, "uuid": "d4133e64-518e-4c74-b214-720d20d7df99", "value": "CloudCheatsSetup688.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df34367-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752478, "uuid": "bfbe6fe9-a245-4d77-bde7-4bb4c0926c84", "comment": "Malware payload (RedLineStealer)", "value": "bff68732bea83e68b0832c4d2c0f432d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752478, "uuid": "6799884d-894e-49e2-8ea8-b50bb1fce018", "comment": "Malware payload (RedLineStealer)", "value": "f7b700c6ac554c2ec4c6fc724fbcc021753dcbdc43ba1efcff35843dd3c66c6f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752478, "uuid": "17022baa-97a9-4ed6-99b1-aa1af76d1121", "comment": "Malware payload (RedLineStealer)", "value": "5d9d47c10a97775991a5cff9685426f765c5bf2a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752478, "uuid": "2d930f9d-e23d-4840-ba4f-6794f554e0cd", "comment": "Malware payload (RedLineStealer)", "value": "8a6a3b4622ff0c78cc212e8675eb1e76ce6155a261fd55ac3cf57e04309c39f7862801009fab9252c458be3cb1233c34", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752478, "uuid": "3a78cc45-aff7-4d9d-8390-f5b40e3c8654", "value": "T1E3252317F7EC1132E8F81BB004BA43870D7A7CB249B5D2AA37529D5B0D73AD0957272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752478, "uuid": "2175ee92-bfd4-4f31-ba3b-e3ea4ed22238", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752478, "uuid": "8f0e9cc1-c2a4-4c97-aaee-7dc1b658602c", "value": "24576:iyqaRmykAv+7S65YPzvXrhhH20Ipr5MSYr:JnmcvcLCTPtIhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752478, "uuid": "87eb7d5b-1bae-43f3-815d-5de4d9c08f72", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752478, "uuid": "37446a1f-a1a6-4c5a-97d1-90f6b5a83726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752478, "uuid": "9f82533c-b6ad-44e5-9950-370773442acc", "value": "launcher895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264b660b-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752492, "uuid": "90243737-f63a-4e48-9647-72001e674c5d", "comment": "Malware payload (RedLineStealer)", "value": "8229a3450e17343b9cf2ea7492822875", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752492, "uuid": "62f7938f-bf2f-40c8-adfd-85b86e47ba29", "comment": "Malware payload (RedLineStealer)", "value": "f7eae242d988e333cddead1f113e0ee294582abb3140c2deba02ec4e53afa266", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752492, "uuid": "c055dd83-76bc-4779-a117-9f85e0dce775", "comment": "Malware payload (RedLineStealer)", "value": "7d8da8ce9d3a9c798517cb8dd92e20d6c687d029", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752492, "uuid": "f2260130-1757-479e-8875-1dda79d01916", "comment": "Malware payload (RedLineStealer)", "value": "d474dd51423e773f1edf12a330e147f573736b16247f3b207576fff18d6a625ffe14fb330698b6eb04aa0536081da3bf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752492, "uuid": "5aa3f715-3254-4090-8df9-b1f842767393", "value": "T164252327BBD88073EC709F7426FA46935B363CB05E78876F2744A45E5C32295C932B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752492, "uuid": "ff7f89c6-29fe-4394-9d6d-adb4b7f050c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752492, "uuid": "d4b9954a-79c0-4b20-9323-031276bdd9db", "value": "24576:5yvn3MnL7C/tLtLq/9Z34RBx1HBxNEm5ZzI6BicNC8Z:svncnXYZLqF94RBx1pEm5f9C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752492, "uuid": "7ea7e7bd-535f-4d4d-bb99-43d625fb4ef4", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752492, "uuid": "27956a6b-004c-4ca5-96e4-447599c4df1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752492, "uuid": "5df4e67c-6849-4e6f-addd-11658e218146", "value": "monitor230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d664bef9-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752358, "uuid": "e6072fff-aa7d-4468-97a0-788d0fda72d4", "comment": "Malware payload (RedLineStealer)", "value": "9dd557bacb247ed4e581b4d15e3b878f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752358, "uuid": "75e17df4-84e5-452f-bda9-c2dfd18bd451", "comment": "Malware payload (RedLineStealer)", "value": "f80437f133f7652c4ef50d6c07a4faf1ebdb7d878687e48d4a332b1aae11d189", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752358, "uuid": "c64eeb2b-a45e-4e91-90a7-4b036b2425a0", "comment": "Malware payload (RedLineStealer)", "value": "3c1e2524ab3147e0fc2432211e0f5fd5285b4ef9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752358, "uuid": "b927c40f-615f-45d4-a38b-9e90fc301886", "comment": "Malware payload (RedLineStealer)", "value": "e6d24ee51a9613a26f205b2cde97a322cfe6a5534821d6d22ef91dac42f7d8bcbb098e8f1bedb8948a8401049e6dfb33", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752358, "uuid": "83fa6e50-1f6e-4496-8335-542008afaa6c", "value": "T1F92523119FC87472CD742F3458F643831A75FDA2DEA5A32A2708A4791D727D0A8363AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752358, "uuid": "6a3d0245-877f-4ec5-9eb2-1de754e21645", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752358, "uuid": "26f009b1-27e0-413d-99d9-60c341b6a2d1", "value": "12288:ZMrfy90xtnJcs51rvCJz14IH4JZ01Rq+MAA3JDI+ATkoy5ugEon5GPSZB2HTpYZV:6yecao14IH40HqzAmzAToWjCsCZCFHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752358, "uuid": "71970730-848b-4fc4-959b-10fb4ed492b6", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752358, "uuid": "92edb185-91e3-44ee-a8f5-ba48865e424f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752358, "uuid": "b93922e2-93ea-427b-b38f-741ebfc4c270", "value": "changer569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c309f1b-f896-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684755912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755912, "uuid": "a7f82f8a-d8b6-427a-ad1a-6f1e0e2ce4e0", "comment": "Malware payload", "value": "4499b3a5b82e748112e760b8efa61845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755912, "uuid": "ee664563-be78-40f6-9f77-15c73c3a22bb", "comment": "Malware payload", "value": "f85201212fe7abd6d4b2f9dfa90fe181c7437239436450cee10698ca7d56b1ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755912, "uuid": "6aabc890-8c06-41bf-bfbb-652ad916e094", "comment": "Malware payload", "value": "8bd128f295104e22e91cb99e27d4e311c475fffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755912, "uuid": "23501b7a-0bee-4cfa-9e15-8347fe17d365", "comment": "Malware payload", "value": "4b575467b4ec6a779669519022e26a5693898a03823d110502e9406f2d3442b7f46c85abef1ea9e9ef92ed9110f3a7a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755912, "uuid": "68623ae7-865e-4afb-b125-862464614c7a", "value": "T1E70419B1B3C344B2FAA615F0031A277AAA24EF3D47139BDB1754C94A44222D1FF7A64D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755912, "uuid": "1a5289bc-c01b-4e56-8d4f-0ef9c8e18a16", "value": "3e77c3e3fa0ce99c83d31d3cab555757", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755912, "uuid": "87956afa-0479-4c65-9e46-88865e18431b", "value": "3072:34Xf7E09saf5QnFKW4Oq5iyDuH/OklVtnOE5CN4Ig5:4f7E03IbaolqEsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755912, "uuid": "23b56ac0-c958-4cb1-ad3d-17bcdbbea95b", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755912, "uuid": "5c1efd87-fa9e-4601-b949-d0886869794a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755912, "uuid": "9eff4d07-0da6-4853-98f7-4fd9a0032776", "value": "SecuriteInfo.com.Program.RemoteAdmin.13953.3132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acf99eb-f87c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684744903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744903, "uuid": "1b0ecdf4-e3a1-427f-8bf4-6f155211027b", "comment": "Malware payload (AgentTesla)", "value": "c460a03f63c3c77e60c5af1f792ac6d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744903, "uuid": "7a154a75-5653-4b36-8472-ee4e7010e6b9", "comment": "Malware payload (AgentTesla)", "value": "f89021befe6118964b05a284f93655371379e3cd86803b5659b62b35a1bba290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744903, "uuid": "0240be2f-b40d-455f-9889-50d2cdcf80d3", "comment": "Malware payload (AgentTesla)", "value": "6ee8a67afdac5a6fd9e4645626685105a5c84f76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684744903, "uuid": "e58ddcdb-cf63-42f5-83e9-e73d8b03090d", "comment": "Malware payload (AgentTesla)", "value": "77d8b3b541d6f70e54c737e998c00f8aeafa4968a6c21588791272b411e862e5c6e4e0440d60058d6944046762799fc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744903, "uuid": "ab680969-cf23-4c02-bf18-0a2d152a05c8", "value": "T17CF2295EE79F02A48F5113B2631B1E89A6BDB22DB35051B1386C833433EDC7D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744903, "uuid": "2247a28f-d248-4bd0-bdbb-02b366361f8c", "value": "768:RFx0XaIsnPRIa4fwJMlrCGlJhly6C31e2XKMuS2:Rf0Xvx3EMlrCD6ee2XKDS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684744903, "uuid": "bf0b0a44-4a91-4226-a558-21fac50017b4", "value": 34397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684744903, "uuid": "8fe472d5-8cf4-4e40-b495-181054421b72", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684744903, "uuid": "ffe49ad7-7afe-41ca-9ab9-267d635ec5fc", "value": "Order PO688930021178.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a7d028-f8ad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pikabot)", "timestamp": 1684766123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766123, "uuid": "d6497a56-fb01-4d5e-8357-9c116097d905", "comment": "Malware payload (Pikabot)", "value": "1862a5acea6e4a61b07862e74fb68e14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766123, "uuid": "d5799a6b-4342-445b-a6da-9c432438a4de", "comment": "Malware payload (Pikabot)", "value": "f89c54a410d1de9f9d05217831e651db77627a6d93e95dfeb6d0385fe951555a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766123, "uuid": "0fcdb2ec-0617-4862-ab32-eed01d5b3d80", "comment": "Malware payload (Pikabot)", "value": "313561041922d23d1149b22f72eecf0149b0f547", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684766123, "uuid": "26107758-eadd-4627-a63f-ff9d4e9e82e4", "comment": "Malware payload (Pikabot)", "value": "53fe5d08ef9af44d86ae3bbf8ca6d5d8c845d9103e32b1617028baf2924699636e120453fc67da9a6bf5ee1bc04fe048", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766123, "uuid": "095de634-8cd6-43cb-bb5a-bb89fbfb0046", "value": "T123C4F064AF25C874F6EE02FC21392F45A82F50929B211DD7A7555E0E9A256C3EFBC303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766123, "uuid": "bde5d856-64b5-4cc2-ba8f-ceb691f4f295", "value": "e57923ac05f8cacef874991aaef87b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766123, "uuid": "3266159d-da1c-4554-b725-93d841f3dc80", "value": "12288:f67mo2xmrRgC9+JiEWpOp9VTOvqUDVKeQQGtTzqz:C7RrRJ9+b6MTTOvqUDbQQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684766123, "uuid": "c2948834-c95d-49f0-948c-ef79db5f7b39", "value": 562374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684766123, "uuid": "aaa58c62-a890-4ecf-a777-a89f0be37464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684766123, "uuid": "ab7d007e-e016-4bc9-95f1-dcd60554a952", "value": "splenativeDeterminative.SilviculturistGallantry.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ada8c20-f88c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684751775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751775, "uuid": "bcb78952-45c4-4f59-97af-d26ead269147", "comment": "Malware payload (Amadey)", "value": "c6d25d13abbbc4e63d87427f07657518", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751775, "uuid": "e09a54b4-f7cf-49b4-ad07-730f00c68d08", "comment": "Malware payload (Amadey)", "value": "f8aca976c674e1600c014f4b2f0e9f1754ec38b78caefbbc0b2f43d791641063", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751775, "uuid": "f01d4135-e2e5-48a5-93ca-c368b4588f1e", "comment": "Malware payload (Amadey)", "value": "36d55497f8a6c745c0eb85f56ab689ed1321e16d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684751775, "uuid": "4af09798-7571-4bf4-94cf-48960176e8d2", "comment": "Malware payload (Amadey)", "value": "fcde7e1c0b9d1bd88f118034861447bad1df4f5b07e91ac5a12659a6541dab60975f71e645e6c69f38d4062fb3a12e5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751775, "uuid": "e237530a-98a6-4398-a817-cc79ecdf7cce", "value": "T1E7252327A7C28575E8F41F35ACB512830B757EA1897D82623B84ED1A9C73992F13133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751775, "uuid": "2b5b609a-b9cb-4da5-b402-ec60e555d525", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751775, "uuid": "432b6a01-80f0-4893-b07b-6eead5f94be7", "value": "24576:ayqkY1h7acNyZn/5EumCETBMvecsZKPVh6Tzz4jT5:hzY1QAytRE3MvJ6T4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684751775, "uuid": "1a18a122-3fcb-4250-9d96-37ae4d618452", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684751775, "uuid": "853c4b73-1997-4918-9d67-9b27c4b3633b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684751775, "uuid": "33cc0c23-0d5b-4b3d-8c62-9b0ecb1edd01", "value": "353512274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3097af-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752424, "uuid": "a97b2f97-34a1-4165-b847-3933fb744eef", "comment": "Malware payload (RedLineStealer)", "value": "52f8829e5f8860232f32545167113b01", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752424, "uuid": "cbd318e2-473a-43d6-8737-63ae1f519270", "comment": "Malware payload (RedLineStealer)", "value": "f8f605cc1595ec322d907bb8db8e6959c84f51382f9fa81d929c2e5bec60a902", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752424, "uuid": "c17cdb9e-97b3-40b0-9c33-1eb5503d9032", "comment": "Malware payload (RedLineStealer)", "value": "86d469bca1632fa3479e26f074f7f45e4a1a533e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752424, "uuid": "3b497dce-acdc-4d12-b0cd-04977a928f95", "comment": "Malware payload (RedLineStealer)", "value": "257cb0351243250fcff53743863d340b493d17f73f32272d630c75e2f17649310f2a3d3fd9c13e440046f808da9e3834", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752424, "uuid": "1991e7cf-e6ef-4c81-bbaf-461fa907d206", "value": "T19E252312A7DCA5B1ECB06FB459F762831B39BCD08E70962A36C8F95B4CB31914432767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752424, "uuid": "1a98a480-ddcb-4e91-85e2-926d1a18b6c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752424, "uuid": "c2b5b560-1de0-4739-974f-733ba6cc0f67", "value": "24576:by3oofoauArUdOqwCfZxrdM2vUZxI9qm8ZIW:OHoauAr8OqvfPdLMZxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752424, "uuid": "d9a9607f-af64-45d8-abda-1f688e9c289d", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752424, "uuid": "6c7abdb9-da7c-4e24-9a5c-c96202e8d170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752424, "uuid": "ec27939a-a4bd-4240-b9c5-dff8e376803e", "value": "file775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db32b269-f883-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684748072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748072, "uuid": "98d1efc7-ec44-41fd-92ec-8a92f910924e", "comment": "Malware payload (RedLineStealer)", "value": "2e43b7c5652a71f5873addb3f74ea937", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748072, "uuid": "d9016ea3-c3ec-4bd8-b76e-36f87c934b98", "comment": "Malware payload (RedLineStealer)", "value": "f8fea01bda14147cf04584de4fd2f396ff90f7bf5f0f8e0dc01c1ab3dfee1d4e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748072, "uuid": "96790cde-48b5-4eb5-a6a4-7980a0ef9f24", "comment": "Malware payload (RedLineStealer)", "value": "7b47addf0f13edfbc0ac6db7154fbf56f814d15d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684748072, "uuid": "914dcd70-7952-49bf-b31f-c78541da8d02", "comment": "Malware payload (RedLineStealer)", "value": "298917c0fc2bc161889398d876318eec38a7b2663daccc316fe37d872c250d5b1f4b22d19796f3fc370ff84a9cc3af73", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748072, "uuid": "bd472393-d35f-4146-8a9f-4ce1946a1e65", "value": "T1C6252356A3D46037DDA027B418F926E30B36FDA09D74979E23A5D82F0D72950E83137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748072, "uuid": "1b3054b9-f98b-44d9-bfbd-7f98ed6da4ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748072, "uuid": "d14f6c7f-9958-4650-bdf5-82c1337e71c0", "value": "24576:byEOE5huoR+2v3WYh2PD8SCdo0EOOWPdUZqUSs:OEp5huoRmYQPD8Sco0EOZKsUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684748072, "uuid": "537a4f6f-8032-4a52-8395-3e9a2a7cf11a", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684748072, "uuid": "2a9a68f0-de51-4b1e-a6a2-7b6033d67b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684748072, "uuid": "fc2b57f5-546b-466c-add3-b3c846f9c0a3", "value": "viewer738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfb925c-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752316, "uuid": "3fc9d502-c78d-4f9c-b970-adab432fb72a", "comment": "Malware payload (RedLineStealer)", "value": "403fd8ff69f90ef514123b2d6663e1e5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752316, "uuid": "203cec41-e829-4ec5-b3e5-bcb8c819475e", "comment": "Malware payload (RedLineStealer)", "value": "f986b311823696f04aa59fe89ec8c78ee7c9ad539682f1875e439364ad6f3245", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752316, "uuid": "c3363adf-0125-4d4f-8b5c-389aaff8c3f1", "comment": "Malware payload (RedLineStealer)", "value": "8f40c6df1f5f81ce479c41ec7877b40370ab53a0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752316, "uuid": "8748c35d-aaac-4afb-b4fe-e2fd100e4099", "comment": "Malware payload (RedLineStealer)", "value": "a87b427064726e70cd12e75b99bb4493dc4c218bd1347eb62e76863751bea0a35da4ca348b84549092846c6a8e9121a7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752316, "uuid": "6eee5737-7978-4ae0-a363-67d10463f777", "value": "T1F4252307DBE4E576D8B523B098F642C70A307DB28E78E32F2291969F5F73580583179A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752316, "uuid": "5c90afc9-83d1-4c2f-a1ba-80ee18dff87e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752316, "uuid": "74ca3f5f-59f0-4471-8033-16f23589818b", "value": "24576:rykt4C89hMVquvg1jJsmA9HZ5MBg8EFYa:ekt4C8UVquAjJXA9HZ5d8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752316, "uuid": "79517466-0025-4e8b-9dbd-fe733ee106bf", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752316, "uuid": "805c16b3-995c-47c6-a056-7423b547e454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752316, "uuid": "d7bd0739-bd14-4491-8289-167cc973e92f", "value": "Unlock602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b0c0dd-f894-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1684755253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755253, "uuid": "d492a7b1-91e5-4e01-b453-f88565fe9b17", "comment": "Malware payload (RecordBreaker)", "value": "b1cd27c89da9066af4bf5a3fef881db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755253, "uuid": "b3fc9fb3-174d-4456-858c-9ae29ad024ba", "comment": "Malware payload (RecordBreaker)", "value": "fa8a2d2416b64e351ff6a3fb2a1466c1afd3cfb9f26292243aa6f42d17cf395c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755253, "uuid": "69235e0d-52e2-4840-b5f6-7f1449d8995a", "comment": "Malware payload (RecordBreaker)", "value": "7742b7ed82046645f3589f1cec24ca489bfad1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684755253, "uuid": "fb6b192b-5ac2-4b9d-8bfc-c4e89b285319", "comment": "Malware payload (RecordBreaker)", "value": "e0f82e2e63214329cf17fab1fe82c8551f12ac42964bb3e671ed12a370c0771deb70c409df73fd5a641ca2b268b094e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755253, "uuid": "ff72f0b7-099a-461a-886c-17e8dd1fac1a", "value": "T1B8A6F03E5AE15133D4B3C976C9B2AED6F9B6221736419C6E90D71BC11C13BA37E9200E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755253, "uuid": "5d1e842c-ea70-4140-8955-4782cd06ebdb", "value": "3ca41e6b13e51d030a4336b9e807dc18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755253, "uuid": "9fc6cfb6-1fa7-45d2-a6bd-32c423811527", "value": "196608:H64vbRoSTIX3JgxzJLInentj7freItG5A7GAemY04Mur5VW1+LJrDLmZ:H6wdZcuvInenteCMAhemYYGy1+LQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684755253, "uuid": "5ca9a75c-6249-4acb-85aa-78a5c26b7845", "value": 9957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684755253, "uuid": "53196bba-48d2-4c20-854c-424dc293bc37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684755253, "uuid": "86970745-a9ba-438b-ae78-d6ddb7e35ce1", "value": "fa8a2d2416b64e351ff6a3fb2a1466c1afd3cfb9f26292243aa6f42d17cf395c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e7b932-f871-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684740016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740016, "uuid": "bc3f2977-edcb-40c6-8d3b-2a1e8b60bcd2", "comment": "Malware payload (RedLineStealer)", "value": "3ae7dac6ca8b29a90f6dd33b0220d352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740016, "uuid": "36227502-7c15-4def-8575-40639662ec89", "comment": "Malware payload (RedLineStealer)", "value": "fb5f11711efc34430a76891605b673742a3f15dbc5db2263df71afb0a28ee308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740016, "uuid": "0f18c3b6-c493-47b1-8e41-f2df16c66f81", "comment": "Malware payload (RedLineStealer)", "value": "3ab3a88047134b09beab306d213b8e7345929838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684740016, "uuid": "1b883003-e73f-400f-8207-db2e9cc7353b", "comment": "Malware payload (RedLineStealer)", "value": "c2cd0469cf0776c2c49fa8081f743925882c591d2a6003ee217f816a4bab42389493f51463ec20e242f34ac64fc518f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740016, "uuid": "94766279-c417-4359-a239-4d6c7b18fec8", "value": "T13B25231267D94977ECF0237049F703931A72FD91DA70CA6B22826A2F4E32640D5B57BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740016, "uuid": "76129a4c-b375-42a1-8750-e8656619e2a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740016, "uuid": "71468294-670b-4bc3-bb6c-3742e0a8bfba", "value": "24576:syG9Vis3FNPWnvqJqwT3tnEh9DjHv4fFsRo7D:bmks3revqJlnEfw9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684740016, "uuid": "60c7ab33-eaab-4c81-8520-41a6d2f8c5bd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684740016, "uuid": "04f7323c-bc7c-4f5d-99f4-f386d55c150c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684740016, "uuid": "41099b40-fa43-4ab9-ac15-365720e256e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1af6b3-f8a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1684763721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763721, "uuid": "7fc05edc-fd77-488b-b263-f4f0aa86fa5d", "comment": "Malware payload (QuasarRAT)", "value": "b16d9a488d91cad20084d64c7cdcf356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763721, "uuid": "7e0fd526-279a-4241-b0d7-adebff2039a6", "comment": "Malware payload (QuasarRAT)", "value": "fbb8623e06fa0ae61b4c276c785fc262a4ae5c1a1709b17d63960d41c79e0dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763721, "uuid": "2bc15649-ada2-41bd-ba5d-2c8810e3d261", "comment": "Malware payload (QuasarRAT)", "value": "b05704e9388d9800cbfbc9b2f9f59d9a87bdb497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684763721, "uuid": "730d63a5-f6e1-4a52-8b22-d9a3e849e95f", "comment": "Malware payload (QuasarRAT)", "value": "fa96435eaceb63d8e5b63c2a60995175bb715d29219292bfa23591c5cbe279ef6effa15333db6826aa0b9bfa456aadcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763721, "uuid": "367ce349-8153-445d-93b0-fe3300b675cc", "value": "T19C83229A639F5F53C2C121B0367910DD7AD4FDC4C82D32BBD196A4060F8ADED895A83B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763721, "uuid": "ef922bea-3fa4-4363-9467-b193245e7c08", "value": "1536:HDzavlhLzteVHMB/LZ78qgWABKJQYgTHa7qdkTWNAGRYp4xfi8MK9L+fqA:HbgK9L+fqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684763721, "uuid": "26a85bed-f723-481f-9506-a05dcae32ed2", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684763721, "uuid": "6c967893-a456-47f5-bf1d-40086029744b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684763721, "uuid": "fef37476-c25f-405b-9456-7d88afc4231c", "value": "b16d9a488d91cad20084d64c7cdcf356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a882df-f88e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752486, "uuid": "c57e8cd2-1f8d-489c-9ec7-bb787798b2ed", "comment": "Malware payload (RedLineStealer)", "value": "aae23f5501f4e4354fa646e4ee1dbc91", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752486, "uuid": "963a2c2f-31e4-4043-857a-86f844d6daf0", "comment": "Malware payload (RedLineStealer)", "value": "fbd3b3ad7dee596fd4982d5b478f58160811fff8174efeac9cf9c759ab621af8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752486, "uuid": "a14a94f2-072e-4109-89be-d065c8aab104", "comment": "Malware payload (RedLineStealer)", "value": "2592bd56949f210f49d574af341b63509e84bf4c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752486, "uuid": "b4d4a44e-7c3b-4db2-a0a5-9da48e24292c", "comment": "Malware payload (RedLineStealer)", "value": "3bdfd5d6d924f758fec1ad184422e136ff0d393c9ef3021e1745add1650433fb5c805ade19583295cff0802fd088d813", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752486, "uuid": "92300db1-300f-4fc7-8c4f-42e4ca956e5f", "value": "T115252303A6D85171DCF5633094F703530B3EBCA20E399B5B3BC6599A4D73AA4A672372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752486, "uuid": "33a5983f-bdd6-466f-9d63-c36520802cfc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752486, "uuid": "04fbf4a6-a7a9-457a-b697-6a716b0d77e4", "value": "24576:Zy2oWU0euopPg4xqIKXrdXsOrCQxEAFgEtvE:MbEKo4xqjdXGQJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752486, "uuid": "616ab4bd-499c-4b26-a532-c417c9b5f1d8", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752486, "uuid": "d2e82c22-24d4-4e67-9c4f-db53799b5f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752486, "uuid": "43e148a5-51ff-4f13-93fb-c75baf6e2066", "value": "manager436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f1cbbf-f86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684738265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738265, "uuid": "b1926a37-c355-4610-8cd3-249255fdb7c9", "comment": "Malware payload (TeamBot)", "value": "6fc11e13ff0e516592aaf7d2ba128caa", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738265, "uuid": "6ad4c0d8-2e6f-4564-88d5-48b99f3ec1ea", "comment": "Malware payload (TeamBot)", "value": "fc1be6a0fc7f924b095628ac544fb76032195cd85c43335c9ffbd8c806426238", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738265, "uuid": "2b347a73-2ece-41b1-831a-ae14e6cff60b", "comment": "Malware payload (TeamBot)", "value": "d931f27a71f4967df2d1c31c9981fc65c9d1a9ea", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684738265, "uuid": "24b86a14-0545-4cc7-9c10-1f90d1180fb8", "comment": "Malware payload (TeamBot)", "value": "52552fd6c83a77b59bbd68b865690e45f912919592f898c10812736aa2284fc000c0e4c9751f830a83ee14c37a5c797c", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738265, "uuid": "34a7fe9f-0c0e-4dc0-9a4e-4e585786c80e", "value": "T13524C02176D1C032F26316344AB6C6A55B3BBCB16BB169CF2BC0067E4F752D2CA78356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738265, "uuid": "e0f51fa8-c9c2-4661-99d6-201a000e00c1", "value": "97d476407c8713e8d8094dcaf80101c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738265, "uuid": "219c0f33-414e-4d93-b983-eaed010dacd4", "value": "3072:r4fbkJHulLhvhvkAgGUqQOjoa1Zk+xU0MP4p1x+MdAbsL:cTaAhsAlQCoAZkD0hn+Mdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684738265, "uuid": "6dd60734-bf69-45dd-86f7-ddf7769f1ddb", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684738265, "uuid": "d5fd9a56-bc31-4f05-84ba-be609d8facea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684738265, "uuid": "71d9e7cb-8dac-45c7-a42d-1f5f627c2c85", "value": "generator707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8c82b7-f8cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684779558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779558, "uuid": "bdc51f06-d5ea-46c1-8292-90c59d849ff0", "comment": "Malware payload (Formbook)", "value": "10b5d2457bff0e263f3a306a87857e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779558, "uuid": "29a4b2eb-a1c8-433a-a004-b1aa310f01ee", "comment": "Malware payload (Formbook)", "value": "fcabc2e435d451a512f1fdd1b9425ddc3d336812d4b33d1ccaaab42e8e752fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779558, "uuid": "1f24f381-930f-4fc9-ad90-04d96aa53690", "comment": "Malware payload (Formbook)", "value": "a83be6fbaed453bd86384c8ede9211284e3f4f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684779558, "uuid": "2122e652-feb9-4fcf-8b79-3a88b5d2afcc", "comment": "Malware payload (Formbook)", "value": "7b7da10f74a38d2ad43f70d55dc97e68a578059b604492533e2c8a59921e2ba03caff4da6cac7da5db7b1ed609537372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779558, "uuid": "5523af6e-bfce-4472-91f4-5e94b15d0e27", "value": "T170F4F1D166988C14F5AA5FB91AE7E23403B4BCA1EB27C34A64E41C4F7C56B823B017D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779558, "uuid": "2930b9c7-9617-493d-bfc1-a1fa3af7d59c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779558, "uuid": "f236448b-1c8e-41df-a40a-494e94e990cb", "value": "12288:nTex0YPX/NqPsoPp9w29IoGf+0OV+eFt7xoCVqQBx36mSoy7p1J1LFx:nT1HPsoPp++MYt7xoC1Bx3vSoy7HJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684779558, "uuid": "3f56fba7-31e9-482c-863c-53b4ba04f3ee", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684779558, "uuid": "bb2791ca-9524-4783-bb1b-2e8f62e68066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684779558, "uuid": "9ab591a8-83ef-4549-89c5-c142ccc8f37d", "value": "PRICE ENQUIRY, ENQ REF-LPRN- 20221096_PDF___.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80013610-f88d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684752213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752213, "uuid": "81a573fc-6041-448c-ad8a-4ce38e0ee32c", "comment": "Malware payload (RedLineStealer)", "value": "35e40208deea22a052d1305b4b032bd1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752213, "uuid": "84360063-1ba9-4ab7-96e4-0d012cb045c5", "comment": "Malware payload (RedLineStealer)", "value": "fcb99fb8b8f5e4674a95b7a2c932a2f80151803199a9f2be8355638589b4f19d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752213, "uuid": "389246e5-2c33-43a8-90ae-5023f42ade2c", "comment": "Malware payload (RedLineStealer)", "value": "703e713879b6ad5641d5f2191443e8f226303b1d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684752213, "uuid": "374814e7-4ab2-4a9a-afb8-c54db65c738a", "comment": "Malware payload (RedLineStealer)", "value": "13d41541cf6fa152986b4de8af491146d734ab6bcba286f282f73ae04e9c16e0ca53c98f683efbf31b6edd90143e5b85", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752213, "uuid": "9ad06617-7279-49e8-a3c3-063e0c0f7192", "value": "T13F252323DECD4563ECA867B04CF266530A347EE11C78965F224AEB592C71A88857733F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752213, "uuid": "bb9e7a30-8fb8-4a41-b9d1-72f80096c4b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752213, "uuid": "814162d9-c02d-4914-9601-059f93f4dfe6", "value": "24576:Hyy0x95gLBLZhDK6dmLrwXVPSNVAfjG+tcCBuwc0/WF2zKZNQs:Stj+LJSL+VA0GGcTwc/F2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684752213, "uuid": "b21fc1e1-16f8-434f-9714-768ceae2d120", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684752213, "uuid": "41920db2-610c-44b2-a35c-76c0d74385ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684752213, "uuid": "77463171-173a-40cc-9111-f8b861c87cf2", "value": "24468682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca66284-f892-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684754570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754570, "uuid": "38bb9fed-dcaf-4810-87d5-4922e0d85cc6", "comment": "Malware payload (Mirai)", "value": "27b52c60712713f0d5f67005794a2ef2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754570, "uuid": "b6b0c00c-1fd8-4b6f-8a0b-efb1af1ed613", "comment": "Malware payload (Mirai)", "value": "fcf1a2fcc4bf6cac4ad06d3e128aeabb0ddc59130737687345a6bfa69ca228dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754570, "uuid": "78819072-c21a-4a71-a757-099e235a0312", "comment": "Malware payload (Mirai)", "value": "a93a36709a0108d5ddd61a7433040f1296df99d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754570, "uuid": "45d12c1a-2b7b-4a27-8c17-920a421b1864", "comment": "Malware payload (Mirai)", "value": "495a997cf08f38bc0bab8fccd67bc8702f3f630d3f5f15949124a11c6c952a3af33ea6db40fe5488ccec9166a489dc6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754570, "uuid": "ed1a7714-89f7-44df-a56f-f1756ff39106", "value": "T1EAA3D71AAB610FF7E8ABDC3349E91B0529CC551B21B97B757530D828F18B24F86E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754570, "uuid": "fbe92768-775b-4f9a-8317-fb50eea2f907", "value": "3072:DIx6ko5im4PiFrQcKuGRAHeLzMzkPjW83ildYYq:ko5r4PKrQJFRrjbSldYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684754570, "uuid": "a110ddb6-2892-4989-976d-bd1c251e536a", "value": 100480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684754570, "uuid": "d7448f46-81cc-4b78-b599-9025a4019fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754570, "uuid": "431a4fa3-220c-4867-8c9f-2c0ec5a17314", "value": "27b52c60712713f0d5f67005794a2ef2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bf13a9-f893-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684754590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754590, "uuid": "e19362af-8983-4108-85ea-c184050d54fd", "comment": "Malware payload (Mirai)", "value": "7d6b994b3863c5f8e94d5c9764df9ec6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754590, "uuid": "79c77640-5e52-4185-8486-d65f1bfa6efe", "comment": "Malware payload (Mirai)", "value": "fd4e7dff7bc9e7db77ad11bd24f36e5dd0930572b01a57d7497d28a371eefd16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754590, "uuid": "6aa742eb-df14-4e74-8be7-c88ea32e83bb", "comment": "Malware payload (Mirai)", "value": "5b428ccefb1d6e4e5a637bf89502756bbfb55b25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684754590, "uuid": "8a7387ef-adbb-404e-8635-23c3c6b3a47e", "comment": "Malware payload (Mirai)", "value": "d04766aca7e6d5f451f7a927d289c06effa151d968a40125177e2d068c57bd5c5079fd33be24ec1b7e855c4ca3be0977", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754590, "uuid": "dec33603-f3db-4f43-8b5c-b4804dc0b9f5", "value": "T131530A95BC91663AC2D023BBDE6F114E335193E8D0DE3253CC280BA5778A94F4D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754590, "uuid": "0e3cd55c-fd9f-4293-a6de-2357a1c1aac8", "value": "1536:DcE6Qbg826COpRNoQEJ+pXWHIVdxWRBqg5PX51ti33:DcE6V826COCKQHIVcqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684754590, "uuid": "932f4aee-1836-4ee3-a9d2-ec141281d97b", "value": 62820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684754590, "uuid": "050728e8-da06-4221-bc89-72bb6237656a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684754590, "uuid": "f0dcecb4-aee1-4c1b-b0ee-e523e62037c8", "value": "7d6b994b3863c5f8e94d5c9764df9ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6979290d-f86b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684737573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737573, "uuid": "a1c29b57-5444-420b-8d22-c400e4f5cee1", "comment": "Malware payload (Amadey)", "value": "32184510fb6c09ce43703f2c6242b3e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737573, "uuid": "9988de2b-0be5-4017-8878-12ae3ffea349", "comment": "Malware payload (Amadey)", "value": "ff1f0c9824d0b69c9bde099fd13863d5be65445ceb52d6d3e5685821e1ba2ca1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737573, "uuid": "2d6a869b-2afe-4db9-b2e5-9e3432fe4964", "comment": "Malware payload (Amadey)", "value": "56f3932a78b77a69f036b84491c2178fa9d94922", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684737573, "uuid": "c52dacd8-eb37-4420-bac6-fae4290a7c32", "comment": "Malware payload (Amadey)", "value": "bf525abf2b3bd557d35f3d67f136f5359f9f0c98a1ab5ec7b253521b453ecbecc5fe86108fec14972677d6d270339492", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737573, "uuid": "e3e74cc6-624f-4f96-b152-1bf6915b4629", "value": "T1882523069BF854B7CEE13B74CCF21647173778A2A870579F1390A88B69B3294E576323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737573, "uuid": "ec92a76a-8a64-460e-bae6-d040d7d97217", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737573, "uuid": "2903a015-e5dc-4b06-974d-548005eaf92a", "value": "24576:JyAU93TQZblIcxSQ2mX4Q9IZRst5JsvLPTgxOEI:8AwTQ5SQP4KIvsJeLPTgxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684737573, "uuid": "8b649256-ae68-4014-9f28-d073198c98b5", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684737573, "uuid": "d13758af-5313-4379-a009-46fbb992fc35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684737573, "uuid": "bdc0747b-4ed5-46f5-8fa2-8733c56c02fd", "value": "physics657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }