{ "Event": { "published": true, "date": "2021-07-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-06", "timestamp": 1625616182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "21886650-cecc-409a-b127-adb41ec90884", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed5c243-de31-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625559080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559080, "uuid": "700d4fae-31f0-4a55-bc1b-13318a6b07df", "comment": "Malware payload", "value": "40253c4885c52237755e64dc8ca6e423", "object_relation": "md5", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559080, "uuid": "570275f5-36ba-4eea-b401-edcb66ae0768", "comment": "Malware payload", "value": "00946462797de8e5636676060439d06adb4878ab1472db5c16972b2074a0400f", "object_relation": "sha256", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559080, "uuid": "3453dde8-a33b-4a0e-a6fb-7e57c8c94c42", "comment": "Malware payload", "value": "198eb007add2d533ab938e6dd7998c87289c0abd", "object_relation": "sha1", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559080, "uuid": "e4ba3310-1991-4a5e-9f8c-8241ddeb8e33", "comment": "Malware payload", "value": "3e87086e70cd94b82470d419a211a2acc92fe19216ce296c6836b05990ee77bf3a0876a1c5638374eb08020d2bb13a71", "object_relation": "sha3-384", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559080, "uuid": "dfb6fe3d-a2b4-48fa-9184-d29fe897ff59", "value": "0413E10DC7137C65DA2AD4BCD1A469F2E6AC199AC901A2881FB0D65E0F605034FEF4DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559080, "uuid": "bbda37f6-e0a6-43c8-b228-6b8ae2f50f26", "value": "768:YTa43VKayRzkZb2Aautwbcj+bYCVIji1qXiJB57ZXNGN0me+nDEoT:YTyayRAZTavwj+bYNSJHNds3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625559080, "uuid": "ebf687f1-de6b-4177-8482-a47563f6e865", "value": 42240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625559080, "uuid": "e53d88ed-76a0-4ec5-9dc5-7099aab9c7de", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559080, "uuid": "9c40ba94-3d99-4236-b5b6-a517cc9ba8c0", "value": "sample20210706-01.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9f6d36-de63-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625580388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580388, "uuid": "f6832c86-d951-4f72-bc0a-47b8af9a2f64", "comment": "Malware payload (IcedID)", "value": "e61d872e6bd0ba19d435dae638168034", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580388, "uuid": "54246b5c-6bb3-4f19-aa1c-e1ba44cba6ff", "comment": "Malware payload (IcedID)", "value": "00c91b1844e31811f8a2ebd9047cc093a955437c700844f7a72bd6d54b73c602", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580388, "uuid": "cc103ecb-e9f8-4784-9b36-aa42d222a1e3", "comment": "Malware payload (IcedID)", "value": "939842aa615def586067f03e12fefbc0f6952d57", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580388, "uuid": "19277ca3-ec74-48d3-9e2c-022d11febb63", "comment": "Malware payload (IcedID)", "value": "1c05fb7617c7d0a37235bfebd415437b7c75e6e27fffee1b6375f1821b89ffd0f60217e7b9ac55557ccbe5383bbb925b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580388, "uuid": "e978ec8e-7b24-4675-bb2e-7289d0d048df", "value": "62040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580388, "uuid": "26d66a4c-245d-47d9-9f2a-d40b207a705d", "value": "3072:UDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:+RcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625580388, "uuid": "6f5baaf5-96e1-4e1e-9b82-f6c748245161", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625580388, "uuid": "8827a4aa-8ebb-4a7e-acfa-92194351f5bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580388, "uuid": "e9e73dda-c21d-4a76-8c88-7c1dc756b458", "value": "uhr908723097306.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6713eea-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625556059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556059, "uuid": "b6cdb96b-2170-4286-beaf-c1db6a6dba21", "comment": "Malware payload (Loki)", "value": "81a072e5cd5667b0d5bc4761b406092e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556059, "uuid": "3907f5a9-a4f2-4c5d-ab53-d7fd044fc633", "comment": "Malware payload (Loki)", "value": "0163f04792cbec67b028f5deb577699dc4c645308d702da0e555cf325f043d53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556059, "uuid": "3bdbd142-7bd1-4913-bd3e-17343792ec1b", "comment": "Malware payload (Loki)", "value": "9d37db061072d5223a54ad11ffe5ea612a3fbcf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556059, "uuid": "8393aa34-43dd-4b8d-ae7c-8ff9470b2ba1", "comment": "Malware payload (Loki)", "value": "45c65e44a5350faecbb949d286f13f6206e80cf59ed6eee194a1f023fb92cd86384324b0080c0df268addf1f4a968b7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556059, "uuid": "e451243a-61db-4290-a19d-87066d6a2d03", "value": "8A558D3576729F91D87FC7384732E13C4FB5AE26E217E6746CE8788B24B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556059, "uuid": "50e3380a-7e54-46b1-99bb-5edf25a291bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556059, "uuid": "87e222fa-1a4f-4d34-9e6b-82e1cb232713", "value": "12288:pe3OaIMVjLz7TPU3iOceL3gVZsZZZsZ7JshHLlzlJH+Sguhi4W5vY4Fxofq+ON5w:YqiOGatRpJH+/uhi4axX+BnfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556059, "uuid": "b8ec1d79-9677-4234-922a-e706919aca6a", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556059, "uuid": "7ace8b0e-5332-4360-8334-282322d2c202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556059, "uuid": "0e686be4-41b2-4e17-b167-06a12a816bbd", "value": "81a072e5cd5667b0d5bc4761b406092e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea969e5-de55-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625574326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574326, "uuid": "d24c0156-c11d-41e0-8e91-593c59b30d20", "comment": "Malware payload (Gozi)", "value": "6577b8581782142e658f404003f240ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574326, "uuid": "b6007a1f-dacf-4bb8-a25a-065e2d725242", "comment": "Malware payload (Gozi)", "value": "0314e12bc1cb1e046282a7933eab7e5fa7ec39c9ceaa78e233c7648904af5c28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574326, "uuid": "62d92073-bea3-4e62-9c58-42311bc340ea", "comment": "Malware payload (Gozi)", "value": "c6420b09963f9cc8db489b477238374448b11de8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574326, "uuid": "bf95f58d-a3e1-4630-8d5e-1c5f2a9e7253", "comment": "Malware payload (Gozi)", "value": "5e3762a07697fc04e18d1cbfd85641949ee8c27404ce1a1eb0f0ba324041cee564333cf7e744b22b20efba51f0af74b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574326, "uuid": "f0911537-c17b-416e-a066-1c4c54eae1c8", "value": "55048ED67D86C3EADDE3D1B01E297F9BABDBD241133C5482D7005D8A6578CD2E22920B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574326, "uuid": "7ebaa053-35c2-4127-b6a6-87363b9b112d", "value": "3e5a5960a954602a0f374a91077473ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574326, "uuid": "d343ed7a-5e2c-496a-a696-074c28f7123e", "value": "3072:x3dMfAlx6C82qlalrbnwEBQS8TxyEAJ5dtjCklcvdIwC7cP2fJN/:xNUA2OqlalrtQoEAJ5v1lcvd+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625574326, "uuid": "4646ff0f-e008-473c-be27-b9e803723f2b", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625574326, "uuid": "8e36919b-bccb-49a1-b2f7-5e1df52f7f49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574326, "uuid": "5540d0d3-ff7f-4a04-baed-91608731b138", "value": "570000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005f3917-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587966, "uuid": "0ce57ce8-01c2-41d9-a6eb-fd9ebd532a0d", "comment": "Malware payload (SnakeKeylogger)", "value": "e7b3c3562cd48e88898d9da9468b8c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587966, "uuid": "1a8c053e-61a8-4435-b245-e143ee7cb1b0", "comment": "Malware payload (SnakeKeylogger)", "value": "043c91c0f8bd07fdce3af1ccadf2afec896527684eacee91d78e7afe32173d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587966, "uuid": "71580493-c78d-430e-85e8-983a7117a530", "comment": "Malware payload (SnakeKeylogger)", "value": "f127d8f2e5fdf43aec36e01f8a69ce968ba70807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587966, "uuid": "8b511253-7a1c-4121-beec-414653da7115", "comment": "Malware payload (SnakeKeylogger)", "value": "85aee7165104b0652a18fbe155cf7fe074c900314424de7878230330a28c44914a7bc4b6b289620f8eb98edd22753ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587966, "uuid": "4c05b475-a6de-4bf8-beeb-9d0abf94d833", "value": "F0358D7572728F81EC7FC73D8331561C8FAA6F7AD356F2B96C94744A05B1B800A12A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587966, "uuid": "e1956b01-65c4-4116-9e93-f381612fb854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587966, "uuid": "c2d75f48-2050-4b68-997a-ca92ecbe2307", "value": "12288:Ba1KaIMVjLz7TDwiOceI3gVZsZZZsZGNYcAyRkAYKB6htyrol4moBaaF6zJsPuNP:liOsTAyRGKBMkUlOBaa0zaPJeeat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587966, "uuid": "af924524-c5cb-4240-af05-1cff3771052b", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587966, "uuid": "90380878-f0fd-4afc-b48b-c0c4d760806e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587966, "uuid": "bc884b81-744e-4f28-a923-cb76a0defa52", "value": "Invoice_7734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34698ac-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625550927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550927, "uuid": "c2dabc2d-d169-4a3f-b602-6e3b741ee833", "comment": "Malware payload (Loki)", "value": "55896fb2c6d92e0990cc3d513263041d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550927, "uuid": "9f61c0b3-4d9e-4808-a452-6bfff6054af3", "comment": "Malware payload (Loki)", "value": "05cd56fe80a28286dbd615aab1d23aca7a6dc7d87059cdfae4a65f337006cb38", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550927, "uuid": "63a392d2-b57b-46fc-bea3-de4b7a808768", "comment": "Malware payload (Loki)", "value": "94ec47441e93db3b90eac8a3148ce52225cbbfb1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550927, "uuid": "b6c4c46e-146c-4520-b229-d45fd87c385c", "comment": "Malware payload (Loki)", "value": "3ec4ef981c57d1c0d91856bd214c498610d8bf1b167de017cbb3da73b2a70cc4c06ac90b84277afc9fd7ac8996846ca3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550927, "uuid": "71cc808f-6564-4358-9776-517f79589cb2", "value": "8E451245AA6666C3F4A39CB5E297AB0AE11ECE6DC66D485601C1F03C353FE3742E394C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550927, "uuid": "36ec2081-0d7e-48fb-b02d-44100a0f9260", "value": "24576:zFBNGc3YlqTqeoEU/StnQUbIHKQmuGaSYvVymb7BPQfaXl8U4Z8Fax:TNRYEq8U/s3bIHKbNkvV1b72BUOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550927, "uuid": "52331b1a-3e7f-4150-a8f1-fd0d1f90d1fb", "value": 1173976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550927, "uuid": "d67d391c-14d6-4b11-8f59-986faff4a97b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550927, "uuid": "38e0baf2-0053-47a2-ad68-f9dfb6776d9f", "value": "lk1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a282537-de85-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625595015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625595015, "uuid": "69def7c1-3f6e-4c5b-b2e5-59b9bc02cca8", "comment": "Malware payload (SnakeKeylogger)", "value": "85522dedf93b183413387b60937ba822", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625595015, "uuid": "a550e233-be4c-4049-8ad9-1000b18f8567", "comment": "Malware payload (SnakeKeylogger)", "value": "0625021c787b2f711eb6fadc44856a9f001037bcb29686b910c557316bcbf212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625595015, "uuid": "aed0bbac-24c9-4e87-ae87-3bfdb80e7270", "comment": "Malware payload (SnakeKeylogger)", "value": "79a49beed68e4541cc6b32e785a20fa9afeea723", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625595015, "uuid": "3b9e13d4-5680-441a-9138-f8ff4e2f8c4b", "comment": "Malware payload (SnakeKeylogger)", "value": "16a22b063ab9563ca0acedfa6e6c301a686d0b1f6438481dccf5325957d2e2a123a4a491634f6fd95cf5e8629a67ddb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625595015, "uuid": "c6504bc4-43b8-493f-82dc-f2076d89ce5b", "value": "7AF47C7A20328F92DDBFC7394331561C4FE9A277D31BFA783DA4B4990490F464A62927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625595015, "uuid": "400cc792-f033-4c17-a8e2-a088ce953326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625595015, "uuid": "6c1275c5-626e-45ec-98ea-eb93720495d8", "value": "12288:C4720Xa6NsB1Nu2cy8EePgD7qvXmRzH2D4/BDb:F86NCNu2cye0qvXmR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625595015, "uuid": "1c4827cb-4dc5-4994-851e-ba43d2169192", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625595015, "uuid": "76653e33-f81c-4cdb-9716-74aed9ced1ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625595015, "uuid": "ded339a9-5ac2-4fc9-b54f-f60600a7fdac", "value": "85522dedf93b183413387b60937ba822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5332944c-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625586387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586387, "uuid": "0e03fe58-3459-48e4-98e4-6ed917b81ee4", "comment": "Malware payload (AgentTesla)", "value": "f01525b2b4ebb308ecc5d816e447f0e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586387, "uuid": "648a35d1-130f-4286-b338-52850f22fa42", "comment": "Malware payload (AgentTesla)", "value": "0781609c95d49539c78f3638fd03ba47f3488fc7c8c4c1b5cce3907003ad6dd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586387, "uuid": "a90be2ae-3155-4d74-9b76-5c9681e5c63c", "comment": "Malware payload (AgentTesla)", "value": "d943d79f881d088093bcb954c47be5f147210e92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586387, "uuid": "cecdcf3a-6f95-4f97-a543-d874700600ec", "comment": "Malware payload (AgentTesla)", "value": "c798c90fe982bcece1a611f0a9ac22f91df0fd8c55a2263e6d32e94c8d2ecd0510ae5c1bd3a6f15447ebac391b724061", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586387, "uuid": "7788d577-c670-4220-b891-b7d247e504c7", "value": "D984459411CB82B2E6885E4D35C0B1895A35FE9630CACC2A63AECA71DF557F62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586387, "uuid": "e12723fe-766d-4659-b2c0-045ed8b824af", "value": "3072:9rBrB2BrBjhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHchNmfhi4txeHry1oziLmNmT:bVcVj+hldzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586387, "uuid": "f21153ce-f7d7-4799-b58e-b3d9e0e9f7a5", "value": 377263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586387, "uuid": "59fb4f08-ce15-4d1d-ac44-c20d76622df4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586387, "uuid": "6c0b281d-f5c8-4245-892f-9dade020fc15", "value": "invioce.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae865579-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594271, "uuid": "993efab3-2fc5-4ef7-b111-76b5293ed8a8", "comment": "Malware payload (Mirai)", "value": "e9381141da56b9d0c15421ae8e4a03ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594271, "uuid": "c24eeab8-1cc9-4ac7-a2fb-455162d9db8f", "comment": "Malware payload (Mirai)", "value": "0ac43a3c49f59a29edc42ec554cd3af4592746240f13e297268a279f70179d8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594271, "uuid": "e3426399-5f4f-4545-8e25-c46883e265f5", "comment": "Malware payload (Mirai)", "value": "3b73a12a1d5e5099a42758fa4f85bd3fd614cc40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594271, "uuid": "0b306bd2-e18e-471d-b3f3-d46bc3d788ad", "comment": "Malware payload (Mirai)", "value": "9b332d2e144235770098512c38b33b6dfe0c052e3ae9b6bff91ec3ff7fdcbb33352ae16a11013977464e2a35f857da1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594271, "uuid": "62468b63-415e-4d9a-9834-4a2f9b95067f", "value": "47B2F18CCFB75FC1C1448333B06C4C6691F27E9E078D8A526B8C368677C592243997D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594271, "uuid": "29eb4162-2f34-44d8-a4cb-4627e6609cca", "value": "768:w/QOC0Yhn6ROHWFhYGLQNPVijNeicoGcD:w/nihneF6G8N8QohD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594271, "uuid": "7f16577a-6210-4c7c-a4b0-d5450dc5b22d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594271, "uuid": "7b66a6af-dccf-471c-a3b2-a39fe2e6433b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594271, "uuid": "0878b6ea-f0bb-4247-b109-86a20e7d2a9a", "value": "e9381141da56b9d0c15421ae8e4a03ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d47b41-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614496, "uuid": "def43167-7394-4c09-9e39-46f0a9d5a6af", "comment": "Malware payload (Mirai)", "value": "afb15401e166b5b43275bd0608fdf7af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614496, "uuid": "9463c39b-9bd6-42b7-adff-8baf662a5caf", "comment": "Malware payload (Mirai)", "value": "0b2fe35a5b3f06e1958ae5c80564789c1bf4f2c96a1dd5a274367f31b50ca44e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614496, "uuid": "c501ed6d-cb31-4692-9af4-10c91adc1a32", "comment": "Malware payload (Mirai)", "value": "5950973494057e3584e26ebc232ffd399d81068d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614496, "uuid": "04f12ddb-df8a-41df-8b80-f073a8b9f650", "comment": "Malware payload (Mirai)", "value": "711cba662d7f5692ee92e79637c2f4049c90d310b8fbd8d46bb2186e0a3e4d4efa7b0dd776fb9c739d91bd22b096c1eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614496, "uuid": "4e6a1d5d-20a5-44cc-bf13-a6b92c279508", "value": "4A7309827C816A2ACBD057BBEAAF108E3350ABE8D1DB7217CC544B5577C640F0DA7B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614496, "uuid": "21a4686d-6fc7-4f06-aea6-74bd80c674c9", "value": "1536:qZhYPc9kUEaJy8Rh1yFR/wsU8DYobz8JY30iS4NhNx9YceZWB5N/fM:UhYPc9kAJy90I7NxmcwaNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614496, "uuid": "a3938ce5-b81d-488f-a935-08830f5fa715", "value": 74968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614496, "uuid": "3dea17b7-2072-4347-9355-25483e13adb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614496, "uuid": "7ac83dc7-5696-425d-a308-a44f343099ef", "value": "afb15401e166b5b43275bd0608fdf7af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aec4883-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625549570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549570, "uuid": "bb374103-b79f-4702-9940-03277102ca02", "comment": "Malware payload (SnakeKeylogger)", "value": "6194fd6474421f2ebcc6d02b8106b65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549570, "uuid": "f4a79fa8-c3db-4612-a53b-7df2c7f0bba4", "comment": "Malware payload (SnakeKeylogger)", "value": "0b4395c59b6047b482089bbfb4e09fd11504f693f2e9f414bd4834e649405adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549570, "uuid": "3a906909-c19d-4ce8-b709-ec2725b1fc47", "comment": "Malware payload (SnakeKeylogger)", "value": "4d631f412fd82b597a764b3c97dd69c7b06e61e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549570, "uuid": "28c41bce-ec2b-498a-bcfb-5ad17c4c04fb", "comment": "Malware payload (SnakeKeylogger)", "value": "c160e32258eca0219e795c124bcd4b1be07439388b3b5a8e2f726b930d1b312e4bd86d3c4f1da7cad2b818b292ec0a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549570, "uuid": "509ca4d0-efc3-476e-9487-e6580aa05305", "value": "A4F46C993240B5DFC85BCD77C9550C60E650ACBB830BD203A49732AE9EAD59BCF152F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549570, "uuid": "a8121f18-8b3d-4d71-9d7c-542def0596d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549570, "uuid": "97862831-2584-4b4e-ad16-8706175f8118", "value": "12288:U/T+1qLDF781O1k99S+lfOFie1r88NVpOAAJvh5We3D99kIA8DdsVpblTu3m+Qk/:UCWDFw1O1k99SHFjlJAJvnl+Lurd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549570, "uuid": "64f599dd-5cd5-4d05-93eb-abb6b9b92d12", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549570, "uuid": "d6be3dde-5874-49a3-beaa-66535e0f0096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549570, "uuid": "a03fc6c2-c642-4ab1-a908-2a17c2d38e02", "value": "SWIFT COPY - Invoices 464A62042150 - 25.485\u20ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e265cf7-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625593572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593572, "uuid": "5cbef549-fa7b-4d55-bc19-f466ed4159da", "comment": "Malware payload (RedLineStealer)", "value": "11e661ed1637e12a56b4036396444ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593572, "uuid": "9d7f24bb-c1d6-4302-bc39-6a8222abd7b8", "comment": "Malware payload (RedLineStealer)", "value": "0cdc970d8e755d0cad0d351e87cc13337e19a9c2c6b8c1abf9f9d90c814e6677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593572, "uuid": "72493f13-1d1e-4f43-b91e-3e71c579bc0d", "comment": "Malware payload (RedLineStealer)", "value": "63783e8a34208d00e0f01b148644e22d79ab6d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593572, "uuid": "3fceffe9-7610-4551-83c3-083c4d972b9c", "comment": "Malware payload (RedLineStealer)", "value": "b356d96ae83e40d25458723f37362f2b3abbb5c86e622bb897b8a98df1f19243f5ce1a70b1efee7c13a91ca5a22c6828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593572, "uuid": "c4ff8f9b-f36a-4692-9fb2-a1b491555e94", "value": "D70633885D74206BC196EF306C8D9B656DC406A370E160AF7E528FCC74E7A83C9F661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593572, "uuid": "c109abe4-d5e9-4c04-be10-58cfd05ea52b", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593572, "uuid": "24315e5a-df77-4597-b1c8-e6fbbab9c139", "value": "49152:EgyhHwEzw67QGvPANlxvUxOmEtAzr7X/DZ3sm1e/hBxPRCXcymlA2bfKujj3t7/A:JYH1c5NExREM/DxsmMh3PRC3mldfP97A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593572, "uuid": "e749e1e0-1b60-4726-93fd-6e009327d5bc", "value": 3880641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593572, "uuid": "fc3fd052-521a-4219-8505-4d3f2f4a03e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593572, "uuid": "2cffad39-1457-42b3-85af-0f89e30e0559", "value": "11E661ED1637E12A56B4036396444FFB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5a59a4-de2f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625557925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557925, "uuid": "b417ad01-7e6d-4a88-855c-f5c25ae33db0", "comment": "Malware payload (SnakeKeylogger)", "value": "9174b9434f0c9ffa1922461cbe7bc1d8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557925, "uuid": "16b1b97d-d0e2-47c1-bae8-650faf0c94eb", "comment": "Malware payload (SnakeKeylogger)", "value": "0d7a9298b83d805fa2540b085ac6c1c374251340ed76cf2661feb5b967cc7623", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557925, "uuid": "dc9c8097-0127-4cc2-8f5f-2ce807039b15", "comment": "Malware payload (SnakeKeylogger)", "value": "9e767bc3c6f927b4c92104a13c604bdf947756ca", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557925, "uuid": "92771082-5dd0-45d0-96fa-23981141124d", "comment": "Malware payload (SnakeKeylogger)", "value": "72240e8a613bd0defc04b856be898f812b061c6b1132685a2c8fd9b515d03ceb4af645d747fed102c6e75cd2fc326a6a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557925, "uuid": "f81bbdb0-b807-48e0-a4d0-109c3010fe73", "value": "E11412B8F28C695D341EE9B2E13601F9B52F5C1AF47834F4896DC254D35AA2482F7933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557925, "uuid": "023aa0a3-88b5-4f95-96fe-1111b5849354", "value": "3072:DkrKoPEKisPz7oLW271/SAjPYeCWuVLreJN+qO8HWzulwKpEHJiZnkmyi7yfi+sE:DkrcMz7SAI0draNDO8HWzuiKuJ+ryilE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625557925, "uuid": "f27a0344-0172-4744-9928-e4bac1edf6d6", "value": 206981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625557925, "uuid": "3497a8f5-76fb-4e00-858d-0f7c97508e30", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557925, "uuid": "945ba407-44e0-48bd-a86c-751065fea8ee", "value": "Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c00965-de8c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625598093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598093, "uuid": "93f40dc5-1b84-40f0-8530-91643291fbe7", "comment": "Malware payload (AgentTesla)", "value": "07e7d54a2211b5d7ee78c9957946198e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598093, "uuid": "97036ab5-0786-47a4-8a56-56e35e56a88d", "comment": "Malware payload (AgentTesla)", "value": "0e899ddff1c0f02031de9a5ba0ff5d744c31c0ec2039e9750dba4f18ea72fb48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598093, "uuid": "b84a4621-2026-4b8a-8bd5-36194c9f4210", "comment": "Malware payload (AgentTesla)", "value": "7b09ff5f8810dd01d2ad47c6a611ee3e4fa633ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598093, "uuid": "e1a31274-3c5e-47ce-9229-9748c4771edc", "comment": "Malware payload (AgentTesla)", "value": "dda226a67431a2cb6b72fc485c1827e4b12b4c745536a493ba37d0df9397b9dfd535960f73f05159d4bbaefc38ff6ff5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598093, "uuid": "cb63d2f0-0c66-4cdb-899e-6676eed39cbb", "value": "7BF48CBA60738BA1DDBFC6380731EA3C0F69AE76D14BB67418C4BC5730C1B550A66927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598093, "uuid": "69d37b75-3c5c-4b30-806e-abd33b4403e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598093, "uuid": "628e3097-7198-4fac-b3cf-cdc0afb9c000", "value": "12288:9W6NsB6nXmuBE6eGdKBENYdx0LH3HUQKqB0kfhgq5iOtbhEc+/rvmo1j8CT9:c6NN2uBE0oYXHUQP+k8OtbynmTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598093, "uuid": "b1f4f2b9-bcb7-4c59-9901-8004f0357b83", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598093, "uuid": "c6be084d-1e69-4506-9b42-b50c22b3516e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598093, "uuid": "8c8b7dfb-4f41-4bec-adc9-8a2cc4ab7f25", "value": "Order PP08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39517da3-de45-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625567446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625567446, "uuid": "8b038cbf-c28f-4b44-bd14-a429bf463b2e", "comment": "Malware payload (RedLineStealer)", "value": "c40101e3f1c71b894892b4c9256cc2cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625567446, "uuid": "bfb490ee-9c22-4cc9-a517-518cb600632f", "comment": "Malware payload (RedLineStealer)", "value": "0fb61c8452f589c9ae49be6ffa4e815285dbf512d60e6bfcdec1283234a57b31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625567446, "uuid": "30c25376-7dfd-4b64-b260-163f6fbd2f55", "comment": "Malware payload (RedLineStealer)", "value": "9de1d919af7f87228c4128e66ca0505fc6368d55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625567446, "uuid": "4dc5e5e3-9d57-45c2-832a-78226a7dc8bc", "comment": "Malware payload (RedLineStealer)", "value": "fcefe0cac2170ac21a204fa55a24638f407929576e951ea739d73ee63da1670d8ae18fd24349021058b66944305428d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625567446, "uuid": "e794cdde-a680-4dcb-8b03-412bf05cfbdf", "value": "EC55E02864BFC019C5E3EEB12DDCA8BBD99A55E3640C743701B4632B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625567446, "uuid": "b674c231-620a-48e2-a7b3-b7b756e7cd27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625567446, "uuid": "fab1d0ec-6727-45cc-a061-e216f8f95c6f", "value": "6144:B5YqofbkGES2Y7xHIGKpeLZG6Tv/3aV3yP:B5Y3fbkGHL7xHIGKsLZG6Tv/3aV3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625567446, "uuid": "1ca8d2ca-7b1c-45f6-b474-f3da2e6f9a6f", "value": 1367615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625567446, "uuid": "b782a2b1-0fa9-405c-b40a-3173ba9448b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625567446, "uuid": "13d1a58a-2aeb-4758-9803-07ba2919e97d", "value": "c40101e3f1c71b894892b4c9256cc2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7226916c-de18-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625548214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548214, "uuid": "810e0e9f-1ce3-483e-82e7-4bb39cb0f10e", "comment": "Malware payload (AgentTesla)", "value": "c6f75761184f97ec52ed280d842ef95e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548214, "uuid": "87d2e2c2-dc4f-4e12-abe2-30a4a35efdc9", "comment": "Malware payload (AgentTesla)", "value": "10d6cd22738b4c398a63c37069bea83bc6f7219ec27b10fd3f031051f2f96800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548214, "uuid": "7486f0df-1d41-4135-93cc-83d764113c7a", "comment": "Malware payload (AgentTesla)", "value": "5aa277ee03790a1d8d1ecb6cf2bc18ddf51cd692", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548214, "uuid": "05939391-c938-412e-8cf0-48259b0f9749", "comment": "Malware payload (AgentTesla)", "value": "bda4eaa4c561f8ecc639e61e790637b7b4e608f76af42ee8503e7355877655977e3d5e1588a61c588d907c59d346c652", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548214, "uuid": "e606e6cc-3f9a-4dcc-ae31-6470160193e7", "value": "FFC423389C4A71C6D6B26BBF1D94C5484D190848EFC9D69C3703F92D26CE20DBA97D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548214, "uuid": "81d44ba0-5f4f-42cd-99ca-5cfc9283fa01", "value": "12288:9kz9PCFcXZ+KnaQglQGKIWk9j0OTNEowuOxxGoIRzD/n:YqEaZlQG1Wk9wOTN1OxIoI1Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548214, "uuid": "aa1bd024-051a-4e24-97bc-0d8a22c5b805", "value": 575416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548214, "uuid": "c1726e1f-f9a2-484d-90dc-233f48241cef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548214, "uuid": "88a70c05-d363-444a-891b-8d6cc5791016", "value": "TT slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef8d590-de48-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625568958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625568958, "uuid": "9029c856-d16f-4639-acb8-18b78e5e1c1f", "comment": "Malware payload (ArkeiStealer)", "value": "dde5e3410b076b8168baa4ad94d3bb93", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625568958, "uuid": "d732efd2-3005-480c-9b47-940e20179a55", "comment": "Malware payload (ArkeiStealer)", "value": "11776f78d1e87398d54f9d45b62971f30af2466db9602a2ed6cccce72193a501", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625568958, "uuid": "958f3c57-fc3a-44ec-b535-7d109eed2e69", "comment": "Malware payload (ArkeiStealer)", "value": "56bf14eb9b39884825568d939ecf3505f5c0ef31", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625568958, "uuid": "7014167a-433f-4fce-8ce4-42f86688f24d", "comment": "Malware payload (ArkeiStealer)", "value": "00593b412fee7a0c1473eff963ab7403c8c022510d448f97b1f283fda39950a1fac400d7841997568e7027373807d519", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625568958, "uuid": "ebf2353b-cd21-426a-bb12-7147823175ff", "value": "4335231296E0853BF8E823F046FC25A3177578B45FB4A3EF924449D89DBA6D0493836F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625568958, "uuid": "54f651a6-16c5-4cae-8a80-c9690e0e014f", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625568958, "uuid": "1fb4b54b-9716-432b-ad5f-cc1f2d328b19", "value": "24576:p59ofKMj9EhZfrHLyQ2rZtEV0fi/nGfnqwtLjQvYA5ZcFYEoxhwt:poCiEhxy3l0Gf7LjQcYXhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625568958, "uuid": "65be282b-4db7-4cb4-809d-97480baab6eb", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625568958, "uuid": "58e6f149-534c-496f-b90e-10b7bf309e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625568958, "uuid": "1681afef-3758-44ae-95b3-f01a43466805", "value": "11776F78D1E87398D54F9D45B62971F30AF2466DB9602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43a6ef2-de93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625601153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601153, "uuid": "878c6897-280a-40d5-896f-95415791077a", "comment": "Malware payload", "value": "470a229bfa54b2942fe9e30988c698db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601153, "uuid": "6c4657dc-ee86-4c10-a6a4-7cd26ebecebd", "comment": "Malware payload", "value": "1203116e27faea18ce97535f2dd14090e3d7b3a2cb864111ca9f2a0ae609c1dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601153, "uuid": "e783935c-f91d-4b00-8014-6d62d2f1339a", "comment": "Malware payload", "value": "d721aa30d228575cfee37047e7fa78e0edf546a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601153, "uuid": "533abf85-75e2-429d-9c63-823f9aff598d", "comment": "Malware payload", "value": "3e57e599abb79a3978c300cba7281362faa59c52325c9d4ee7983f31555d8b05b402ff83bbf81dbdbb872802b11e1b2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601153, "uuid": "a6546aa0-48a8-4b91-940e-079968959f73", "value": "0E81E9B77651D063D85C8571AD06A036A136FD43FD84D51A30AE332F5B767C883411A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601153, "uuid": "8ca904ea-d7ea-4835-a049-db2c2854f8cc", "value": "48:rcHX+Ssge65H3dos1MuixajEJWnVIEJqgNSdYPlkRBHrSBbLs:wX/sIGZIYJLEYgjkRBHrSBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625601153, "uuid": "20ad6e52-2f76-40d8-9b81-a6edf79c8c8e", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625601153, "uuid": "4e23ec9d-a884-4528-a447-165192e9c47d", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601153, "uuid": "1ce7ecb0-bd63-413e-b30b-ec19c034d426", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.3.29312.26782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3752c4a6-de18-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625548115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548115, "uuid": "a4dfdb2d-5d1a-45e7-b090-51b12e50f938", "comment": "Malware payload (Formbook)", "value": "5ff76c76c29d309adc9f4d007d71603f", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548115, "uuid": "fc4dc038-3953-47d7-9110-67dab8e4fdc9", "comment": "Malware payload (Formbook)", "value": "137e5b7da690b6315d40c99848c61e7b0dd9ff8647fed73a14de6091b8691c2c", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548115, "uuid": "7e4cea13-97b7-415e-ad3d-222403237742", "comment": "Malware payload (Formbook)", "value": "e91d6244bc9a76df5e130443d2e2ab7faf0442d7", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548115, "uuid": "4baa3af9-340b-4271-ae38-8d649adb273c", "comment": "Malware payload (Formbook)", "value": "7a451f9f577f5887079174c410214ec6fef744c16ba53e82d4675c062c2b36e1617e7728654f6b258cb8f0c609e18297", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548115, "uuid": "ed00f7f9-d576-4e50-b5d5-9760a6381e2f", "value": "69E423464A639A83F9553CA7F1085C13BE34D1B35F0D9291969D6883CFFA7203B26787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548115, "uuid": "de599147-146f-405c-8ea2-5f09b9671533", "value": "12288:5fDKG4wvz9E/QANDTa80HWfx7EgTqbdi4fu5/ONYRhR7InjLggg:VDKGtAVTaHHkFGbdFsmORj7Ivxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548115, "uuid": "6cf1bb03-0b61-455b-802f-4e3b813907a6", "value": 674549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548115, "uuid": "314ea8a5-b7de-49ff-8845-2fd59aa0cb59", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548115, "uuid": "2b473d6b-dd8d-4078-b268-ce63386194a6", "value": "Payment copy.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103ee43b-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614192, "uuid": "d2e32f22-e554-431a-b39a-279ac4fda7ac", "comment": "Malware payload (Mirai)", "value": "87f81f2fc4c9c6aba1e8ef67002a0de4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614192, "uuid": "5997727c-db78-449a-84ac-cdf1183649cc", "comment": "Malware payload (Mirai)", "value": "13ba99fd542857c855a2e13134ac035e547252a6e9e66d10ac0fea86ba63e65e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614192, "uuid": "27800ed1-4313-445d-aac2-1228e417f744", "comment": "Malware payload (Mirai)", "value": "ba2fb63563e74c9323f41c3d18726f0cb166d3a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614192, "uuid": "cd7f6880-3f9b-4cc5-9f0b-c9ac89cb5c02", "comment": "Malware payload (Mirai)", "value": "0ee651b4d5109e40acbb57612cb5b8fd9df4df2f36422a1b45846fbfd23ec7d76dd2a8a6461d664646e3c8d169c320d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614192, "uuid": "5ea3f383-ba18-4ad8-aeff-c26654349944", "value": "AAE34A46EA418E13C0D6277AFAAF414A3322D764E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614192, "uuid": "288631b0-2c1c-4b23-bbee-bf2005309f7a", "value": "3072:sU+Muo14YhaYf78LiK9mrsplDKZUyQBKXAVaniX+F8Jyv1GhLd8Fp89jJNxLZS8P:sU+Muo14YhaYf78WK9mrsplDKZUyQBKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614192, "uuid": "d27545de-ac41-42b9-85b9-6f771fae2366", "value": 155907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614192, "uuid": "132d1399-24bb-447a-b425-687e70ffa9dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614192, "uuid": "fd747f63-db4b-409e-8cf1-45b120deaea5", "value": "87f81f2fc4c9c6aba1e8ef67002a0de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2173ef-de3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625562966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562966, "uuid": "fa851a20-5b87-4439-8059-c8dcf012901e", "comment": "Malware payload (Formbook)", "value": "1b415a56616a9f7c2e37fc2ce570664f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562966, "uuid": "c43b2c0b-63e4-4794-a8fa-117c849e4d9a", "comment": "Malware payload (Formbook)", "value": "14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562966, "uuid": "67d273ac-c0a8-41ba-8217-580b682628a7", "comment": "Malware payload (Formbook)", "value": "2e7a5b8378e9a0e5fd7f5a8321af4d128ef2a1a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562966, "uuid": "4a0c9b99-320b-4f49-afd1-6d49bf7f3ef1", "comment": "Malware payload (Formbook)", "value": "7e735942c9e8e65f0e6f42b963a5d4778d6eb4a844fab1f46d404f044904364a1659930cf79b03f5a6fa5583094dbba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562966, "uuid": "465de657-7906-475e-a76e-00feb9ca63bd", "value": "5F158E7660328AA2DD6FCA380735D67C0F9AAE75D14BB63814C87D0B30F1B5506A792F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562966, "uuid": "83601852-9e98-475b-8503-8549ae61a80f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562966, "uuid": "0e3abc76-3ffe-4e61-9809-a46ce57d09a6", "value": "12288:c6NsBxnXmu2YWb3Hc3qGuyTM/cTO5t0M5XYMQ2Ds0yW7AWgLmKijL8DP:c6NE2u2YWaDucTO5mM5XHhzy4AsXcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562966, "uuid": "24b1f33d-a52f-4827-abb9-924518607478", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562966, "uuid": "499364c2-4455-4553-950e-3bc4d489875d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562966, "uuid": "6d8d050d-51b4-40dc-99b6-0a49d873d7b8", "value": "1b415a56616a9f7c2e37fc2ce570664f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf77a68-de5e-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625578270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578270, "uuid": "87f822e0-2481-43c4-9d47-ed131d5d73c5", "comment": "Malware payload (IcedID)", "value": "184ff7a1642ad86b81cc2067f92cfa9d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578270, "uuid": "852d8052-c92b-402c-aa76-b7873dae4717", "comment": "Malware payload (IcedID)", "value": "159596a25327a7ca8531fa0d326c3d80fac14b3732a6ec33e2ba5339fdbce9df", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578270, "uuid": "f34c5e93-0142-4161-ba1f-bf8670f60ff6", "comment": "Malware payload (IcedID)", "value": "6362f03ec8cdf762058724459668c9460c692b9c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578270, "uuid": "2a3c40d4-6e94-4a59-9f3b-ec88919e3932", "comment": "Malware payload (IcedID)", "value": "3077a98bffe968bdadcef3c400e4591712d552e37be5354b8b78acddd72310d48a39ef801ad93fd907c595c681fbd29e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625578270, "uuid": "2a8ee928-e296-4419-815f-bc4b18469004", "value": "2F040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625578270, "uuid": "72b859e6-1612-45e3-9fec-c11fddc2f48a", "value": "3072:eDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:8RcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625578270, "uuid": "85d56ed1-86e6-4f5c-9401-2bceb56f852e", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625578270, "uuid": "329c3fd5-b4b5-47bb-a184-f48d3ead8f84", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625578270, "uuid": "8b5aa8af-eb6c-46e1-bfed-15b3b6f4282c", "value": "sbf0127365-7431059.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbc75e8-de67-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625582214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582214, "uuid": "7f9653de-a40a-45a7-8a7c-3220f7b75f23", "comment": "Malware payload (AsyncRAT)", "value": "3e46e05d321065ab67c8b5d588ffe418", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582214, "uuid": "873789d8-e63c-4d2a-8877-f38f1bbab54d", "comment": "Malware payload (AsyncRAT)", "value": "15cf9daf5bad1a5a78783f675eb63850e216a690e0f3302738ce3bd825ba6fc1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582214, "uuid": "eb58af9c-dea3-4dd6-a9f1-3c931376f74b", "comment": "Malware payload (AsyncRAT)", "value": "16bbaae13819f996be9f81794df7c9f33ade9b7d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582214, "uuid": "14cf8cd1-6ea6-4d7e-9f87-8bb5eee938b0", "comment": "Malware payload (AsyncRAT)", "value": "4c6b58134f80a181e7983f637d843bbade2ce1ac4d3da8e95c98593c797e49db6ff0a0ccd272394837d2bb53379ada0b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582214, "uuid": "7ee4cd04-31d2-4ef8-9ee7-31cff215e8e5", "value": "87312208998DFC9FBD59BA87C8108C2B7ECF897D1A65201C6941CD491EB92DC375A05F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582214, "uuid": "61b2261d-704f-4070-b65f-595888e12dfe", "value": "48:/t4IwOS2W7Q7L6hym1gIGzUY2ycgdTJnvqdRT:/tDWXM7K31gi9H2JvqRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625582214, "uuid": "ed9ea2c5-2912-4198-b940-ebcd104edc81", "value": 1803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625582214, "uuid": "278703fa-e58e-4684-a3f5-38580e3d9815", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582214, "uuid": "c88d46a4-f746-4ae3-844d-d8e6875a9d98", "value": "Report-11003456773312.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb9bb86-de55-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625574246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574246, "uuid": "d02b8da4-d7ac-4386-8b7e-e526e6f39d06", "comment": "Malware payload (Gozi)", "value": "f583da0f19c02a59d838b3784bbd4a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574246, "uuid": "38b1a45e-ec2c-465b-9745-1f32a9af1b3b", "comment": "Malware payload (Gozi)", "value": "15db47b02f2c661ca62158b2d2393ac7d8b771fab35be42ebbb8bf9a6969b950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574246, "uuid": "b5777136-a6da-41fe-bfc8-e54f0c95c7c7", "comment": "Malware payload (Gozi)", "value": "922d5a5572d90b11db55c21f28044fed1f5450cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574246, "uuid": "6b364cb0-d557-470e-88c5-5dbb6f0c1f9a", "comment": "Malware payload (Gozi)", "value": "fc480d0fa05fac9be537042cdbf78cf4a5b4eb0337069f0354ef27df131e29439e1eaca650934087dcf389ab3d45bf99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574246, "uuid": "fcbd1e77-d547-4fc2-abe5-0949637352d5", "value": "E9245B6AA3E40599ED6BC6B5CE53D61BE7F274052B14D30F43B4CAA66F07722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574246, "uuid": "02ae7ccf-22bb-4054-934f-35083f8320e9", "value": "6144:iHExb7VwvtKNbnvSxYNiyf+D3LuIy5Yy+H:3xb5wvtKRvSxY0G+D7uIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625574246, "uuid": "93450511-9d9e-4ba9-8e24-67181c9e8065", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625574246, "uuid": "7094d7d2-ad1f-4462-9f92-44a02e6cb990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574246, "uuid": "e7bfa41a-fcf0-4f53-923b-512048624a25", "value": "20579540000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7959fe49-ddfa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625535341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535341, "uuid": "5f6901ec-b946-4a88-b0f8-59b757f2ed58", "comment": "Malware payload (Formbook)", "value": "d9d6f2a7d42dc1ec0db29b628a84979a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535341, "uuid": "45a1463c-be8d-4c72-80b5-31657db93a7e", "comment": "Malware payload (Formbook)", "value": "160cc59f612cb0eb2cea9d77eae72641725f33eebdaf06d431d8bf409410b883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535341, "uuid": "f3a99c68-33d8-4552-81dd-259ada7b48bc", "comment": "Malware payload (Formbook)", "value": "f7e6c1828843dea55a861c0616f1e4892c1bbe41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535341, "uuid": "bc3f41c0-829b-4543-9f5a-988bd3886485", "comment": "Malware payload (Formbook)", "value": "1fa785a1d312b0bc388a495d803040bcd738d16c680a6674f1effada41bed095d70e5782ae0ea485dd6315790797fa34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535341, "uuid": "a7bc703a-c23e-4b53-bd18-8c2e5696c25d", "value": "FB059DBA60378BA2DDBFC6381331E63C0F59AEB6D14BB67418C47C5B30C1B550A66927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535341, "uuid": "dd126c2e-a9a7-470c-82c5-b9ba4f1f8644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535341, "uuid": "abbc4127-cd29-480f-ab7d-61fddbac4315", "value": "12288:pPL6NsBOnXmuWGiKGKmWG+juBYgS3GVIoYsETNZT61vX1XFm/V3z:F6NF2uuKGKNG+juBYgS2VIoEOhhFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625535341, "uuid": "b2a02984-141a-4a5a-a33e-8257df0b1774", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625535341, "uuid": "149f900f-96b1-488b-bef9-15dd9dd69ea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535341, "uuid": "e5ff1b41-89db-4e4a-bd5e-6624091ca2ec", "value": "SecuriteInfo.com.Trojan.PackedNET.908.10371.20204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0076413a-de6b-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625583671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583671, "uuid": "54e83ff9-22aa-421d-bcec-828e8ffdf916", "comment": "Malware payload (IcedID)", "value": "1799e36c7dcdafacaf883a1f9d92f62f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583671, "uuid": "a9c4213f-b728-4762-8522-2e67f04c5711", "comment": "Malware payload (IcedID)", "value": "1756dea333ae5179a904c49f5fb16b76b03208cce0c05953552a46fd37e685f7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583671, "uuid": "80d1de5a-32a3-4c51-9757-78abbc19cace", "comment": "Malware payload (IcedID)", "value": "d49cb116574bedd7a18eb99b3f74f9b10964f3f8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583671, "uuid": "0fdd26cb-2f6e-4694-8135-e7a86cf56fb2", "comment": "Malware payload (IcedID)", "value": "8bbfe13f8c5a2c03e19c65db297d2d6824cf8f0f28f04a773435df9d8c7a593f6563a97b2ec28d7cd948c38affa04bf6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583671, "uuid": "23ec8116-f52a-4a76-bec0-03313c8d282a", "value": "C9040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583671, "uuid": "2485e7e9-6f5d-458e-b322-2767822561c8", "value": "3072:iDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:QRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625583671, "uuid": "da6459ac-b5a5-4c31-b81d-2ccc62e6dc4f", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625583671, "uuid": "961c3971-5f76-429f-bfb8-5c87da6f2fa7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583671, "uuid": "3cf9da9d-f2f6-40cc-9246-3af97d6da244", "value": "HRScheduleH3965005.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2689df36-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625584164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584164, "uuid": "0d2262ed-88f8-491c-bab9-feedfe02a98e", "comment": "Malware payload (Loki)", "value": "51fbad0bcc44f495e09b64ee2f6e542e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584164, "uuid": "fcb35599-4a6a-4028-a811-5423255b809a", "comment": "Malware payload (Loki)", "value": "180a4564ce82447e45e75b149c9a0ac9c87ecbbd77f603a7ec690b8a273f23c1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584164, "uuid": "fca9d152-c1d6-42ab-9dfa-a5fff3210a5f", "comment": "Malware payload (Loki)", "value": "8a0bc79271a4cef5d9d2e5c77b15a68f869ebc8a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584164, "uuid": "77d8ad5e-dd4a-44f4-857e-a9e54f4d553c", "comment": "Malware payload (Loki)", "value": "6ab70984f469a5943ebdcf86fbed492c85596d228752368a4203dde1ccac94f251737226096bede7d295cc0c80d622cb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584164, "uuid": "39efe733-63ea-475b-a0f7-2c380cdb4863", "value": "AA55122856EB7520C77F2A367283EDA4EDB9AC5D6182B311326D30C3743F6609BC1A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584164, "uuid": "b07a8bdc-559a-48a8-b1b3-3bae882b00d6", "value": "24576:I7zOTHyLAzJNxycIJmjB/I2p2gll1+V9m608E2o9CrmoPstg4OmyVFOT:aZIxylJmjBN2glHu3V+9C70tgJmyeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584164, "uuid": "3d0eb12f-1ba8-46ff-9530-ad923c0e4be5", "value": 1281784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584164, "uuid": "6c248033-10d5-47f2-87ba-08b1d341f70f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584164, "uuid": "e59a0e73-e51a-4bd3-8771-11ed4635b8f6", "value": "DRAFT SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106f0d2d-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599160, "uuid": "392a5736-9399-44e7-924c-d7655c1a4e37", "comment": "Malware payload (Mirai)", "value": "5d99c10b2ce5ec848715b13df57969cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599160, "uuid": "3d174416-74c5-4a10-be55-ca8842853ba2", "comment": "Malware payload (Mirai)", "value": "18a641dabb79e2d254a559a7d313cbbfb59b7693bc301ba217e480ad36d968d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599160, "uuid": "a2d578b6-0871-4a67-aafd-a4611ffbce9b", "comment": "Malware payload (Mirai)", "value": "faa0af340b7174f1da625f782e864cacc3604801", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599160, "uuid": "029a4142-037b-4d48-a188-7b4bbf77e3bd", "comment": "Malware payload (Mirai)", "value": "03bc7e32a3f3a55cb335ebeacd72f27f3304cf7fd1d4c037cfe7442ab8dc42348b1f6d914f7bbce418d213ce1432dc53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599160, "uuid": "0f4b8074-9627-4040-804a-c09fe778cab1", "value": "16C2D1716AA7D03DE4EE3974ED281D8498E54BB8C1B111A273E51C94DFCB40F1274A6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599160, "uuid": "859ef9f3-981b-4ce2-9b74-339290d7e12a", "value": "384:ivsivrQxe2yaEujBrI0dOBbp7PuwZOc62wYsdBnh/pN/terihymdGUop5h5Nb:gTvRPkjBbgbtjZJvnsbXN/4ris3Uozn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599160, "uuid": "34053677-d792-400e-8eab-61bbdc95324a", "value": 25904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599160, "uuid": "454f0897-14ed-4287-b0d5-7d4343635395", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599160, "uuid": "5f8ca45a-e590-4e8b-a801-2240976e7b68", "value": "5d99c10b2ce5ec848715b13df57969cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a7f5a7-de5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625576573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576573, "uuid": "63e4182a-a1a5-4bab-840b-f2953303c189", "comment": "Malware payload (Loki)", "value": "e1449558809c33d74c09eb128359fd19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576573, "uuid": "683560e1-76eb-4931-89a6-95b8332370ec", "comment": "Malware payload (Loki)", "value": "1d153b7141591161b750ce0ca425ada69f3a80ebc9b036efc76e779537dda8db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576573, "uuid": "e5eb8821-7803-4a45-a35e-45c2d61de757", "comment": "Malware payload (Loki)", "value": "52e059adb63cec9754c954bcabdd4a412a439119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576573, "uuid": "262a537a-9301-4f0a-a1de-a91b6385e535", "comment": "Malware payload (Loki)", "value": "659acf866d81cebca1f8c7aaa0cd708ca75dafed5d901eac4e131d1e1a6f7a05eda024494acb84ab4cd12a12615bae40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576573, "uuid": "d02821ae-795b-44c0-abaa-8fcb10f596d1", "value": "70659D593700B78EC4968E318868DC34EAA0AD679707D383A0E7399EF97D556CF091F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576573, "uuid": "18246f5e-23bb-4713-947d-8b06430d10a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576573, "uuid": "2ab9041b-364b-4057-88f0-c0b6101dff46", "value": "12288:bw71fTJat9iIY/TScxOP3gVZsZZZsZ4jEaxivPWeEH96lKNGqJsPf9Tmdz8NCpyZ:kj6Y7vyzeJlVqaPVznLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625576573, "uuid": "3bd3412c-75d8-4077-9a58-88f8dded7066", "value": 1537536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625576573, "uuid": "3aecba5e-c568-4e7e-9c59-e48890df5e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576573, "uuid": "5bf3c4d0-6991-4079-9476-e49ad6fd0350", "value": "OW5kgRuQ4j5SEKv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab51417-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625549543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549543, "uuid": "34999367-1114-41b7-880d-da02a08da753", "comment": "Malware payload", "value": "1ee433c085b06182a9ffbf859d210320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549543, "uuid": "0fa6a5be-c470-4b2f-9909-8bb5aa464768", "comment": "Malware payload", "value": "1d247a499ccf8ebb1f70cdcdccb12fb9e9e9a2bf39d3bce0e77831c9f19dcd03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549543, "uuid": "36ce981b-212c-4726-ab33-69d0662fb536", "comment": "Malware payload", "value": "6fe27f073cd70991a027c1c18bc6c73d5961f61b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549543, "uuid": "c6597e0f-6a59-4d52-ac61-07664afb5f11", "comment": "Malware payload", "value": "3b1c729409e2caec63e3591714f42ce2ccb8bd0581c5a5e7f4ec0375fe85cc21bc03b341842f5917a22f1a10a584e84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549543, "uuid": "952e1c71-cc67-468e-baa7-cccdeab3f997", "value": "7EF47C587601B1DFC85BC932CFA81D30EA606C7A8397C30BA017319D9A7E697DE190F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549543, "uuid": "68365c80-4830-4395-abae-6970e581829c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549543, "uuid": "b8e746dc-1cf4-4246-8894-4e396acfb216", "value": "12288:H1QHdP3rYiDG8oppsXmUptsPurJkWYoWP01GPo4e8WijSo2WAXztFQPnz+YcbNtj:H18djpDvcUpt8uXZ1q2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549543, "uuid": "1c4c18c5-1016-4b1d-bb1a-64b36719f59b", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549543, "uuid": "a68f935a-4d7f-402d-bd1e-b61b1693c225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549543, "uuid": "b9e7c6f2-a5b4-44be-b7ac-2ef6819e93d5", "value": "transfer slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b52779-de1d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625550347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550347, "uuid": "e66f05ca-3dd5-4553-a0bd-22f69f038a33", "comment": "Malware payload (Loki)", "value": "a75de5624668a22585df35614a16f239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550347, "uuid": "9883702e-c617-4dbe-9ed7-8053a9923ef0", "comment": "Malware payload (Loki)", "value": "1efc12d1e6ce967ba24857104c963e606e5072b3f0aa59af3beb01f0e2791292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550347, "uuid": "22f72191-e5e3-4f62-80fd-0cd78028044b", "comment": "Malware payload (Loki)", "value": "3c468a540e0d33a741acfea5d9845d2ddff11036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550347, "uuid": "70c92272-3b56-48af-813d-5d2d3c5fb5d6", "comment": "Malware payload (Loki)", "value": "78cef39f0a1a0406c13f77d726e61afe4d5b5c4fe95ef9ca8b84fd8285302e746111794d357f4075d8bd1d016409142c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550347, "uuid": "f407e25f-569e-48dc-97b9-e0fb18f8852b", "value": "88F46CBA61764FA1DEBFC7380331251C0FEDB37ED25BF6B85C98B1880590B450A96927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550347, "uuid": "431e627d-d773-4bf7-b067-8252d578977e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550347, "uuid": "79546f3d-ff6d-4941-892a-3586a2c2b747", "value": "12288:gQvP6NsB2lZ9Potk6BwbgskwITQXcVmqX8KReqp/6yZAM:ggP6NVD2w8sSr8yp/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550347, "uuid": "81cbb686-5015-46e4-a7e3-0793a7e08647", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550347, "uuid": "79ed2b02-341d-43c5-afcc-09618591bd79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550347, "uuid": "aba77b45-4c2b-4373-992f-4136079f0b2d", "value": "PO210706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf53c4d5-de1a-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625549202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549202, "uuid": "27197bff-c645-4cbf-9615-17b4bbe54a59", "comment": "Malware payload (CobaltStrike)", "value": "31451142d47c8ae4b59da98940ab4f16", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549202, "uuid": "624c590f-bbc0-485b-96fe-655d6e98e63e", "comment": "Malware payload (CobaltStrike)", "value": "1f5fd052dcc9d28b5c9b2ad4b1186c1051027d9df6814be97b2ec612578aac6b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549202, "uuid": "ac10fe06-4e0b-4d00-8621-5a07940ae921", "comment": "Malware payload (CobaltStrike)", "value": "b4db5322ea3fb4c90d4dcfe6ce41cb98c49a0b26", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549202, "uuid": "9274a4fa-ed2a-47ea-807f-cb2a54f462f8", "comment": "Malware payload (CobaltStrike)", "value": "ecf9c29c5e097b362ce3f7615fa91ae597c96d0247ac4710bcdf610fc385d51a5a13a1dd15e38c006374150a4c58e73c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549202, "uuid": "17e5b40e-9b26-43dc-af56-d32a0ddd90ad", "value": "CCB48D5A726404B5E1B7D038CA57894AE7B2B8461761D7DF03A0D3BB2F237E05A3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549202, "uuid": "c0a93b7e-369d-449c-a9e7-7460875ca64b", "value": "f1f1b33a000de2e63012caa25f3cea30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549202, "uuid": "87d5e0fd-9401-4e6f-9723-c1ad4d90fe2d", "value": "6144:2XTPTph0RixI+yBwx8nURYxfpz5j5l9JuT0tCPvPTQKBmowoh8RqGQ5lX:2jPyKxHRWj5gTx3PLAomQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549202, "uuid": "f9b3a35f-df8e-4604-ade8-24071d8f19f1", "value": 497024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549202, "uuid": "7794ef44-57b5-4f91-8323-50dc4eecc236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549202, "uuid": "bcec9dd9-93f7-443f-932a-819235d4aa1f", "value": "31451142d47c8ae4b59da98940ab4f16.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5262b0be-de21-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625552026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552026, "uuid": "5d56fe9e-2047-46e7-b155-247d2e92404c", "comment": "Malware payload (AgentTesla)", "value": "90ee531b5343a3b1953160e6870f55ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552026, "uuid": "fc1faa21-4b1b-49c4-b338-da5611bef847", "comment": "Malware payload (AgentTesla)", "value": "1fa1c759ecb40e7c8a22dce73ea2a22783c219b8640b8495b464f30180be6a31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552026, "uuid": "a1600668-e449-43fd-9cb6-5bfbd7e7f493", "comment": "Malware payload (AgentTesla)", "value": "a1fe3c663118c9df2f638e08934e6fa9a36ed485", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552026, "uuid": "078f2c3b-e547-4bbd-b13f-6530bc93fc38", "comment": "Malware payload (AgentTesla)", "value": "58f2617ade1bb0f08737cb39528acbccd624f57da8e5f8d4752fd50a438414f234721c90fa63e25c1a081d8cfdd57290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552026, "uuid": "e62634e8-79b2-404e-bfdd-fe3887ae5f75", "value": "6CF48C9C3650B6EFC85BCD36CAA82C24EA60B4B7831BD203A45712ADDD4D59BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552026, "uuid": "38023cc3-3404-47d5-bc80-9b46bf9bd115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552026, "uuid": "9e96154a-7046-4a12-8335-915b3d3c4e1c", "value": "12288:eMwzMV8FXmpNP4b0glBkqP12oLWiPwegd/xTOjfhFGRmYjZ:eFh5eyBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552026, "uuid": "17b482a6-582f-4370-8ede-b291cec59928", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552026, "uuid": "07b9df4d-9c67-48cb-af46-3a79fdb7f5d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552026, "uuid": "6ad6dcae-bdac-4dde-b3a0-3ad90a157665", "value": "iqdYDR9EaVpTWfj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba88115c-de7a-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625590426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590426, "uuid": "247c6822-5103-4937-bdd1-47925ff14178", "comment": "Malware payload (GuLoader)", "value": "66be55da9e2ab05f8452bf8a3de2707c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590426, "uuid": "677fe11b-682d-463e-9666-3001290fbc79", "comment": "Malware payload (GuLoader)", "value": "1fc65a967ab063e5d58e0358b81f9eca048b47013f1e2b1383d8f028b114cffd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590426, "uuid": "522a2211-389c-4737-9bf0-04502dcfde67", "comment": "Malware payload (GuLoader)", "value": "e96e7c1caabb6a9250982fdf9a370e62406fc384", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590426, "uuid": "4a5ed48e-d30f-423f-a965-1aebcc8af7a1", "comment": "Malware payload (GuLoader)", "value": "b84904389beafdfa7b283f344ae5041886cde0b0bd992914e2b0782ea5932ac9662347f1c64f084ae9ae1da9782627cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590426, "uuid": "1f29b9fb-542f-412e-b0fe-6858e3cd371f", "value": "7AC35BA3B6D95CA1FED14F701471D9263726BC3078939E1F3643BAAA7C32602657062F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590426, "uuid": "20313a6a-ca54-41ed-8664-797a70db25c6", "value": "773df40b486ba5eea01d9fbfa70abb4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590426, "uuid": "07deef65-bc68-4e4f-aab2-e6a48e591bb1", "value": "3072:hbD/Xiw+FdW1vjxgDsSG7UsPDKV6UZikvQi:hgFdKLx2sSG4aDQLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625590426, "uuid": "cc1d2171-2b98-4e93-b42f-0f2c0eadfa55", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625590426, "uuid": "3bc6a407-94ea-470e-a590-f7ff2329cb34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590426, "uuid": "11321580-064d-4dc1-9b91-75a38192c7c1", "value": "66be55da9e2ab05f8452bf8a3de2707c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ec453b-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587163, "uuid": "7a190cce-6b97-4739-ad01-51c938014b19", "comment": "Malware payload (SnakeKeylogger)", "value": "fed83d37cbd4ab15e8587c17257bfd59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587163, "uuid": "a080c81c-2f82-4971-a704-7706ff200d76", "comment": "Malware payload (SnakeKeylogger)", "value": "1fec8f73f9d81a56157b4457c26fbbcd175fda95a2b9c77aaa2fab99c1a776dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587163, "uuid": "8d049fdd-b7a2-4044-8cdf-289f9f83168e", "comment": "Malware payload (SnakeKeylogger)", "value": "f16f4fb435fbf34602a0f26a7e0ec768e4031142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587163, "uuid": "c94f6120-3b2f-4e89-9323-630c1bfef52c", "comment": "Malware payload (SnakeKeylogger)", "value": "f5139045e5cfcdade30bb29fa7eb94911ad1238d62f18d0750a3be9005dc342414cf5892ce5bad22b186a4e16f9c5737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587163, "uuid": "b23468d6-9fec-47e0-9361-50358c0a0330", "value": "E1058E7651768F92EDBFCB785375261C4FE9B377D34BF6B82C9460990480F804A62A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587163, "uuid": "ccb4b966-a787-4812-9843-bcb49c99ff5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587163, "uuid": "64c1c886-e649-4e7c-8e09-18c11a609993", "value": "12288:d8dJR0m0R86NsBtD/F08SxyeGG/+x270EdlM1lPH23fExeZa:d8d/0326NUYZoU6H23M4Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587163, "uuid": "72338ae3-c3fd-4f86-9f98-fccc536561c6", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587163, "uuid": "c85b9cd0-7bd6-423b-a3c0-a0cda44c24ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587163, "uuid": "05ccfa32-2b97-413a-92cf-04c20f58154a", "value": "iXQKqQRUEetloRB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15383c86-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625552353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552353, "uuid": "40d98bcb-bc6f-48ff-9a58-eee1fdea69ec", "comment": "Malware payload (AgentTesla)", "value": "4e1dc0d2e17e635f67331b851f251cfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552353, "uuid": "69172d64-deb0-4eee-a803-defe3b10a77f", "comment": "Malware payload (AgentTesla)", "value": "20c348d09305a7aff80b3967175a4f7a3c7debfa8a9ae7fbf3dc4bf31f0ec9f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552353, "uuid": "a1c56cc4-53e2-445a-abda-669014ef7371", "comment": "Malware payload (AgentTesla)", "value": "13238034c80de1242efa4175182ee7797c77a3d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552353, "uuid": "b07a8265-12b1-44aa-a365-4836cff37cd8", "comment": "Malware payload (AgentTesla)", "value": "3ae143988027474846f4dc74c48edecba9ca6e912647c9088e6badbf02e2da34a7fb39bc5a43943522e221330edd0b33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552353, "uuid": "5786055b-9d06-4b6a-b312-96db29101dfc", "value": "32C4F10E7FEA4664C09407B1ACB7E2509B71AE574C56DB4AB488B3072FB33C14A57F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552353, "uuid": "130f1d23-1d42-4c65-919f-d1253b6e5b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552353, "uuid": "ab2a8d58-43d1-4885-85bc-79649213e1a1", "value": "12288:NdIopFjV4h+DrEmvdEslw10RCUcPsFDbc:HjuOrEmvdEsl9CDsF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552353, "uuid": "4399179c-a680-4f0a-b1c7-7e04f6ce95cf", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552353, "uuid": "efad51a5-83d3-467f-b61b-60751c63a65f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552353, "uuid": "53498d97-e047-45b4-9cb6-4d488933f46b", "value": "MV TW HAMBURG_VESSEL DETAILS.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c528a21e-de7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625590873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590873, "uuid": "5af86bef-87b3-4719-8410-c15df4e8214a", "comment": "Malware payload (Mirai)", "value": "78ff158651a1e6259b6d93b7a9aa5f73", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590873, "uuid": "bd883fd6-b261-4f66-9b02-358fa1e27c66", "comment": "Malware payload (Mirai)", "value": "211b5dc3c2d2bea57857225ea409cea9958c9848edf35f24cec820898dac9584", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590873, "uuid": "6e7980e3-36d4-4826-a6d4-f4341c3e9eef", "comment": "Malware payload (Mirai)", "value": "152aee0090bd2f0fe397a91efb471423f9627693", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590873, "uuid": "2e06d4cd-42d9-48ab-98f5-b904e82b35bc", "comment": "Malware payload (Mirai)", "value": "f6a4ce18bb129154d8f5a1147ca5900933737d07acf080d28df0148f779dee579cf9b41fa883f5e2c10a2439a976be92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590873, "uuid": "d2f5bc2b-540b-4e75-bf0c-da61b689a35d", "value": "13A2C0B034D2DD7DD7F544B19E25E187261E13FAE1F93238253916B8A1C281F2BB6287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590873, "uuid": "5a0331f3-2b0f-4217-ae6f-4273c95be46e", "value": "384:nJ3UQyFDNgB36T3d7n3peSzvV3wlnxcrE4SICQ6hymdGUop5hXC:nJAWMLd73dOlV4Xes3UozJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625590873, "uuid": "305b1c71-bea7-4c61-92d3-6b0737b20daa", "value": 22124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625590873, "uuid": "ffed6c26-b901-4296-8d4e-af0b55283596", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590873, "uuid": "4efc209e-14b8-4fb4-9714-d3b8b80799d1", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54b0d6a-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625588323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588323, "uuid": "3753bbac-e645-48cf-ad27-42a0dd60dcf2", "comment": "Malware payload (RemcosRAT)", "value": "5e9e5959c03e5058985150085c6b646a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588323, "uuid": "d45210f7-3e45-427a-b3d7-b27b2d7e9bc0", "comment": "Malware payload (RemcosRAT)", "value": "2252394f06a149c0619536e086345f308109a6f1f1a35bee94f10d3877e87fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588323, "uuid": "5bc6c5ff-e3e6-451c-87ed-5a3d0deab3ae", "comment": "Malware payload (RemcosRAT)", "value": "aaac0d1764b369b94449bc63fa9d3093a97776a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588323, "uuid": "2a37f2e5-61f3-4813-bfc6-e66509c472c1", "comment": "Malware payload (RemcosRAT)", "value": "d63423b41f678eb371e2b268e49c5c1739a665d4f84f297370645a27598ef6e96af7452fa262b2451f0961bc7308d9ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588323, "uuid": "55bad95a-6b0a-4eb0-a401-bac0c03ef8e2", "value": "63759C683210719EC857CD7F89541CE496136CA7761B920AA093F2D8BB7FD97CEC13A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588323, "uuid": "3ce4d7c6-9976-4da7-9f38-123ab541ff4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588323, "uuid": "181c5063-1cd3-412d-9e84-209e8802beb8", "value": "49152:wqEhr1q+6Fh02e1QPzbC6JnOqFYLQ7cOztTHKS:lar1shb1zOD6YLQ7FhTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588323, "uuid": "a43298e0-e4ab-4d0e-b6d0-ecc9035bd359", "value": 1696256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588323, "uuid": "9b31e8da-1853-4dcf-b815-201c28422714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588323, "uuid": "4cc730ae-2254-48cc-b082-b136a2be8456", "value": "5e9e5959c03e5058985150085c6b646a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b21a26-de70-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625586076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586076, "uuid": "151cc369-eabf-4080-9e08-f119e5a4341e", "comment": "Malware payload (IcedID)", "value": "acdff723834c2096a2b6cf764530a39d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586076, "uuid": "da1bb901-26ad-453e-99c5-3ca1c1903594", "comment": "Malware payload (IcedID)", "value": "236813afbb9c8784ac18f4653ee4933de94941b17cce4dad97ed1f21d61eb5b1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586076, "uuid": "6c43c992-78e4-4a2f-9201-d12c33b26a8c", "comment": "Malware payload (IcedID)", "value": "f73118a481aff1b466d3357ed80ad5dda7bdb082", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586076, "uuid": "6cdcd838-9d62-4e87-9d2e-8e3f71ced16e", "comment": "Malware payload (IcedID)", "value": "cffb1a0b07d47c1e21d676bee45d9b195e1eb9fbca6d23fe7cf986261bda8032bd7238c2906fd6af3add1aed83f963ad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586076, "uuid": "3dce13c4-a825-40c0-ad3e-b42d9aa60bd7", "value": "33040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586076, "uuid": "d7e7dd4c-08a9-4729-8b5c-b80357d2660a", "value": "3072:2DusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:0RcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586076, "uuid": "ccf878f6-6922-4141-8ea5-6c237f49ed1a", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586076, "uuid": "522caf2d-9e9c-4f52-93b3-158b92035bf0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586076, "uuid": "3044cd8b-ac43-4144-91e8-255bcf6e0ddf", "value": "Outfordelivery389402.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef266719-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625556154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556154, "uuid": "132f7153-002b-43af-ab86-199c552d98c9", "comment": "Malware payload (Formbook)", "value": "6c50a6be6da2f2cd9d5b47ec5d69bcc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556154, "uuid": "d5da2480-1c30-4b07-b6c0-a5ae91725009", "comment": "Malware payload (Formbook)", "value": "236837232b18ee0bc9cf33d315d3a003216c87a7ccae8fc811a871daf91c3753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556154, "uuid": "b6abf28d-b497-4c35-92be-3f52e74978ac", "comment": "Malware payload (Formbook)", "value": "30255b1caf30720210ab4623f778e43eb63aeef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556154, "uuid": "49a7db23-64e3-4a40-8275-80c876d4c83f", "comment": "Malware payload (Formbook)", "value": "12ef4c2da7ae9ae9a6f4c7f9190b0c6e51fd382fa3094d955d5eba4d66b0434b0110647f128a93fff77b3525b7c58abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556154, "uuid": "bdbf30e3-f007-44d7-9980-7c886a949654", "value": "13F48E7A61379BA9EDBFC7380331255C4FE9B37AD24BF6787D88648800D0F490A56927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556154, "uuid": "d6c18137-da56-4758-9c58-b987346c92a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556154, "uuid": "f3a528a1-3bf2-4a00-a4b4-07253a6deb42", "value": "12288:iQYP6NsBOpUst+Bkky8VFxeZnUcOAKCQkC2+rEzVNAYE6l1Y+9BtQW9R:itP6NXpUst+Wkyb393ZCbKVNAc9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556154, "uuid": "7c9d1b95-ff58-4db6-a340-74dd08084aa6", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556154, "uuid": "41519aa7-b974-4533-8556-2ba5cd02a846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556154, "uuid": "1dcd8f36-6425-4ecd-8fec-5d8314bbe6bb", "value": "recipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9795fd8-de20-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1625551850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551850, "uuid": "3f0b9f1f-66d1-4488-a70f-31a240517b4d", "comment": "Malware payload (STRRAT)", "value": "2807dc3b20262592c5f707c5d14a631c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551850, "uuid": "060d5caa-f3a9-41af-aa23-a25e31399e3e", "comment": "Malware payload (STRRAT)", "value": "24275ebc1a7d2e6fac65d932c55f34a5c885d768103cafb546a4b52b36af0060", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551850, "uuid": "6daac0c0-9251-453f-8b4c-d37871e2d6a0", "comment": "Malware payload (STRRAT)", "value": "1ab670d4adb4f1f1d9d9e2e2bceaf9ad16f72e80", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551850, "uuid": "8c08d06b-d253-410e-a242-0816c779a62f", "comment": "Malware payload (STRRAT)", "value": "e0b97981630935d49297b0287b57dfb60f048873d878abd12e444416e537d11fc5e75687620e83b35b1ce8a4ee24737e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551850, "uuid": "e5cb7b8b-4a95-41ad-8609-4f1e35f84aba", "value": "5BB3D01AA99DD1BAD21F22BB041CA276E61CC99DD044A82F66FC04551C70D788B97FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551850, "uuid": "87a257d5-bd76-4eaa-b6b9-87632d00d45e", "value": "1536:0vnf1ltzT51wH8Ohng87e36hLt/keWgeZXdfyXVvQoTw5/0c3zavAPm2Rx:0/fbtfcZ7eKTceWgUBylvQt9rDa8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551850, "uuid": "b3d38ddb-c4fd-4c17-9d26-5e58d572b7f9", "value": 107846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551850, "uuid": "fc7a514c-d18d-4ee4-9909-2030c600ec2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551850, "uuid": "45159197-d41e-4d82-b122-19e9c8353118", "value": "shipping document.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4daa2ee-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625587034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "a0dd2071-93e1-4273-9924-f0990c9407ff", "comment": "Malware payload (SystemBC)", "value": "26e9fcf63f321363b555a2bbe423c5ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "9dd5e572-3ecc-486e-9460-48dafe2dfc06", "comment": "Malware payload (SystemBC)", "value": "249e53beb5992ce00d694688998e54743fcc74ad4f2942be7f66596b8c0a8867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "38cc52cd-9528-4c1a-8fc2-e276473a6ea2", "comment": "Malware payload (SystemBC)", "value": "5e7d7acb5e4c3ff3586740dfb556fe5ba53e947e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "4235f284-b474-41b7-8ac7-61fd8621f986", "comment": "Malware payload (SystemBC)", "value": "d02425313d9251864e8f253b76e96f05f917004c875c530cb54723a27ad0ff2396d66163d53f9e33bff3b3be867b6637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "0cd9d834-b14a-4103-9e95-95296013b786", "value": "70058C32F2814837C573363D9C1BA758A83ABF112B3CA9866FF51D485F3A6813935297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "a89c22ba-0fdd-48b2-91cc-6b553472a6f7", "value": "41e286bd81e15d36bb9bceeebfe46ffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "e586f4b6-f47c-417f-ae80-8bd165c82908", "value": "12288:mGpmnrfAsq3NCRRi57t197JQdQ97co9JWPXa+LD9HyrUG8Co9A:myarofgRin1PQGdCPXa+LD4UG8Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587034, "uuid": "aa0d36e5-66e7-4a04-a580-e4e72ded3797", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587034, "uuid": "6187ff19-1527-4ba4-bd8b-d7814f56e2a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "9b142762-ab6c-4feb-bee8-0800af515cf5", "value": "26e9fcf63f321363b555a2bbe423c5ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9155fefc-de9b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625604530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604530, "uuid": "75c1a753-1447-4b44-8dbd-b96408ea2af9", "comment": "Malware payload", "value": "de57b50ddeb32383574874af224b2a98", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604530, "uuid": "fed714be-24d0-427d-816a-ad41c24050dd", "comment": "Malware payload", "value": "25e3873adf19d7e8ba42b472322dbafdfc21d55a2119b81ad9728d6e8e2b0e7b", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604530, "uuid": "2a7da393-9d90-4916-afda-65c58f6a965b", "comment": "Malware payload", "value": "0157403a8cfbb4c17436ef67923fac656177b5c2", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604530, "uuid": "59e3dbe4-d7af-4b16-8d48-196f4fe27bd7", "comment": "Malware payload", "value": "7077d930a333fb34c4c0112cbf72f13fe7d005daa8f46ef2edbd3ffe219341f07f0ed7d95bb279d8eb7a6130a6a479d7", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604530, "uuid": "6cd17663-7470-47a3-bd1a-eebadf8adfba", "value": "72455B9A7A5670E5F47BC2368656A12BB6B135118B31E7CB82404E430F637F5AD3E38C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604530, "uuid": "c8f4161a-ed2d-4af1-8bc1-bfa21c1c84c1", "value": "9d4e8e7b3c2ceb0885480bd38fe7b721", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604530, "uuid": "f1fddb85-9ab5-4c51-9cde-6ccaffc896fd", "value": "24576:56SPF9sLegqTaCM1i/7umo6o3pRk11CvLs4pKyJUa1:5AeaCMySM1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625604530, "uuid": "ce04973d-4544-4dfb-8c78-29e15c7a384e", "value": 1271200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625604530, "uuid": "78fac706-0eee-4370-9d6d-fd48b111513c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604530, "uuid": "da139af8-6810-4453-ae37-ee1a293b51c4", "value": "9663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe4b2c4-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625553464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553464, "uuid": "4bac93f5-2ef8-4bdb-8bfb-639c373ca361", "comment": "Malware payload (AgentTesla)", "value": "51fa1f25c86c4ffa1b779453de9e8f72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553464, "uuid": "7eee5db7-120f-4c0f-b9f7-8bd240f5f8ed", "comment": "Malware payload (AgentTesla)", "value": "26ae1aabf5b3b7236e691aa817a93741d0e825e2c7a39e1c31c694bee0eb7480", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553464, "uuid": "02387f2b-69f7-4c46-bb77-d2e99f1fc77c", "comment": "Malware payload (AgentTesla)", "value": "e2881598b2c64945a9dc8d2fa36ab1244d9881d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553464, "uuid": "b808d717-4dab-4b5e-a2e4-7a85b563a97a", "comment": "Malware payload (AgentTesla)", "value": "19a47b7a00b0ba00870567fc2622e160394c8b22651c084448c3ab0ee18b4edb35fda471c932581dadf2c7647d0ecbcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553464, "uuid": "a0b36bf1-511b-49e2-a546-f299c53c0055", "value": "C5C4022837E94C99D03F9B7B849276528B39F3637223E38419D222590D637D1CD91ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553464, "uuid": "d3f99a6e-6768-4114-8a64-177ea4dc723b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553464, "uuid": "777db462-6980-47a7-9207-8bb16feab886", "value": "12288:lW2OLyyZAwb22/djJW6Ff5XuJ7fIWkE/HuDtUt5PTR:FpwBXWQYVgWp/HbrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553464, "uuid": "5fe73c86-6ba9-40b0-b204-e150e8b7cfe5", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553464, "uuid": "041cc449-7075-48fb-99ec-4d983d116c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553464, "uuid": "44dad586-9120-4ad3-8928-5003127d503d", "value": "51fa1f25c86c4ffa1b779453de9e8f72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0d36ee-de55-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625574322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574322, "uuid": "3e2338ce-abb4-4ecd-94a4-89dd4c29a3c2", "comment": "Malware payload (Gozi)", "value": "aaa13231276a779a6a4d5453691021c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574322, "uuid": "00ef6328-fdd3-4bff-9e5c-28c30f1ae9cf", "comment": "Malware payload (Gozi)", "value": "2785ed572096ff0b03c9d5767023262eb85ef11a817602bf8eaaf6de294256e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574322, "uuid": "233a7322-ffa4-427f-9e5b-fe0f96d880b9", "comment": "Malware payload (Gozi)", "value": "f2d4724f2672330aee83c959bdd3e8b7bf3af4c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574322, "uuid": "a0ea021a-e90d-4050-a3d9-28df86a41111", "comment": "Malware payload (Gozi)", "value": "ffcf73f2d91ac437ddca84961729956adcfe0cb3a8d52448ae34de582b172cda49af6db3186b77fe04a8c52467e2e2dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574322, "uuid": "f20354bb-5da0-4f7b-ae31-6480526c4b4f", "value": "58438F9272E008F2D3925D3429C5B7E6BEBD47706178E0819B630AD67A52563FE3D30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574322, "uuid": "ac5968dd-2839-4fff-a3a1-b3bdeb372ba5", "value": "1536:j3xCQc14ZSaZtXI7WTM2qlalXFL+KuNSMSgvP74:j3xCnnanXdM2qlalVSbNSMSgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625574322, "uuid": "1f9b90ae-c0ab-4677-9501-b6d12579a5bb", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625574322, "uuid": "e4969b0c-e6fa-4b2d-bf4c-c611d846ff27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574322, "uuid": "a352ddd2-5c70-42ee-8ea1-2768ba780a72", "value": "46d0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4020b32-de4b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625570309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570309, "uuid": "1e819967-076f-4eb1-8a87-ca6eb49bd5a1", "comment": "Malware payload (Loki)", "value": "d5f0b27602885a0812c490ccf8a8b313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570309, "uuid": "9f62bfc7-040c-4224-870e-08cb4f1550df", "comment": "Malware payload (Loki)", "value": "29126a5e8627154e25e5b4687de0dd5af09dc1287b4917f7a429a9bb646bde4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570309, "uuid": "ae4b3a75-9c20-44b3-80dc-b163eeadcac4", "comment": "Malware payload (Loki)", "value": "5a8cbdb744b436d1a9a0718f0cdf5e47f672f94f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570309, "uuid": "dd863b02-8c05-4cd4-b02c-5de411c33352", "comment": "Malware payload (Loki)", "value": "ffc2fd9b9250e90c10a035490052ee3705d2ec083bc1205131f47fe6af46864400e792eeb2af66b52f11a160d3171d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570309, "uuid": "ebe07292-1e96-4667-9d1e-38103d90ad54", "value": "02E45C7A60B65BE1EDBFC7381B31351C4FA9B27AD24BFE786D4474480090B450A76A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570309, "uuid": "bcd1b079-cdc3-49d2-b3aa-4822e0dea474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570309, "uuid": "4d543667-f74e-481f-bd73-e567828e0b35", "value": "12288:FXhP6NsBsyS1pusRsqihrp0VPCVgfEUi7zZX8gKMzCP4GvOUI:FXhP6NXyS1plaqih5g9i7ZvKoCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625570309, "uuid": "f0fa4d25-2cf6-4866-ac3d-c221829bd8af", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625570309, "uuid": "797668c9-046f-4f51-96a5-b3b1131cb7b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570309, "uuid": "7e62fc89-5d24-4ec8-867d-ee88566fce94", "value": "Balancesheet-COAU7231833484.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fba76d-de6f-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625585484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585484, "uuid": "dbfe3ee8-a502-493c-962b-425ff6dd7a5f", "comment": "Malware payload (CobaltStrike)", "value": "36440f63c73652e73f0487907b2e8ca5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585484, "uuid": "bf65ae3c-1ed3-418e-bbe8-3bba724969c3", "comment": "Malware payload (CobaltStrike)", "value": "2b0c5224050242b238dc90fe1170856c59c2083836b4472e0e70ebf386c378a9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585484, "uuid": "cb47d748-22dd-4960-b431-8d084874673e", "comment": "Malware payload (CobaltStrike)", "value": "ddf463773c3b7b2b3668379821bc6d31931e369a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585484, "uuid": "02b2287e-d41d-4572-8fd3-2b3aa8e4fb0c", "comment": "Malware payload (CobaltStrike)", "value": "a125f581711ca808693372af4a490e6815ff75ef3efdf9d2c1e4ec976e475ca98928f337ece9ebd9810a33f09542d08a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585484, "uuid": "d22ba695-eeca-4602-b307-6c29d21fc82b", "value": "F163D025E39508B3F22580F4F21616A728596C7BB010EE01A4DB785F774BFB22D78F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585484, "uuid": "643fedc6-e063-4654-bd95-608ae1a1adea", "value": "1536:SkhOSlUzGHakaWRfRvOqtg3eLmsqU44444444444NA:SkhOSlUG+GpGEY4Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585484, "uuid": "11aa79be-129e-450c-a589-ffe13dd2bff8", "value": 69709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585484, "uuid": "ef809c56-2e21-49ef-9e34-64472b147e75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585484, "uuid": "235cf21c-196c-4e22-a11b-f77217425b96", "value": "Reciept 7505704.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76ea09b-de3c-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625563872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563872, "uuid": "41fef882-9383-440f-86d3-2b7c8b8a006b", "comment": "Malware payload (DarkVNC)", "value": "3538b9fa40cd95f8e1b788093866007a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563872, "uuid": "5b7e7028-00b5-4297-a106-7fba73af9c2a", "comment": "Malware payload (DarkVNC)", "value": "2c05cd58376851b90256c6131497d81a57a22a47d62cfd54882f91766cb2d59e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563872, "uuid": "32dd93e0-cc32-4267-a97b-a9911b235254", "comment": "Malware payload (DarkVNC)", "value": "7691160529e3b1f8dfecfcbc4426199756d712a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563872, "uuid": "f0add504-5cad-40b5-bb1a-b8d53c97eee9", "comment": "Malware payload (DarkVNC)", "value": "26a92a53a020a84c11925f47fcb0ec8b2eb70baf162c147ac8709dd4c9ca942a7732e67c0831f8156f909c9f7bf3e993", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563872, "uuid": "c42fa20f-0bd5-4214-981c-d8e20eb88023", "value": "822512717F5EC076D48A4130E47882A19267BC26787B464AF6E43A5ADE333C169FE307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563872, "uuid": "c0648834-eb1a-45d6-9a73-34602bce8751", "value": "12bf876345f3e6a9ef251306e0541fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563872, "uuid": "936243ba-ad9e-48f0-aa09-6b7fcd8c2f06", "value": "24576:2wdHWOEE+iebgGZIHMPIY/VFaE5P4yfyxXcC:2ezgbgGZIHiX/VFaGJfGXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625563872, "uuid": "31b77387-dde1-4dff-a563-8ba5104f4c3f", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625563872, "uuid": "9c367c63-c2d0-474a-aadf-c2affb86aad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563872, "uuid": "01e94363-adbf-43ba-907c-a2913279448e", "value": "3538b9fa40cd95f8e1b788093866007a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7fc304-de3e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625564476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564476, "uuid": "000fa590-a37b-4879-a75f-4fe14eec4796", "comment": "Malware payload (NanoCore)", "value": "230c9effbd24805b39e22ee438dad072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564476, "uuid": "7f1cd5be-5be2-47a7-b2ec-eeb6dc022340", "comment": "Malware payload (NanoCore)", "value": "2c843e853f219d3351e07f0474118c2edf970b3d4f90d3e0f5a9e6298e3ca494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564476, "uuid": "5b0b3dd8-3f7e-4abc-bd34-1ae848a39148", "comment": "Malware payload (NanoCore)", "value": "2006e099fab68bc3df0c870c619edd14efd49ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564476, "uuid": "68bb9a43-4d59-4190-b09d-9000644b8b43", "comment": "Malware payload (NanoCore)", "value": "e3876e04006baaaf8ceead5293a3718b63fd812ad5086087a06f4dbf9888406582ca4366e7b08d306473a33f97279bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564476, "uuid": "f87e8529-d937-4f81-92be-ddd7cd7d7772", "value": "A4659D7662768F91DCBFC7384331E23C8FE4AE26E657E6756CE4384B10B4B404A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564476, "uuid": "518061cc-f87a-4653-b06c-bd589e46349f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564476, "uuid": "9ecedcec-c9f0-4eac-ba06-d8579b11722c", "value": "24576:XwL6zviOn/9+bsDjjbIwyNR2L8anYnvm:e6zvl9+boXIwSR2I+Ynv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625564476, "uuid": "89c89eb5-2f34-418e-a634-419cc8b7cddb", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625564476, "uuid": "7f9840aa-a0ee-4dd8-8c35-c99614203b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564476, "uuid": "32befb6a-c430-47d7-8fd7-acb10e2e5b15", "value": "ARRIVAL NOTICEPDF.EXCL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b8db4c-de6b-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625583913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583913, "uuid": "c0cd3852-0dee-4430-98f4-0f61a86d4399", "comment": "Malware payload (GuLoader)", "value": "63944826ac42e1526801f88d3d31ec03", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583913, "uuid": "698cad23-4ff6-473a-96cd-13fb6469ce06", "comment": "Malware payload (GuLoader)", "value": "2d3a96a20e2a94bbdf23334318314edb8f1c0ca084b04e0b3777116d0c8100f9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583913, "uuid": "6a69cfa1-542e-4425-95c8-51f780a7014a", "comment": "Malware payload (GuLoader)", "value": "14ff44f20eacbe75fd24f96344dd9fad086f3d86", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583913, "uuid": "dcd7ddb4-863f-4a6f-bdc9-59a27d369a0b", "comment": "Malware payload (GuLoader)", "value": "32100bdb5cb57e5df3cbaa5676b0496de8653c7f4b7845e98bf2b8e6dc43d0430f3b9764ddd330332cb29e4a55d5ce85", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583913, "uuid": "7327250a-1d9a-40c4-a595-d79f9b20e97d", "value": "F4C312A228B126C6254A15E916DED989A710BB1846C7FD8EC60F0C67CF1FDC0C8634BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583913, "uuid": "9d667c11-b6de-436f-ade2-fb9ba24c1697", "value": "3072:AjCzYlc2daVUuqrzsKMZS658Q/5cGnxQM30Jlowp:Ajpc2Nuqnsj5xJCtewp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625583913, "uuid": "233225eb-df6a-43ac-82c4-8353a5ddb527", "value": 122234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625583913, "uuid": "2ffd59a0-aaa1-4f8f-a5c4-6c633cf4bea9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583913, "uuid": "49afe828-be32-4565-92a0-077d8a99acf9", "value": "Invoice-NBM01557.PDF.CAB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85da4b43-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625550824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550824, "uuid": "73cb95ee-18ff-4fd1-9233-8c681b512dff", "comment": "Malware payload", "value": "7dc66b8ebb27218efc5fb2faceef2d99", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550824, "uuid": "9541e85a-f17b-424e-ac1f-6c1413596a69", "comment": "Malware payload", "value": "2e056e63b52612a2e8ef66a33adfb334320a854dc5b2f94b424a802a6271e52f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550824, "uuid": "21df9cc5-634d-4497-8ea3-08e89857025e", "comment": "Malware payload", "value": "9ff667016204c815ea3669c9c2b0d3ac9fabfd86", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550824, "uuid": "3e3a60e0-c63b-4460-908b-dcfc20cf4ccf", "comment": "Malware payload", "value": "3729eec319f9226cec3a9b957e92eeab61381cd17748e501a4b67a291751b2f48ecd1f4ed826ee4fb6f4eacf717dfa47", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550824, "uuid": "985a6b51-0355-4346-8591-1f71ac94a830", "value": "8D4512F0DC9C7A11EDF9757A26462175D23AAE84F6408C090F56BDD1AFBB62B071230E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550824, "uuid": "80cc9a94-2bca-469d-921f-2b23c2aeaf75", "value": "24576:HMMiXj0so88Rsn/m3wPLBNP+GDROeWK8elXD4Jdrq:HMMs4bJsn9VZ9irq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550824, "uuid": "2cf909e5-dc5e-4a57-9a52-c0dbd866ba1a", "value": 1269240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550824, "uuid": "7af0eaf1-b0e2-484a-afba-cf8fb6a35b11", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550824, "uuid": "e75ac2ed-dc1f-4197-9894-72333347dd70", "value": "Transferencia.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e378a92-de41-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625565655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565655, "uuid": "0513e2bb-1f3c-498d-873d-c2a35c1f8c61", "comment": "Malware payload (RedLineStealer)", "value": "1acc21279a17e3c916fede86ef4f8a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565655, "uuid": "408ae156-5030-44c4-8979-12c044ee322a", "comment": "Malware payload (RedLineStealer)", "value": "2e641d4ca1ec2d70e05dcfea340e14375c20cc66dcb964c003a43a71ae8ea911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565655, "uuid": "6a5b67fb-eb8a-4ecb-9728-c6e5d014e96a", "comment": "Malware payload (RedLineStealer)", "value": "04cdbd056d8cfff49c51e96d7ab3ce771bc12753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565655, "uuid": "b5d78899-2e48-4995-b8ac-284e1608b3d0", "comment": "Malware payload (RedLineStealer)", "value": "da43d4a9f5384d88a56a636af415ce617774422e25b221fe7ad77f7db3fb920be968cb06a0bba29dcb5e32e9e3147f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565655, "uuid": "48e93210-58aa-4324-86a4-b808708dc99e", "value": "31D47B2632214A2AC37346BF43B2B167057D9E071A62F9DE399037C90F3B697F819971", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565655, "uuid": "bf68da7c-9999-49f8-b88f-e044eaded49e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565655, "uuid": "df3418fb-7cb0-4f68-b2e3-fcf59ebe34df", "value": "12288:HE/ot4OOTNxcgV03MZHseB/Fa64yXuJo2k/WLnJ3Ap1PQ2:co+HTwgqYs48ugoJ2cPQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625565655, "uuid": "94051eb5-7a66-48d2-9c1a-3184755f51bc", "value": 622752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625565655, "uuid": "c23d49c3-3b71-400c-9289-f718d9c5004e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565655, "uuid": "de898c09-e027-449d-87d4-ee93b48e776c", "value": "1acc21279a17e3c916fede86ef4f8a66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812f7c9b-de8e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625598919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598919, "uuid": "132dbd7e-349d-425a-9844-d49e27158b21", "comment": "Malware payload (Mirai)", "value": "f5eb15360eb4070f835906b31099f52d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598919, "uuid": "bf5dd9e7-ec5e-4383-8929-2d021a4bbff2", "comment": "Malware payload (Mirai)", "value": "2f4dbcbee5d9cb1c397f525a989e84d3f4a2be4234f6b1952ea60b3e1da710ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598919, "uuid": "fba4def8-2310-426b-a6cf-ae42773c3ddc", "comment": "Malware payload (Mirai)", "value": "66e3d1328a94dd550463b8abf07ce235dce1b07d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598919, "uuid": "f97a9cc5-4c44-4b37-bec4-780fcb945ddf", "comment": "Malware payload (Mirai)", "value": "ec036be27741cd0ad9d57f4ac2ca71e6c3fa8a6bb54abbbe8cd5bfa2a88dd95f59d0f7be8523ec4a64636d63f5e5d51b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598919, "uuid": "de76632a-f80a-437f-9d7f-201c61107dc4", "value": "94D2F173412A899EF592A0328C7ADDA7171D4182B04D533AA0C2CBA7FDF2902FF50F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598919, "uuid": "2b51daea-2b58-461e-93af-f023312f5f35", "value": "768:CwVjSg90VlP0rJ4uvVpOlkNIHjO9/FKrNzSt:CwVjSdMrnvVpokNIibK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598919, "uuid": "ba56ab6f-997f-419a-bdc2-0a3bdf15ad8d", "value": 29604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598919, "uuid": "649fe467-4450-4268-a209-7beb1a44a590", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598919, "uuid": "be4774df-7e04-4e18-9c21-7c7fb1859bc9", "value": "f5eb15360eb4070f835906b31099f52d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac79e846-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625552606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552606, "uuid": "9ad89aaa-9038-458b-8693-ea5225c1de16", "comment": "Malware payload (RedLineStealer)", "value": "d8d80bfd344ffdd77e9386ab97cd66d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552606, "uuid": "9b724457-e28f-4ebf-88ff-d968f7f034df", "comment": "Malware payload (RedLineStealer)", "value": "30c6dc1cad38616c523e9ad08dbdb2c8b8b946eb83bb8047c2da23a8317c2f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552606, "uuid": "d248f377-0a14-4532-a000-13411e57eac7", "comment": "Malware payload (RedLineStealer)", "value": "b859fde45b78881794e2c3c701e5ff424d055cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552606, "uuid": "6165bc6f-aa4f-4e86-bceb-6629b3ba7608", "comment": "Malware payload (RedLineStealer)", "value": "48835b18566f02900f36e6d3d4fdb3230354840b645b84c05f015f9af270430b5856535c552d9f3fceb0bae2008197b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552606, "uuid": "d389ba18-ecd5-409a-b08d-6f4c1bd2de1e", "value": "AC64F1217550E933C15345301DA5DFA1A9EEB431A671CE437B8E2B7E5F213C1AA7B30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552606, "uuid": "e0461b2b-0b12-45f3-b5be-ddd6f41db8f7", "value": "31bc5b00e4fb196a092d39676ddbafcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552606, "uuid": "108a3121-c5e4-4aa0-8ba0-eeab656c0666", "value": "6144:IW25optXjiv7YFCvrNt6vNEMtZtx85YPcdF:IWJXjivc0z/6lEMtHxcYPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552606, "uuid": "ad21d075-b448-4a8d-931d-84faa9bdcf81", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552606, "uuid": "644dd8f9-0723-475b-bae9-fc8620908712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552606, "uuid": "bb870041-fb5f-4b75-8016-ba7f53e060bc", "value": "d8d80bfd344ffdd77e9386ab97cd66d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae91476-de6d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625584897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584897, "uuid": "332c6e20-31db-4a66-8b46-7e4e5d483dfe", "comment": "Malware payload", "value": "8612c9456445f26677fd841093ba9c43", "object_relation": "md5", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584897, "uuid": "e8b27bfb-9eb7-4be8-8fe3-bd7f9d279e70", "comment": "Malware payload", "value": "31852390e0981c4e5f872b5c55037e24c455b46b2217d9115ba8374ea29829e7", "object_relation": "sha256", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584897, "uuid": "0b309401-8837-452f-bc6d-f3e342ca66d6", "comment": "Malware payload", "value": "1984a0f9f17e07fb4b5dd2c3720e737b8e5b3f01", "object_relation": "sha1", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584897, "uuid": "aa01ee16-7e48-44b6-9489-d5357e1fb0b5", "comment": "Malware payload", "value": "08a5cd584337cad862cbc8203af9a41d0da693dd2280ddbe950310c70132ac679dda03bcd2d7bac0ccb2f946f212ec8f", "object_relation": "sha3-384", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584897, "uuid": "f11c9ae4-27ff-4f7f-8830-87d1a2f18859", "value": "5142FD038D554BC7F16897E8FF134E986F8A1B59F4873AFB14620EDA7A602124C4D47E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584897, "uuid": "22981c9b-281a-4ffa-9294-e6294cb71b3a", "value": "192:9f94PkaB23FCIkUv88Gp7gj1ETW1u6vUMroqC+NX/ahIH:914PkaBiFCTkj1Eq2Coa/sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584897, "uuid": "8d2949c8-76d4-43c8-af7f-a0b82ac2dacf", "value": 12967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584897, "uuid": "858dba24-bd7c-46f8-be06-c94447e1bfd3", "value": "image/jpeg", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584897, "uuid": "4609ec0a-e7ed-4728-907f-ecf4e9c244b6", "value": "payload.jpg.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c677cf8-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625587288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587288, "uuid": "ac0b0a99-841c-42cd-b076-cb93324e4505", "comment": "Malware payload (DCRat)", "value": "320013195d74908df078cbd9353e4c56", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587288, "uuid": "fc7ffebc-fba6-4557-9f2f-cd65e4710079", "comment": "Malware payload (DCRat)", "value": "31997bf6fe956c521bfae0d2a3cdad571889e44b41313ab745b3e82dfa73fb8a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587288, "uuid": "00a73e7e-3295-4458-89d1-a85192f2df38", "comment": "Malware payload (DCRat)", "value": "216bdce3fca89b7dc2232e1a30486bfef8acdbff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587288, "uuid": "16fe9bb3-d012-4e28-a9f9-ce2ff519fc04", "comment": "Malware payload (DCRat)", "value": "7c1ba5e55e241227498832910719d1d56956a933beb58bdb635900488d74da4e89841b82d78475a0e32c0a5d1a3ab894", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587288, "uuid": "b89aa230-7190-46fc-a3f2-fb4554359c35", "value": "7A646C2927EC9A21E1BF87BED4F195068B70A4127BA2FB4F09C1569D5C23341ED80F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587288, "uuid": "8e7b3cfb-2c7b-41bc-aa4c-cac396dee26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587288, "uuid": "b943b55a-8fcb-4c83-af5b-9b38de682227", "value": "6144:zqqDLtEcjvSao8TDoBeZyyxHd9B44hLEQHPn9oYgFRo4TH45RGbbu1jDBU:uqn7zo8TrHdL44EYoYgFRrTHURPR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587288, "uuid": "c9a3e683-86cc-422b-9fb7-ad19390e3102", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587288, "uuid": "4b098a73-da71-4999-b75a-dec6c32c4c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587288, "uuid": "cf78cff0-3050-4ab3-a0b7-1693e12a17be", "value": "320013195d74908df078cbd9353e4c56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12317f6f-de2f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625557931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557931, "uuid": "23d0a1dd-185e-4945-971a-d93fc8833320", "comment": "Malware payload (SnakeKeylogger)", "value": "7e863977442bebf591c56238ef493972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557931, "uuid": "fdcad041-a587-492f-a9b6-31f3cd3224b3", "comment": "Malware payload (SnakeKeylogger)", "value": "31f6705688a80570935edc1587aef0b6fdd7828c704fdc6848ce6fb9844609b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557931, "uuid": "e0638bf7-049c-409f-a863-2f5b70f20d20", "comment": "Malware payload (SnakeKeylogger)", "value": "beebcd6fdaaf5972c539b2d60adec2ca6b381ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557931, "uuid": "06c02b21-7135-45e8-a092-e32b4cb568b8", "comment": "Malware payload (SnakeKeylogger)", "value": "558f47bd7c342258ba83a83bd59cb073e2ac5bfc7336ea3deeb5e0a859adaeebf621adceb0387881b205ae37b4caad80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557931, "uuid": "fb6b8853-f1a3-49e2-9c38-e52cc58e1a3c", "value": "F6F44B3D59BE213781BDD3898BC88D2BF840D67B71117E7998D707A5870AA8375C223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557931, "uuid": "68de7fe9-9661-405b-a9d6-a2184888e277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557931, "uuid": "ab808cfe-8442-4ff2-b38c-9db6c8ca3427", "value": "3072:BFJPixOit7T5D8VzaTDhSfcwuPwVUxO/6iGnJd95V/wNVzg7w2bH3X2:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625557931, "uuid": "472223b8-01d9-4f59-b1e5-53fb49a7ddfa", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625557931, "uuid": "a9c4dbd1-3c5b-411b-9827-96feb449527c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557931, "uuid": "657e5932-88b1-408d-b6b3-87df34bf241d", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c500126-de57-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625575235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575235, "uuid": "c93c7359-439a-48ff-8623-262d78217bf0", "comment": "Malware payload (AgentTesla)", "value": "1350812515042a42dfe26fd52aa57795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575235, "uuid": "0c495112-d8c8-4ac4-a1f4-721ab4c79a12", "comment": "Malware payload (AgentTesla)", "value": "32055ea1cc29d0af201485c7f72cefab05f19a381850ba9484ffdbde10c67dc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575235, "uuid": "9c51b333-8bec-464b-80db-2326d85d803f", "comment": "Malware payload (AgentTesla)", "value": "66b344f4ce76ce3ba2bab0dea1ce4f2868577424", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575235, "uuid": "5323da13-826f-48d6-b6e2-a076c360f8e8", "comment": "Malware payload (AgentTesla)", "value": "5baf750b8bc060e22a0db50b7c1c0feff51c88fe708727d0ef007f806a3d5416b93bfed3bb094ca539d920789c03f352", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575235, "uuid": "05692f9e-68b8-4227-9707-cb254b94575d", "value": "F8C402242BED4C9AD17F8B7F9493B6014B39B7237613E3441CC562A91DB3B818D8277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575235, "uuid": "f562d5fc-ec3e-41df-a9b7-f1db9e75861e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575235, "uuid": "db90d2e2-7f34-4060-a21a-9578f44096d8", "value": "12288:mW2OLzoAwGRNkJcsLnLf60o3QvqCEqsi1l8ydAjJ1YuD:NwvJxLnGJQDEqDkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625575235, "uuid": "3fc9bada-9322-462b-b281-036bf374ae46", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625575235, "uuid": "490b3183-c1d4-4b38-b925-59bc4eeb2d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575235, "uuid": "e92b3b33-fc7d-4388-99d5-4f0d15223505", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95daa8fc-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625588646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588646, "uuid": "a8c5a376-963f-49d8-984a-90a132517208", "comment": "Malware payload (CobaltStrike)", "value": "5de6ec9265f79a31a9845c8a504d28f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588646, "uuid": "d99d1e90-e838-4a17-bceb-6ac161d34587", "comment": "Malware payload (CobaltStrike)", "value": "32fc03caa22bc3bbf778b04da675e528dd7125a61da6f9fc5e532230745bcd8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588646, "uuid": "904c376e-a158-4553-a610-b6227e3ac472", "comment": "Malware payload (CobaltStrike)", "value": "7b6621202ac7795e89891b7bd65e769ba6c267c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588646, "uuid": "5091c909-bd03-4794-a58e-c87f76d6a692", "comment": "Malware payload (CobaltStrike)", "value": "2a40f7a62af957d366e508b3f640bf0753ee7f23573e713e11929bdfc7139b21bd9e8c1eb161a1f83167788e2eddbb68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588646, "uuid": "aba73684-571a-4317-a8b6-263e2e1c66db", "value": "5E741215EF3207F9D8CB183B4A4B907FE2567622AC90C5378ACAA9B61050DEED475233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588646, "uuid": "af013674-e01a-48db-b461-403519d3720b", "value": "f09dd27db7b2c002f57b0dee04d67cef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588646, "uuid": "d6cd653a-afd4-4ab8-b8bf-80bc1734f1bf", "value": "6144:wPpBMawV+ebB2QfLkTpNyJUQM+OpolEpxtQPc/rlHYk4xpV/3JDM12zqog/fI3iY:TawdgQjktNaUl+p6r4pN3ZrzWg3iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588646, "uuid": "964009f6-f705-44ee-be27-d4ae37e24038", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588646, "uuid": "2bb9ce54-3923-43db-ad9f-1f8139e4bf0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588646, "uuid": "778a3640-4183-420f-a0a1-db0179dbb37a", "value": "5de6ec9265f79a31a9845c8a504d28f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566d2bd5-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625584245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584245, "uuid": "f4ebc3e4-782f-4562-85d8-625660eaaa27", "comment": "Malware payload (Formbook)", "value": "58d3107a2b92a5e18c89b78eed4fa5c4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584245, "uuid": "63b0cda6-cf1c-4c80-add9-e485169dbda4", "comment": "Malware payload (Formbook)", "value": "33a4ca06e240bb7b16a9db28a10d1cb34218970bed0402f5328aadab532fcd1b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584245, "uuid": "11e7c179-47b9-4af0-aac0-80f7b5cd3c37", "comment": "Malware payload (Formbook)", "value": "7fecec69b202cadf12565883cbbcfb4ea8dae8f6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584245, "uuid": "3f1df6db-c2e7-4e35-b9e4-9e235a325e90", "comment": "Malware payload (Formbook)", "value": "1e0ac7f2a748876f7bd4ed08dbf19041fa5017711541d9e3db3ba94ff9feac21b86544dc84268f93b1f6ae45299beb68", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584245, "uuid": "26864153-8756-46f7-aec9-e9194d15c8e5", "value": "4B551214CAE78673EFFCEAF6279A863C35D9AD487D21C06DC22872429BB11F4117B509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584245, "uuid": "1d55fedd-450b-4c02-9161-dbccfc9de1c4", "value": "24576:IK6yGW6rFtyzGdPaUU7lugV6rxK/TfAewiKwV2USOMvh3FAVgph0IWA108IiFm:I1WgcsPat7lV6M/T4ewiKw9eoV6d08Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584245, "uuid": "9e7d0af5-2a58-4a2c-a6d1-c315d967c3df", "value": 1298632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584245, "uuid": "666e8621-ef1d-4ed9-b8bd-06c3cbaf9ed9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584245, "uuid": "8393c3e9-d8ed-452d-afc2-09fd35277acd", "value": "3456_RFQ998778.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895d67b-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625549459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549459, "uuid": "a53b6577-90f1-4f57-a082-06d9502efa7c", "comment": "Malware payload (AgentTesla)", "value": "2b91ba0a89ac19d2de47c38c4bdc84f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549459, "uuid": "37295cae-9e39-4812-9bcd-40a8408aed26", "comment": "Malware payload (AgentTesla)", "value": "33d1397a0366fc393fa61f7f2a9aa42c2da10a255edb6e08f49edeba3fc74b3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549459, "uuid": "d4e60b77-142a-416e-8155-644cac7c6834", "comment": "Malware payload (AgentTesla)", "value": "096ec724d668d351c0721b4711b1418d4a5ea295", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549459, "uuid": "1fa58290-f0e7-4838-89e7-c16378cf2c00", "comment": "Malware payload (AgentTesla)", "value": "caeb802f61b5dde798fab59d9ec28ba0b46ee99109d69cc3f6ef6cc202c6fb9c75c3324b18283359c2dcad940de1dfd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549459, "uuid": "1220a946-c172-454d-a981-c71efa32d66a", "value": "FFB42332EB491236AD45C8B9269572B495E77ADA6CFCC301CC6F347C935AAF23086C4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549459, "uuid": "bd42693f-bcd1-4c6d-a0d7-9397eb7f96ea", "value": "12288:XffqgHV107eoU4YVNSW5xWPFBb/veJ2sImBxYiuHlUX6e6pvx8i:vSgHV10e2YNlxWdB7vi2sRlWFeSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549459, "uuid": "d58af4bd-9d8d-4ba8-8913-ca02ec82a609", "value": 509887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549459, "uuid": "ab44ef4d-fb53-439b-ac8c-f5346d81ae75", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549459, "uuid": "93444368-9784-4970-b0d8-6b1333ded509", "value": "DOC.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecf10a4-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593735, "uuid": "2fbaf9e4-1a2f-49e9-8d01-691fb26bd2d6", "comment": "Malware payload (Mirai)", "value": "663e9e08b9c9a6e80a4582ab18d490c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593735, "uuid": "eb98fae5-5cab-4e22-a3c1-48c466237378", "comment": "Malware payload (Mirai)", "value": "35b4454e1c952a3117d5926568838053ce15b5ec5b37e461c2e8793dbf087ef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593735, "uuid": "39a0929a-0614-4a9c-99ec-91acc9ed9c63", "comment": "Malware payload (Mirai)", "value": "4196c8d5450e52f949ba81c2d470c35656e4574c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593735, "uuid": "a84dda57-978f-413a-8a05-394707e2466c", "comment": "Malware payload (Mirai)", "value": "6e1300fcffed7f1e697c98544fe2e3fe29fd42d87fc59a935ce0680badc47a6982afc6078c161fc7bc78d225710860ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593735, "uuid": "ca617786-c900-492c-aba5-00c9bc471bb5", "value": "59332ADAB902AD7CF99BE6BE80160E0AF23123501053073777ABFD937E331549956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593735, "uuid": "3e021f20-e8eb-42d0-8fb5-7c3e971bf14e", "value": "768:g2e+kfleFXNvbejhIo/0F9wQvRERgFH8FQeiPubWevGpi2kJTiUWLC38Ym:9wfk9tetMFT3FGPimbpui2kJfWLA8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593735, "uuid": "636b612e-89c9-45fa-9dce-14611955e0d4", "value": 53048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593735, "uuid": "551e4c39-45ef-43f4-9662-a6957adb987a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593735, "uuid": "65cfe83a-28cf-4aac-83a4-26b6bb8f9ec6", "value": "663e9e08b9c9a6e80a4582ab18d490c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933d101b-ddfa-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625535384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535384, "uuid": "a49ccde7-f8ee-46a5-bec0-951c7173cc26", "comment": "Malware payload (CryptBot)", "value": "e53e5d09597782552953de1b7a74df06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535384, "uuid": "7d696f12-94b1-4b75-abd2-dbc42a0b45cd", "comment": "Malware payload (CryptBot)", "value": "361dc084efc29ddc0a837710fc28a872389e3a61413e5c82fcbefc1906c7b29f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535384, "uuid": "a9cdaea9-1f88-4152-820e-69da4b87f4ee", "comment": "Malware payload (CryptBot)", "value": "9e0111f30fdb7e9b3a5b5372fed19f8e212dde3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535384, "uuid": "da08b7fc-1a78-4bfa-be5a-c9897eb1e7c5", "comment": "Malware payload (CryptBot)", "value": "facc9394a25f2b7c883402cc328dd8cf1802c1e0cd8bcd504f2cc7ed05e646ef6ca7f4e3ffc8d97a03ade69242f34e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535384, "uuid": "0297bbdf-e6d8-49cd-b3dd-6d7507e57c5d", "value": "7156332693418977D2A15A35D80FF1BBF42BFB841F7821CF17C4497E6C326292BB4299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535384, "uuid": "e52edffd-9923-4036-b544-5ca5a496943b", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535384, "uuid": "de081b46-a0f2-48f5-91d5-1c9b526d5c9d", "value": "98304:pAI+5p+goreqMswPavGIM45Uz8hyraVTe5fh8ndVttAwor7B0DIFIT9ZrQIQq+xZ:it5p+gyhio5UzQbM37yDRZcBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625535384, "uuid": "5e124166-d768-4bc9-8905-28b67657148b", "value": 6296195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625535384, "uuid": "0dff3a34-f47c-45e4-86d6-13f77bd61d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535384, "uuid": "2204f279-1b45-42df-a761-5435b4dfb661", "value": "e53e5d09597782552953de1b7a74df06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e75988-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625550637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550637, "uuid": "cfadd7b6-da27-422e-97bd-279cdc0dab1c", "comment": "Malware payload (NanoCore)", "value": "6bcd03290e5391d02606d8f71208e861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550637, "uuid": "8ce7f666-7703-4928-95a9-07ac71ae39ef", "comment": "Malware payload (NanoCore)", "value": "36f0ab712574cf8d05454dbbcee60591cf0b3674edb8bb68cb34a67eaaea6b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550637, "uuid": "9db7d324-fcff-444a-afb0-f069600520b8", "comment": "Malware payload (NanoCore)", "value": "858aa784b3c31740186a87dcbf0b6faf8890050d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550637, "uuid": "3a94e876-81b4-448d-a240-4c98c4f42e06", "comment": "Malware payload (NanoCore)", "value": "7dd88b15780882153158d314433a3fe30cab682d5236f892f39e573c6aef5f8216ccaab6a1c30b7faa7eab368cafad41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550637, "uuid": "a7321b48-210b-4f57-9d26-8c5de8a18d02", "value": "2914CF1637A8493EE2DE8679601252579378C2E3D8C3F3EE68E855B39F563E4060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550637, "uuid": "f5a380fc-59f1-4d72-bdde-a54c0a9b7b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550637, "uuid": "0afff4b3-1795-4f65-8064-95378af70381", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HImZNZ5U/S5u7LgegC384Fd8DIv:MLV6Bta6dtJmakIM5RD5b5c8evz0Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550637, "uuid": "182455c9-316e-4f32-a8ae-a2a10af917be", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550637, "uuid": "74625ec7-2e41-418b-83af-60705b616de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550637, "uuid": "fac973c7-1321-4db0-b905-c8778546cd8d", "value": "6BCD03290E5391D02606D8F71208E861.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b50d258-de41-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625565677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565677, "uuid": "94782eaf-b3e2-4093-b42a-9d29ee128314", "comment": "Malware payload (Formbook)", "value": "7c5254e5528788e424387834abb4cdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565677, "uuid": "5cdbe565-8ae5-4349-bb00-71e445bf4531", "comment": "Malware payload (Formbook)", "value": "3760fb75e6479b6ecf20f6d5a4ddda0b6a5c7c0e907c43b92a0e1712461c6b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565677, "uuid": "0668f62a-1f8b-4a98-8217-a8efa1772570", "comment": "Malware payload (Formbook)", "value": "5d8c82e5ce2dc683561a486c8d0a446f44127a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565677, "uuid": "0e8f63b2-d7de-4c61-a7cb-658e52adb700", "comment": "Malware payload (Formbook)", "value": "695d39f9844e59689058360f2afe075480554debd15d5bb408f6f774fbf10be1b4c16e9873353d54cef79d9f014e8e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565677, "uuid": "9745f4ea-b8cf-4018-9985-346a4d9e6de7", "value": "50F48C9C7650B6DFC85BC936CAA81C24EB6078B6830BD343A45712ADDD4E99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565677, "uuid": "8be4e64a-9aab-4bcf-929b-1e868b7dae0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565677, "uuid": "c54182ff-88dc-4f7b-9df3-f43a384f7145", "value": "12288:PsRuFZlgtXFs30qqAkkeMoxJF7VLVBegc34MR/5fRPq1t4YGdaSTi15Ky:PkUZlcX20EIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625565677, "uuid": "de463602-eeb1-422e-9584-81f07835bf33", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625565677, "uuid": "8baaf8b0-9ee4-4ab7-aa3f-a9b0137a5f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565677, "uuid": "23b65eb0-370c-404e-885c-90a10c8ff9a7", "value": "Manorama___RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd1abb5-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625549713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549713, "uuid": "88bf3d56-3f67-4195-980d-acdb680b4509", "comment": "Malware payload", "value": "68f6f53ad3002d79ae3fa563c7af529c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549713, "uuid": "c13c5398-283e-41ba-be6b-80dd628530cf", "comment": "Malware payload", "value": "37bef47276edb2c03eed3e9c06065746676b874bc5b66fbf0c7ce167de3efc52", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549713, "uuid": "6d3757c6-d5cb-4486-a444-2e99122c7cc4", "comment": "Malware payload", "value": "9579cfd192e3817f27e4138f64193df231544ded", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549713, "uuid": "a4f5e87d-9e73-473a-91f3-cf1741e7c661", "comment": "Malware payload", "value": "5042ad0dd393b283c9b9489162c15400e00fe1d2cf0f8bb48d89e8ae2674957720e0f412b96133302a6c2a8f4663216e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549713, "uuid": "e7d1f1ce-ea65-4209-8b86-74e0da07efa6", "value": "AB4533D2B76CDE89F658D8AB885F0D40FF9549CF9E1608106BD4C1D6F290B92EE3940A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549713, "uuid": "4ddb073f-e264-45ec-ae48-58cf098395a9", "value": "24576:67VvzQlRNrbXD6+pvWPuOlXEYDrltt5halyJQwqSR7lwfuWE+f:2+f3XGKEKYDrf/QlyJQwxR7+uCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549713, "uuid": "65d96123-2dfe-449c-87ae-1f4e77a6722a", "value": 1220366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549713, "uuid": "a4fdbbcb-7e42-48e6-886d-c76607daa2ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549713, "uuid": "a6eb4715-2b3b-47c2-a3d3-389db07e0071", "value": "Photo-Sample 7t09250..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c06521-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587817, "uuid": "b9908289-3608-4926-99e4-35088ec1ed88", "comment": "Malware payload (SnakeKeylogger)", "value": "5884c08f7eb5490047e223bdaaa8a4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587817, "uuid": "7a1ad603-4287-418b-9f13-c8d41eb189a3", "comment": "Malware payload (SnakeKeylogger)", "value": "3914a1dd5bbef9edeceffa718d5006dce7347b1a3019b452ce754605c0e32e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587817, "uuid": "05c75d9c-bc3d-4bca-bc9e-376d057b722c", "comment": "Malware payload (SnakeKeylogger)", "value": "e69e691975d326f2a8dcad262c3c89e896884fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587817, "uuid": "badfbf99-a077-4466-8795-91b8930760d7", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a927ce1ac7aeb1cd28bc8fab3b081b1e22c002e258caf147f61b0fcbcc6a70f7603696a0414b74f5ee43320f90b523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587817, "uuid": "d3074046-271f-4c51-8343-45e8b7a66a60", "value": "77358C7672728F91DD7FC73C8331561C4FAABF7AD352E2786C94709A05B1B850A12A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587817, "uuid": "dfd6fa33-e5d8-4fab-9faf-af26b5dcc876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587817, "uuid": "c6d5f396-40a6-4d2f-aa8e-f95658ae8337", "value": "12288:vEmBaIMVjLz7TOKCiOces3gVZsZZZsZb9bqnV5UDSDihcjBkpjCWRJsP0NmeeK7t:PiORxgUrcjBkpjCUaPzeeat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587817, "uuid": "efb696af-377e-4a9b-ae44-d558e86682be", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587817, "uuid": "86364724-130b-42ea-be7e-55ca4b44afae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587817, "uuid": "37af257d-ea26-4182-a758-271fac50f4d2", "value": "INVOICE_070621_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dbd45b-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625556078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556078, "uuid": "9f8f3332-9b99-4898-9f6a-756e8748cbc4", "comment": "Malware payload (Loki)", "value": "d034e4dba29e649f665666027eadd43a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556078, "uuid": "1b1891c3-5202-4cc6-92a3-bacac28f1c40", "comment": "Malware payload (Loki)", "value": "393ea3f7449b31e164eef3ad26b5deba8f9f11c45cecbd0dc55c975ff0793f86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556078, "uuid": "cef1ec4f-6682-4831-8633-7c9a6f12a4e9", "comment": "Malware payload (Loki)", "value": "9f902504824075c6925a5e59c7633b85b59de9e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556078, "uuid": "10f04821-9ffe-4440-a073-dc66028e5150", "comment": "Malware payload (Loki)", "value": "010758067644c5d9e64b0d601ebeb2137a21e8b04775ac85a6db6efa43af41d430c008667937634bea6c945d2d6dd0c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556078, "uuid": "284532ac-4b38-48a4-9500-3d401d0fdc73", "value": "5DC3027A77E0C8B7DB124B710E76195B9FFAD20410A096077B20AF9BB3672D5560F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556078, "uuid": "d6c54852-1f79-45cf-a40c-fe383748a4a5", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556078, "uuid": "1db674d8-e25c-465c-a25d-145cf8a80604", "value": "3072:iBkfJpRXATwMdFCcGbZ6PXxdrRhHfBmbiadQieqyLslpRhPmOr9hA2:iqjIKZ65Zr/IbioQdRORhPh9u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556078, "uuid": "9f637f86-3e0d-426c-bca4-92bc70d7a48d", "value": 129531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556078, "uuid": "472e2796-71fe-4698-b7f7-4da2c699baf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556078, "uuid": "297450de-652c-458f-8ff6-87739a6453ff", "value": "d034e4dba29e649f665666027eadd43a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5ee0a8-de38-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625562052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562052, "uuid": "924c244a-7dcd-4deb-a93d-7854f89a1802", "comment": "Malware payload (Loki)", "value": "e2077dc1b7e86dd4af2c9cc401747755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562052, "uuid": "e24f3fec-b79f-4de0-8a72-21863951338d", "comment": "Malware payload (Loki)", "value": "396c0b6670c451a6286a8ebe434ef20bc465c6a01713ecd78d814d423de8ca2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562052, "uuid": "e6b9de86-16a6-4053-a990-56c1cfe35a13", "comment": "Malware payload (Loki)", "value": "d637b3c0d23313eea5bf48fe6c5d3c5d12fda29a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562052, "uuid": "524cc8fe-7806-4688-8181-758263ea5e76", "comment": "Malware payload (Loki)", "value": "cf7a9962ba3e741d34b0422c76ddc8d8c3d8a7564bbbfdd2d3a01a445172fd3562666bf54c6ee840a7e5ce4fcdd4e544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562052, "uuid": "40bcb0bd-0100-42ed-a7e4-d6ba70109d2e", "value": "1BE47CBA60368BA1DDBFC6380731EA3C0F69BE76D14BB67418C4BC5730C1B550A66927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562052, "uuid": "ce474dcb-d231-46c9-b2d7-b1e222dad2aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562052, "uuid": "348d585b-1e6a-4c4c-a105-9d5c9cee447b", "value": "6144:mjLasmg6NEdrBR0nXmFbgnvlxmWVxu1ZOvFcd+ezqGGkUFdE9L9Lkx7jdvh1eK0n:y76NsBanXmu9cwzcIBkUF+9L9CdjeTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562052, "uuid": "8cc94eb0-6227-474f-baf1-414cc34c1a21", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562052, "uuid": "6b4ee130-03e7-4f46-ab97-c6912b0a552f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562052, "uuid": "cb71b7ca-73f9-456c-9efc-321c85d00278", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e863469-de44-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625566998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566998, "uuid": "d4c18007-d5b9-45d0-8c58-d8fb8436fc5f", "comment": "Malware payload (RedLineStealer)", "value": "ea6c614c0cd9cc9bdc0d7ef674081438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566998, "uuid": "c1a8b140-7a9a-43c4-9488-260d1d28f24f", "comment": "Malware payload (RedLineStealer)", "value": "39b1072b1ee46585dba3bd084fd4a076153537660764a9c3759317d73dbfb425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566998, "uuid": "4f7f5ac8-61be-4586-808e-73e33ee90d96", "comment": "Malware payload (RedLineStealer)", "value": "b0dc7f8b50ee243d6a68bd205bf9cbfe0a36a4ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566998, "uuid": "ed9af652-5f90-42e0-bab7-d994c5ef0a7e", "comment": "Malware payload (RedLineStealer)", "value": "c1e5cebc3d5a7606a913b3969923649a0d9ea68c8339eecd0d8ff6c3390814f7983e01f812f16ac63310b53b6e2b7293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566998, "uuid": "e0474e76-7dcc-4a55-9b78-8ce0968e612e", "value": "9554E0113A50C833C07A04349A24D7F1AB3FBD726965C54BB7A53F6F6F3128256BA326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566998, "uuid": "8ffcd43f-354b-47b1-91ae-864b2318583c", "value": "cdab0fef7b5479a045b4ff0657b0733b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566998, "uuid": "9797df84-d550-489c-b93c-3027fa727bdb", "value": "3072:PqH9rNsDFcfBbydjim2NUc1Ko6OeqRo1/Fqemi5mHprqyRlG5YFmDl:YEF+BbMimc1MG61/Uej5mHprqmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625566998, "uuid": "88021a50-4083-4da2-8990-8eade05258df", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625566998, "uuid": "8f1d380c-8d1d-4e1a-b6a9-b66bc4c42ae5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566998, "uuid": "28003a32-c2e1-4281-865e-52c7a86c76bc", "value": "ea6c614c0cd9cc9bdc0d7ef674081438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4edc77-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625587855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587855, "uuid": "fa77fa85-d998-41e9-a8e2-08356afcf422", "comment": "Malware payload (GuLoader)", "value": "9efeab74699341e695f8fa75b511b677", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587855, "uuid": "4d3bbf7f-d5ec-491f-b2d9-e28146433f31", "comment": "Malware payload (GuLoader)", "value": "3a9623489e452d4cebf1aaaabdd81cab207e37931b81652ca67336fca57bbb6c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587855, "uuid": "d8957979-dd9e-42eb-baed-60d92eda6a96", "comment": "Malware payload (GuLoader)", "value": "e6864b104a2a02acd62ff122e1232f2db57fbb1a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587855, "uuid": "fa8798f7-40ee-4478-88e3-e8eedf6de5dc", "comment": "Malware payload (GuLoader)", "value": "b7a095b2792aabddb34eb8e5fff69bec990adcb77471dc92d0ba4972b913b4a59d079d2280bd445af74244b22d77ebeb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587855, "uuid": "256a4f7b-f0d9-415a-a5ab-a49f804ec9b5", "value": "32D1D9897A8530D4AF26D1FF3E1B5190D00ACEC5964D8A5CF650F8E9FCD580E968FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587855, "uuid": "e761f7dd-50eb-4de4-89ec-768a142c6091", "value": "96:fJMslhSRxwaolKzLJssmT2N6xcgI2MZvKjmMYNF45iad1UiA88YsseuFpVJdEwLf:fJM/VoleJxE/fMZSjmMYT4B7LEwL02mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587855, "uuid": "43eaddd9-0955-4434-b7a9-c27cb973c8b6", "value": 6608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587855, "uuid": "f53c95cc-277f-4a2b-89ff-f75ec1879d80", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587855, "uuid": "d77dd5b1-23dd-4818-bc72-245c1fda9120", "value": "iso certificate.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b450a0-de93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625601148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601148, "uuid": "1cb720bc-3aa8-4142-b33d-5b20e297dfd4", "comment": "Malware payload", "value": "f0d3ee0f5f9d9536ea2a984136327498", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601148, "uuid": "cd770eaf-c255-4660-8975-699bee2dcde1", "comment": "Malware payload", "value": "3b01ec9f4bb821aee4f6699d6003f759e27215521f33b785ff2e6c7ea083da98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601148, "uuid": "411ddcd7-57af-48c2-a59a-f248ef4b8128", "comment": "Malware payload", "value": "769e87cc080b03dd8185cf21dcc2407b1f3cc235", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601148, "uuid": "233c6336-dcfe-4f3b-b967-cf3cb338fd8b", "comment": "Malware payload", "value": "7152e41e3b675a244661c6b43db52d54f4823aee7c412b830add9b0a577502ef5ae1f3b8cb8c6cf56b45306523894bc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601148, "uuid": "0a460570-f108-4adb-a80d-9d28e8f2eef2", "value": "FA8294417262C617E6655B364DC2EAFB3B31BC51AF5683273284B72F3D3A380CA12A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601148, "uuid": "cceea98f-fc87-4caa-bb3f-496de6bde989", "value": "192:1vZWJlv/wMsWuelE0ABTmsiCQqvS/eOv5i82aixGa0:NEz/E3TmsiCQ3/oag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625601148, "uuid": "241dd3af-516b-446b-9a0a-5a08263addcc", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625601148, "uuid": "e9d9e8a4-34f1-4e19-9bb4-4e1f9c9150e3", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601148, "uuid": "e4c87968-0f9e-4014-852d-9bce1fc200d9", "value": "SecuriteInfo.com.Heur.624.4716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e9fb39-de90-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625599867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599867, "uuid": "17088f55-1762-4ab7-8edd-144a1f6aad1f", "comment": "Malware payload", "value": "9210ad7ad21f24f7f4bc1bf1e0fd70a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599867, "uuid": "f6d6c750-5dd1-4653-ade9-ad4947e48c9f", "comment": "Malware payload", "value": "3ba615a4d99b560c58bed9e63c8ecd2c20dbc71560ec1fe51ca2b78a6b8309e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599867, "uuid": "c1d51acf-3475-48ea-ad43-61380afcd23e", "comment": "Malware payload", "value": "85ab956d8aedd28b0dc2118441687bd8d05cc927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599867, "uuid": "8e526b5d-3f95-4bef-a41d-a8decc5a80c6", "comment": "Malware payload", "value": "dc8dc3c10de04c765d17d8cc362a4270a72b7b00d7067ecf253665ac49d3d2616cf65b9de4902d040cf4fc30b50ed694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599867, "uuid": "6c079e47-e791-4b69-9411-be335c0df4f9", "value": "459401866A140172D5650DFFC07AB3C80EAADE070722E158617F7DA9BC773929BE8347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599867, "uuid": "ac05c3a2-575b-4598-9044-4f971cf2cea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599867, "uuid": "983ace68-ec63-4f2b-84c9-2da292987edb", "value": "6144:sC//AXkHqTHzVbqnnb+mW2xmvW/yW94QuOwjZM87bb7Ha4MyzQ:szGAMnnb+syW/r94QpAZM8/6yzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599867, "uuid": "2162dd13-372b-4d3f-837b-0dfa28f7630b", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599867, "uuid": "a649872d-14da-432c-b488-c53025478f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599867, "uuid": "baf5cb7f-29f3-49d7-a2c6-3c77b0d763a7", "value": "9210ad7ad21f24f7f4bc1bf1e0fd70a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da8d59a-de88-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625596149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596149, "uuid": "eb8c20b0-7f22-468b-b859-a0fe8e422831", "comment": "Malware payload (Mirai)", "value": "7eb9defd68c4ad301f3a75b73ada98d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596149, "uuid": "08739782-e513-4b0b-a27d-5b497915abd7", "comment": "Malware payload (Mirai)", "value": "3c9973381e00a51eaa4632d109b374f6fc12ec9fb60f6f9c27cd60b1700e48a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596149, "uuid": "0c83f040-27f7-4bdb-819e-a2e1fda18b28", "comment": "Malware payload (Mirai)", "value": "3a4eb08942a334506a0f9c56477bd978297599d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596149, "uuid": "472e07a0-0c43-4f27-929a-4b8e08cdadd2", "comment": "Malware payload (Mirai)", "value": "d8d15125c7721c9efdc3f9b31180a942aa4863673c1f6d26d6a0c32e9db2ae1930d2aa3443ea1bb66e71628a36d9af04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596149, "uuid": "181ef052-e00b-4533-b360-330c7ce6f5cf", "value": "C4431925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596149, "uuid": "136a0572-93bc-4690-b2ef-6092e7067f44", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDY:eL0AxvSHfymp0xgunvCkV6vTMDauH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625596149, "uuid": "a098bc48-fbb3-4d7d-9aa4-d58e93b7427c", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625596149, "uuid": "333cd3c2-59c1-484c-a7df-39e87dcadbbb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596149, "uuid": "ef88b624-9392-4449-833d-11ad0a4e28b1", "value": "7eb9defd68c4ad301f3a75b73ada98d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dda858c-de02-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625538650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625538650, "uuid": "0eb459bb-8288-4b6e-bd0d-2f6e325723c9", "comment": "Malware payload (RedLineStealer)", "value": "424ce6df3e42cc5ff59d6e13baa138e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625538650, "uuid": "6cadd0b3-12cd-4239-8689-28487c4def39", "comment": "Malware payload (RedLineStealer)", "value": "3cb974a37cf858d08db23fb8040602ecde83c5270667f634a694c635aaa5ea7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625538650, "uuid": "19270681-03e1-485b-83ea-0904e34942c0", "comment": "Malware payload (RedLineStealer)", "value": "87508513f6e78a496c5bf053d2102896a85da25c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625538650, "uuid": "f6229725-e192-4450-9983-e6b0e2f455ed", "comment": "Malware payload (RedLineStealer)", "value": "dc82ca0520cef0e12acd1548c74a2d6cfd4f00c00c23fd087cb8f66ed4ebfe6a09f756604bae8e72f9bd6bd8041b7c07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625538650, "uuid": "b82ec00a-f239-4cbb-9e73-6f38e57630e2", "value": "F284342864BFC01984E3EEA12EDCA8FBD99A55E7640D703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625538650, "uuid": "d5b91b78-2188-4379-a76c-fe8a71d3d392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625538650, "uuid": "2cfce429-d7e8-4f50-8b14-5854c854ef4b", "value": "3072:s3Pz3upGhVsU+TyEex3PeLPLL2saq7C4ZJQeOHOqE8bNg35SX2TIJaNivX6lAb6I:K3upGhVsBhe42saq7C41tibKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625538650, "uuid": "8d0efec3-6ab0-4109-8ae8-38029401f56f", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625538650, "uuid": "5406d1c8-b5e7-45f3-9eca-1c4ab7332ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625538650, "uuid": "eaac994d-8fba-4e40-b817-2e6b381d688f", "value": "424ce6df3e42cc5ff59d6e13baa138e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e116a86-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599156, "uuid": "a91994e4-a14a-4406-9581-9cb33eedac89", "comment": "Malware payload (Mirai)", "value": "825b2dbef21c73b7b0989b8d205e867a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599156, "uuid": "3d997c3c-9d54-4f30-9216-3c94c060c07e", "comment": "Malware payload (Mirai)", "value": "3ce4eea7955763ce86035b9035198c443212cd11740b5e59f18d1341dfffc182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599156, "uuid": "8dd5683b-18b2-4812-99d3-9b10f11dc1b3", "comment": "Malware payload (Mirai)", "value": "4e189484731779248e9c4d01111664b289a58f88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599156, "uuid": "d7e1c1f5-0593-4539-808f-4f36d7c2b871", "comment": "Malware payload (Mirai)", "value": "03db548aa01aad708f7cbba331cf35fa5ba4d085f29e545f4d7dbb5e67738201b7b6b6cf09f27425777672bb54198c4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599156, "uuid": "2d20f302-073c-49c0-bd74-6b6456d1d46d", "value": "16E2F269C307DCB1EB302477CE25548A7E905776C1BF35F122902609BA8291377FC256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599156, "uuid": "04ca590c-7cce-498a-9bb2-602f2259b689", "value": "768:UuLhMpj+6sk2HtuODQAk6xOMJMtymGR8hoLB9q3UELEt:U5j+9k2NuOkp6xOp/1LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599156, "uuid": "864341d7-ef9a-4f3b-b3bd-c9b7f6692110", "value": 34148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599156, "uuid": "886176c0-45b7-408b-986e-a229db5a11fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599156, "uuid": "ce86dbd5-e5d4-44dd-8703-8bdbd4c7fe5b", "value": "825b2dbef21c73b7b0989b8d205e867a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75944e4c-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1625552514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552514, "uuid": "1b91075a-427d-46c0-b76b-4718ad11af23", "comment": "Malware payload (TrickBot)", "value": "80bb8587c2c15a448ba80a24a2ee555f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552514, "uuid": "eba09a84-419d-4245-ae37-704c855444da", "comment": "Malware payload (TrickBot)", "value": "3e72aecd1d69a6468079da039b4569a56551c0b202f7d90c41e4859a9c26fa08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552514, "uuid": "792e100f-cd01-4018-bb44-feee13b3e7dc", "comment": "Malware payload (TrickBot)", "value": "89ce859719a17c1fd1580470670eddb2e3be4daa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552514, "uuid": "36c23721-5aee-4a03-8d44-c11976d40a03", "comment": "Malware payload (TrickBot)", "value": "a3a6645c166eb0efefe90dfdb6cb3e2ffd86dcbb4adf30965c2c99ca9460214fcc2531038bc560a9a9b141ea3900589a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552514, "uuid": "9b2ea64e-9abd-45e7-bcf4-695fc58fd518", "value": "2674E001F2D100E9D2D995382A6F3731AA3FE985CBE40BD3EF7CFA9E58125429876351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552514, "uuid": "53bfd20d-0a51-4978-a0a1-6a85aaadd2f7", "value": "a2293d617a2d42d810e0f0af44350ce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552514, "uuid": "daf7a93e-1f5f-4ef0-ad66-4df36fea0f51", "value": "6144:F62tjX2wZx8GcDdbVRvCdEnjzOWy24Qm4:J0NvCUSW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552514, "uuid": "4b1aaf83-6c1d-45c9-9874-d818cd1c00ad", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552514, "uuid": "97948bf4-08a3-40a1-822f-1ddb1c750277", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552514, "uuid": "c3d6d34c-52d5-4e0a-8e35-e2cc390142af", "value": "80bb8587c2c15a448ba80a24a2ee555f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7750ad9-de6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Matiex)", "timestamp": 1625585293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585293, "uuid": "a6845e00-b2da-4fa8-b224-1838ea9a4174", "comment": "Malware payload (Matiex)", "value": "748c53abb96a6a1bf99d6094c24a83f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585293, "uuid": "188e1348-5985-4b93-9d52-77ae40e26873", "comment": "Malware payload (Matiex)", "value": "3e78765ba856759e65007d23fd518d450599157e5a4ce5fe014051a19715eb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585293, "uuid": "78c5d3c2-8c69-43dd-b9d9-b22f5ac1106c", "comment": "Malware payload (Matiex)", "value": "90916a17264beab847d84ab3a98c0890c12e0d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585293, "uuid": "6c550480-ed4b-4d78-b740-492bf09fe2aa", "comment": "Malware payload (Matiex)", "value": "0ab09cf9f5bdef9852f6d8889b0a689c588a16cf4ae4391646372aeed1c89859288b1d706b4e5690f9fdcf0a9864a831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585293, "uuid": "9163e1c6-e9cd-4718-972c-600f0fd76920", "value": "E315AE7661778F91EEBFC7784335261C4FE9B376D34BF6782C9460994480F814AA2A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585293, "uuid": "283617c7-581d-4b95-aae9-0970e8dcdfb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585293, "uuid": "3aaf0cf6-a1c3-4714-a8cb-3493db219fd3", "value": "12288:DdJ7+TLr6NsBrD/F08Sxyen7r5tec8OT+L9lsL5jgaz6wOo3Ncknaq1qHI/fJhxc:Dd9+T/6N4YXf5tzh2shGo3isawxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585293, "uuid": "06d7e723-fe92-43d7-906c-224550ef85b9", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585293, "uuid": "8dff9027-7dca-48ed-b620-af0e73bf6dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585293, "uuid": "d698d038-c5f8-4b9c-af0d-e6219a3a312c", "value": "PO No.179989 - H\u00f6rmann Mexico S.a.de C.v..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27193fcf-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625555819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555819, "uuid": "c6ba9766-237a-4199-96b9-fd1fe7efe73d", "comment": "Malware payload", "value": "19d22f176eec093d2ce313e3e0def5b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555819, "uuid": "030d184f-b9b5-4646-9458-99557f41d619", "comment": "Malware payload", "value": "3f299a38f6196d2df259cd0b626e204fb81f5d33de5ec78d4bd7bae131ccb9d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555819, "uuid": "0cb8ad8d-f184-40c1-a99d-2083ed818c62", "comment": "Malware payload", "value": "3ffa6c671ce32d5818cd6f552145652eeb4ab410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555819, "uuid": "39bba06a-9ed0-4911-9637-df88c8761b05", "comment": "Malware payload", "value": "38a7205790998057eddb653862a85e0352d2ddf4bea32f4399444a5b28d94e2febe977638f9373184e9ed281eda8c8c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555819, "uuid": "618f8a7c-1e8d-49e8-84e7-385382855c90", "value": "8FA5CF3BB368E53EC4AA0B3245B39350597BBA65B81ACC1E47F0090DCF265E11E3B657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555819, "uuid": "0206dadd-9e95-4899-8332-92ee97039c93", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555819, "uuid": "02156ace-2d22-4b88-981d-a3c7a015b1fc", "value": "49152:9qe3f6R5G57Y7ZI8vFKqIZC1ncC/vGW07cDq:MSiR5G5kNvFfjnre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625555819, "uuid": "e1976e98-8993-4e38-8d80-0510c2dd8265", "value": 2146789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625555819, "uuid": "07da1253-cd29-4ce8-b64f-0a36d06abfcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555819, "uuid": "1de4eadb-dd53-4db4-aee2-c6f9b1a417cd", "value": "19d22f176eec093d2ce313e3e0def5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade9dd0c-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1625586539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586539, "uuid": "559fcc92-830a-41bf-8a8a-03547c2face3", "comment": "Malware payload (Neshta)", "value": "4c33a8d7ea67f81000eee8b1c9475f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586539, "uuid": "a7d1c086-2858-4696-b6f2-e7a454478bd0", "comment": "Malware payload (Neshta)", "value": "3fa53f6f68e280013eb9651a53a3c40a16fa99f7689d0761b3f95b2de68b22cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586539, "uuid": "b500e6db-f988-401a-b6f7-c50b64bfe12b", "comment": "Malware payload (Neshta)", "value": "a96a1a2cd37af1a04fafc9104b59661924c2c2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586539, "uuid": "1065983b-125e-4a51-a283-82235ba1e00b", "comment": "Malware payload (Neshta)", "value": "4fea92143fb68c84af79f627fc19e2d861272f1254e7eb359f1ea77b1515d7ad6e7e19c9b7c67e5a8b739229489ba17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586539, "uuid": "6064476a-7fb1-40e1-a8ad-dbb7513aba24", "value": "8EE47C9C7650B5DFC85BCD36C9A82C24EB60B4B7831BD243A05322AD9D4E59BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586539, "uuid": "1e01f338-cdf8-4ae1-bd08-22b16e33fc71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586539, "uuid": "721171dd-3368-4f6f-b6ca-a5db8dec94e1", "value": "12288:oykRkuDvDq7seekteocywRcpfIIPHZx78nb92K9RZ9+Hdi5W/oJORL1k7TTtN6o7:27W8oczcRP78nb92KEKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586539, "uuid": "7dedc3a0-02fa-48a5-9849-0c421aed7909", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586539, "uuid": "099f32e0-3ed9-41c9-9a26-e1deb4afc204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586539, "uuid": "0f730492-8e8a-46c3-acdb-523fc57b61f2", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.ERY.genEldorado.22139.11301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0dc519-de57-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625575186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575186, "uuid": "7d0eb133-b18a-4342-a411-819009ac809e", "comment": "Malware payload (Formbook)", "value": "5c7a9d206155299c5fb51de527ecf29e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575186, "uuid": "ce12f972-d042-413b-8136-9ebb7169ea7e", "comment": "Malware payload (Formbook)", "value": "40f8cfeb5f68c1980aaddf36f9915076d613c4c99293f1f6043180fe1006ea78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575186, "uuid": "68695462-569e-45af-b12e-9e91bffce718", "comment": "Malware payload (Formbook)", "value": "80a6144033b5d2483bd0a12cfd41689e78b891d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575186, "uuid": "bbbc20f7-b4be-4f6f-a614-42f4f1339433", "comment": "Malware payload (Formbook)", "value": "a7ad080e5520dbb04731fed9c54418b09a8c596013136770687767510384e66e244ac4fabdb2d6bc97b36e47754530a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575186, "uuid": "71e495bf-1ec9-4b59-9cf4-8ae54f32d307", "value": "E8F47CBA60764B91EEBFC7380331251C4FADB37ED25BF6B85D98B1980590B440AD2937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575186, "uuid": "356e1e73-e386-421b-aae4-383d3ab475e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575186, "uuid": "a1f2989a-f281-415f-a15c-575ce7bde489", "value": "12288:9vLaP6NsBfsZm7FJTjhn1ckLzCwBFc7Y2ghdQFui+sxkR/2gp+m6yZAM:9vmP6N4ywJvUkLzDBq7YBhfLbR2Atd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625575186, "uuid": "9f4d8ba0-0f24-43c5-b49b-4d8d4d89f8ab", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625575186, "uuid": "b63f68ea-10ce-4cbf-a555-fe1d525a9fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575186, "uuid": "97c6342d-170f-4881-ba2f-550de18231ed", "value": "Follow up Purchase order num- 4500262450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173fd410-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594017, "uuid": "e4c03ebe-fb17-48bf-89e0-4b7f1524ebf8", "comment": "Malware payload (Mirai)", "value": "ab4afd580b31f9f6e9b6f473e8697f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594017, "uuid": "3b908b2c-185b-4dbd-9b81-5ee88c193432", "comment": "Malware payload (Mirai)", "value": "41494f55ed6382e9a71500bd9543992a18ae5c34cb220815db4129b722be790f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594017, "uuid": "19c640ec-d222-434a-87dc-7b19ca7d0d08", "comment": "Malware payload (Mirai)", "value": "f3d7f684b63622ae72b36ddd1715e02f10356669", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594017, "uuid": "5f917dde-a4c8-4a0a-9466-6bce18fcdb70", "comment": "Malware payload (Mirai)", "value": "48fe6dbb14c53856f21637f8cc71f187b8aa0a55157248176b75b252203b503810888966aac958ff3cc0f407f644ca43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594017, "uuid": "bf1e3f95-46a2-4ca8-a79a-548201fecbff", "value": "5323021190930D92E810FCBAC4C14ECCA7FE60B8E16F9BEB05468AB66D559CBD87874C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594017, "uuid": "150e61ff-b1c2-465d-af38-458fb7b3c1ef", "value": "768:MK7y1XGOC/p3l81xe1849E5Ljhkem9q3UELct/iw+kAYYQcp2SFd1Mi:O12Omp3l81V4SlhkiLchiw+kXYflFd6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594017, "uuid": "56673d60-2a06-421d-9f48-88fa33825a6b", "value": 48712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594017, "uuid": "87242f61-e0ad-4901-824b-651f2ffc78a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594017, "uuid": "8a15958f-5802-4cc0-bb45-7e1ea54ae513", "value": "ab4afd580b31f9f6e9b6f473e8697f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea24b043-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625556146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556146, "uuid": "7e0597d3-d9ce-4649-806c-edada025d2bd", "comment": "Malware payload (Formbook)", "value": "2cdd448a51e43d130367f2c46c772a92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556146, "uuid": "4875dba1-efe1-4f3d-9f60-90ee094a93a3", "comment": "Malware payload (Formbook)", "value": "41d1ffa0d55a6c7e6758afe11084539691922714455663d641e1be3c8e4d9977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556146, "uuid": "3781d378-f89f-41a1-8569-87a7dd11a5b9", "comment": "Malware payload (Formbook)", "value": "3e822e69f819e583461b84eb0d9e9129b9ef4910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556146, "uuid": "ea4353b5-a7d0-4e50-be6f-d55bc182483a", "comment": "Malware payload (Formbook)", "value": "1f3eb9370d97d5441501b5a30aef40b33800e47177ea8619d154610346467951715b0cfdc04618fda0efcc81f086b370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556146, "uuid": "70211e57-a4b2-4767-a45b-75208ae1adec", "value": "ACF47C9C3650B6EFC85BC936CAA82C64E760B477830BD203A45712ADDD4E69BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556146, "uuid": "517e2d24-0485-4e72-b6c5-90e0207816de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556146, "uuid": "4c766c6d-bea3-4237-8ded-399804c1ce34", "value": "12288:qcRqyqkNrIRt/qyBIKlYRBQZxs6b67I7DVUInRCRAbxWRworH/CMQAa93hI5oN4R:qRyqB+yBLYRBQHs6ZV7+AbxWfz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556146, "uuid": "66494de0-9422-493b-bb39-6e8469762847", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556146, "uuid": "b90207b6-b88f-4094-8204-8bbc54b3dcc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556146, "uuid": "41403b11-3b08-4cb2-baa2-05283e2446a5", "value": "PO_0187.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1069320c-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625587134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587134, "uuid": "51f3468f-b4fc-4ef8-ba55-44f48e918ce1", "comment": "Malware payload (RemcosRAT)", "value": "3d5cbe744dce24113248ee279b4690c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587134, "uuid": "96f2d6ad-f968-48b7-8095-75e697d02fe1", "comment": "Malware payload (RemcosRAT)", "value": "41f469d18016a7ba9938f2f4409b7e15acd9657a4c639f772a05c53e93287aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587134, "uuid": "d13c8164-012a-4ea8-a51e-9631e32638fd", "comment": "Malware payload (RemcosRAT)", "value": "f057791373ceff4286ebe91894f09a36b3ffb69e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587134, "uuid": "b21da735-ec63-4310-89dd-5e23268474a4", "comment": "Malware payload (RemcosRAT)", "value": "e68f773763a5b8c6464487ecf02b7582460984fc765a49dd6af2e522fb7cf0eb75840cdf9f7a41ecb619a14128da6f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587134, "uuid": "fee6af19-5d97-4e3c-b4d9-2149fdbc8754", "value": "E8D48B685CF4DD22FCBCFEF4EE4193091D6E2D3600A57B497AB3BE6926B40B6610D064", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587134, "uuid": "03dd7592-f5c0-43c6-9437-195590137420", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587134, "uuid": "26106b99-a191-4c7f-a279-50df15eafb6f", "value": "12288:8yvbM3mkIIQS/UBwAJzLehIGqh4Jq1WI1hukKuIx5lHxkZrbNfK64:HvbM3LUhJzLeDqh/ukWlRkxN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587134, "uuid": "efedb955-8166-4526-90bb-8cb6c220b775", "value": 603380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587134, "uuid": "565c7908-5893-41de-863b-d2a49f9b9c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587134, "uuid": "a6b25a95-8af7-4472-a83a-53cf94a99e6b", "value": "3d5cbe744dce24113248ee279b4690c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce5779b-de69-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625582887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582887, "uuid": "4f73fd3a-97cc-4255-96d9-eefb1d0b4830", "comment": "Malware payload (AgentTesla)", "value": "f894b0ab25e43e00520814fc17780c5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582887, "uuid": "b15680f5-9f6b-46f3-9814-cda6b88aad13", "comment": "Malware payload (AgentTesla)", "value": "4274d770f966d5ac705d65ad379484f421130b3a8685f6ced02aa80d29180c36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582887, "uuid": "01e10e13-6588-4cb5-baaa-7685bf20af1b", "comment": "Malware payload (AgentTesla)", "value": "e80eb47d8307943e9dbcd4389ba3b48594572cc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582887, "uuid": "2b0cab07-22cf-4aec-80a1-a314fab28619", "comment": "Malware payload (AgentTesla)", "value": "1867f6a1695c4213738a0ef6f3d935695e909136215294d6b5fafa01372fb8d1ec9098d33dcbcf43f7b42832af0534db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582887, "uuid": "7f6577b4-ea31-47ae-8bb2-4633c4324174", "value": "AAD4CE5433AB5119F0769AB5B553ECF1E26ABF622D11D10729C43F8B3923AC1CEC126E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582887, "uuid": "ca51eeaa-62f1-437e-ac1a-9acd2bc08f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582887, "uuid": "f3fc6e9a-f815-4d82-b1ce-3f9a33c847ca", "value": "12288:oqk7QsAWG5nCQhuIH/K8+QpPIeDgPB4O4ZN:oCbnCNIH5+QpP7Dgp4LZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625582887, "uuid": "4670c305-2d9e-4fa6-9163-559a62b1e6ff", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625582887, "uuid": "622be661-5767-451e-a081-25b699aef556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582887, "uuid": "c5888a3a-086c-4fe5-afc6-cd5d1f0e04db", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.7650.4914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3614e5-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594000, "uuid": "67b8f0ff-9144-4ab5-98c5-0fb6a5a42d86", "comment": "Malware payload (Mirai)", "value": "558fa3e2694366e86aacb759255c0af5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594000, "uuid": "734f88ee-5c34-4432-abe8-66a241880ba0", "comment": "Malware payload (Mirai)", "value": "4372f6dd767523d48b2a3a3a67b5eb74e0620065d46d9db4a4246cb931ba47f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594000, "uuid": "f5d5a9e6-e298-4d06-b9ff-4bdfd5eceb80", "comment": "Malware payload (Mirai)", "value": "7a9576e85304445080cabc4b31d0dc0d2851846b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594000, "uuid": "8d22df72-269c-410b-9073-63538e88ccb2", "comment": "Malware payload (Mirai)", "value": "907a3ee765d81f7c795a22cd07972b9a896ff08781dfb84b212e87d03e436fa5079e95310d47a5617b819ae90682fd18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594000, "uuid": "c8cefa61-f87a-40fc-a3f4-5a791d608d18", "value": "94B2D09173216470C6901F31CD68C1EDB1AB1989F3FE21232A180679B6D758F27F468B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594000, "uuid": "9e6d790f-bf5c-46c5-8dfa-2cde84895e6a", "value": "768:DwBA1NjQwcThlYlYXoKrEas4ccUcfhIcs3UozT:DwBA1NcwcThuuXosq4czcfqzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594000, "uuid": "efa67b3c-cb55-4ce6-aee7-e1d1e1f9204a", "value": 25000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594000, "uuid": "d71442c4-2300-480e-863b-1fdcd7edffed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594000, "uuid": "aee96987-f1b8-48c2-8dc3-c35d8ece60bd", "value": "558fa3e2694366e86aacb759255c0af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f755b932-de77-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625589239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589239, "uuid": "c8047b5c-a252-4956-9abf-603e5be75160", "comment": "Malware payload", "value": "0afbf8672a63d0bc9e1c7ffde5480529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589239, "uuid": "c76352ab-cfcf-48c8-96b5-dc94168b83d2", "comment": "Malware payload", "value": "44f053bcbed3615a90a4ef61383225204e0f986333baa404547b35436cbc25f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589239, "uuid": "32481054-854c-46c6-afb3-c4bc6c2e3d8b", "comment": "Malware payload", "value": "28318f48d507212e1444f0ddbd7c83ec146b1606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589239, "uuid": "94760873-fb08-4dcd-8df4-d60df24dcf9d", "comment": "Malware payload", "value": "3d04c90a27dfcb3c389058226e1ac33b7b5e4283cd0b98809973d96f4d35d2402bf46661ce44826cea90026adb91c67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589239, "uuid": "3560d68c-b054-481c-920a-9820996abd3f", "value": "4F14D15076C2CCF0F4A319360CF5E37F5F3E79128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589239, "uuid": "b57e84b4-bc66-4d29-9855-09d584ff70cb", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589239, "uuid": "a8ec205e-b978-4fd7-9d6c-038ca6353ff9", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjApYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjLfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625589239, "uuid": "ee582bb3-bddb-4dc9-a70c-51975b79134e", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625589239, "uuid": "2732d5a4-ca47-46f2-913a-9694d4c76797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589239, "uuid": "efb8426f-ac21-4474-93e4-038fec71c677", "value": "Application alf need to configure - teammviewer.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc6cb0c-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625588201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588201, "uuid": "7e8d2477-4889-45f3-b234-908c7757dd55", "comment": "Malware payload (DarkVNC)", "value": "eb5c2dd7765958218d7251352fe33459", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588201, "uuid": "4731e3c5-1a38-4a21-8aeb-ecfec396fa43", "comment": "Malware payload (DarkVNC)", "value": "4501a9320cfdb2c126e21510b32e9ccead1175a14f5b08197763dc9e356dc91d", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588201, "uuid": "8db47c68-846e-4544-a7e9-15f94325d037", "comment": "Malware payload (DarkVNC)", "value": "eb3fdc1336aca54f334bb0c5ce7769c16a282832", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588201, "uuid": "2cf2e4f7-411b-47b6-a910-f27e402d461a", "comment": "Malware payload (DarkVNC)", "value": "5c008315cf3b7e84ce916a35256d49260dde98e0fa89d690598edb923f7aca1e4f95edb1d64ada8f19a1084e10014734", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588201, "uuid": "2f077056-ce6f-425c-9350-fcce2e3daa38", "value": "A22523113670CE36C6D698301832C6A0667BBC7256379547BA793F6B8D332C1AAF5F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588201, "uuid": "c70b53c5-d9d1-4adf-add6-6b0fdb44ba85", "value": "0f83e5878c6074b58556b8acda89e40d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588201, "uuid": "4419d37e-5db2-4c91-93c9-45b452865775", "value": "24576:ekXucBQWIZkVhHw51HQSr70PW2ZUufizXiXbK2x:YcAkhH6Hb7RuK6bKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588201, "uuid": "30b6a320-f4f8-447d-be1b-559ef9544933", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588201, "uuid": "2723472a-0924-47b4-9daf-c7ea166b81de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588201, "uuid": "8e731715-04a6-4b38-9f4f-24fd95c1ef58", "value": "eb5c2dd7765958218d7251352fe33459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c32c77-de42-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625566156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566156, "uuid": "ab1bb02c-e107-43e2-94fe-ea1ce6728ffe", "comment": "Malware payload (AgentTesla)", "value": "5fefc9e1a82bda9a98a77f983f4cd8e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566156, "uuid": "5908cd15-5937-45ab-9900-8aa4c09aa450", "comment": "Malware payload (AgentTesla)", "value": "451718173152b069f0873e6003c1b34c517a94de2bdab31df2bad1811c970f6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566156, "uuid": "1ed4ec9c-6257-4dc8-b83c-8b1cfe0fba76", "comment": "Malware payload (AgentTesla)", "value": "bfbd9c29e563eee32743f2e3386bfae7fd28ba0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566156, "uuid": "69c40d2a-d364-473f-8af4-5a38f21c6200", "comment": "Malware payload (AgentTesla)", "value": "de8a706afee23c40175f624e83009ce7b4cd1efe4c7513f8639432a00c7c1e342f30d853882956dec54d57e0a1351518", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566156, "uuid": "3441b457-ddc7-4c58-84e0-6a70bf5f284c", "value": "6F058CB960768FA1EEBFC7380331251C4FA9B37ED26BF6785D58B5880190B440AD6937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566156, "uuid": "c5b81358-383e-4c4b-8b9a-c8433f7674f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566156, "uuid": "b33ec0fe-cf6a-4ea0-a09f-c745919b0833", "value": "12288:upTxP6NsBKnQ6fhbixWN0n2sqMPwCmSLp6fzwN2oaagsNSvx9CaeJ6yZAM:up1P6NlnQ6fMxIpMI+A82oaagRvPHAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625566156, "uuid": "0e8ed6f3-2efc-4f63-b9fa-a8a1826d3bcc", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625566156, "uuid": "eeb37735-31e1-4507-b50f-3bf56bd9d81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566156, "uuid": "6e60773f-93d7-4a90-84e5-d2839d413859", "value": "3278_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d20bd16-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625549520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549520, "uuid": "cb4d31c1-922c-4fbf-8540-e166c3485d69", "comment": "Malware payload (AgentTesla)", "value": "5d66909a2b0872f57566377e25aa001d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549520, "uuid": "33293384-364c-43f1-8b50-a42938631992", "comment": "Malware payload (AgentTesla)", "value": "456f8f697d8c196c8852af66e8add347ee85ee0e678a0bccb424843a560333bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549520, "uuid": "6ccbb259-bce6-4c95-acfa-e874a0b4987b", "comment": "Malware payload (AgentTesla)", "value": "b4932f4ff0418451c19af77113b22f45bf57579b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549520, "uuid": "2f3b73ae-135c-4fd7-8ad1-d6fa41718e40", "comment": "Malware payload (AgentTesla)", "value": "0eb7bac5368a7527a264c314b30166c67258ce9645e3f694a87b10ad2097337d757f21297ee25931f0ae096607029ea7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549520, "uuid": "a4f4b973-bc84-4afe-9ba2-6f7b6308e068", "value": "371423F8055FCBE6CBC6C1C60E4A47682A593E521D671D4C7AEFCB81851091FADC8EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549520, "uuid": "e6949f5e-c353-4640-84c1-89823617b136", "value": "3072:TitqCeA+KvgdVPrHo6Gucqico0Xm0y/UiXs4IopxJX98T+BUkVgyBlZ/0I04TAxc:9ugvrHLvo0XmD+Iqu2yBlxMem1BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549520, "uuid": "cf559882-353a-488b-9e23-9ed59670acd7", "value": 203849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549520, "uuid": "2bb92151-e3db-4ad8-8c23-1d7e73cd1d84", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549520, "uuid": "d4d34680-9fb3-44d3-bac5-37faf49a686f", "value": "DHL Shipment_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5459ccd9-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625586389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586389, "uuid": "f501fe0e-0aad-4ff2-aca0-b3000b2c35a1", "comment": "Malware payload (Dridex)", "value": "db7e218690fde1ddcb1f8a740029aa54", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586389, "uuid": "229c0878-4457-42d2-9802-8bd58faba9f9", "comment": "Malware payload (Dridex)", "value": "45a84e9f8fb9cecb7021024efdee3fac2516d9836f397c37b96320fb80304601", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586389, "uuid": "c1049dd5-1ee9-4b68-aa7f-780dc7f777b9", "comment": "Malware payload (Dridex)", "value": "fc1f4113c100e5dbfc7421bea62c6ffbd05b74e4", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586389, "uuid": "c856c34a-4ab0-44a0-9bb9-926b2e59550c", "comment": "Malware payload (Dridex)", "value": "a60ff8a4a7c034787a611f90b70d2b1d88242bd660c7e52007099f4609210a9dcd974b5e9d772a25d85dca651e1c40be", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586389, "uuid": "a0220da2-e701-4637-ae8b-79693fa742e8", "value": "5263AE18E39A103BF06080B4F2161AD72549AC3BB910FC21A1EB714FA757FB65DBCE56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586389, "uuid": "64924c7d-aade-4997-ae44-52b85ce1be2f", "value": "1536:SkhPewkfc2JK8uMHtg3eLmsqU444444444441g:Skhpkf28u6Y4VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586389, "uuid": "35baf088-3567-4b8b-aa4f-b9a32945b85b", "value": 69833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586389, "uuid": "adb8ba3f-f96d-4ead-8519-055d7d407f09", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586389, "uuid": "03474892-2fa2-4c35-b082-dc701aa4804d", "value": "Reciept 5528051.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2fc309-de80-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625593007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593007, "uuid": "3f890d58-3b43-42c0-b15d-b93918d1364d", "comment": "Malware payload (Vjw0rm)", "value": "5138650f935189f5a1f88d76996a2154", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593007, "uuid": "c9f02b4c-28ed-40a1-881b-600999dce65d", "comment": "Malware payload (Vjw0rm)", "value": "46d59194c7d2e539a1635e0f39774f5a75b0965e937843fd801470c64398b3e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593007, "uuid": "d37425a9-87b0-4028-82e4-e141b5144ffa", "comment": "Malware payload (Vjw0rm)", "value": "011e1fae41f1c1ffae3ea748f575b75a4fe2068f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593007, "uuid": "8f9277a0-a1e4-4751-a5bb-55f3be54474d", "comment": "Malware payload (Vjw0rm)", "value": "d037c009a058b1dac917411b91c5ee9da93a57034275155a93c4b5d2aa8940b9dff9fe180ef00c8c8b749b008034ba63", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593007, "uuid": "efaec21d-331a-4e49-aee5-1ffd311da5df", "value": "BB12ADC2CAC0B99A9A0291C31F3E097A67FF7946014BEE194847C68A6CC9B576F410E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593007, "uuid": "f939a7a4-bf59-4565-9d70-53f19e55a151", "value": "192:QevlNbOhzXyTuFHXxWybodL6Y2nuS1ljzwkbHDpRoagNr:Qe7bOpXyYHXxW0odmxlnDrDpRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593007, "uuid": "3c7e3950-db5a-40d4-8758-76085180f1e2", "value": 9494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593007, "uuid": "a17bb32f-bb23-48c0-bb02-5612015bb8c3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593007, "uuid": "dec7dbc8-f1d8-4ef2-b306-612cdc4177bd", "value": "1ZGDH30JKA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ce9132-de20-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625551649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551649, "uuid": "d27be29f-2d6a-4160-9c1d-1968edd69d8d", "comment": "Malware payload (Vjw0rm)", "value": "a55cca221a51796ad86291249e15527c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551649, "uuid": "ec6877bb-9616-42d5-9173-262fa2682281", "comment": "Malware payload (Vjw0rm)", "value": "47b0e73fe1891556df722ea58eb014682571cf1bc967fe4b60be277b17f20311", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551649, "uuid": "db2d5776-8a6a-4192-a73b-0fcb07e47885", "comment": "Malware payload (Vjw0rm)", "value": "13ea38af653bd19db0e55fc1056699ab1f466576", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551649, "uuid": "38528a89-a495-4bac-b99d-f14b945feec2", "comment": "Malware payload (Vjw0rm)", "value": "6ddc2e406a4891667cf5a40e2d55b9548936ca70ef55192b180adccd990c4efe65507655fc94319abb1fbf052afcf33c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551649, "uuid": "c6217ab2-fd25-4283-906a-e97a1d9d5d42", "value": "F5E49995B603CDA271F5D1E71F9C486EEB8696F2CEC95A00C0CE1ED94CEB117A243D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551649, "uuid": "7c4b62b7-cc5a-40e3-aa3e-f39c8c45ac71", "value": "384:RHSvr5t2osQk+nOoIGIAzrO990bIYfJeIUlJ1R1It8k9KiJGDaIaNysXo+WeDRbX:0fdDydOQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551649, "uuid": "4882f35a-8239-44df-b427-2333f80c4f1c", "value": 660242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551649, "uuid": "136f28e6-6cc6-487f-928d-4b1bfebd9cdd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551649, "uuid": "aa6f8af2-1fc7-4642-921d-765f26352c47", "value": "ID_Colis_FR99728920J0901.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10ecbf6-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614515, "uuid": "c76cf36a-314f-499c-9fa8-c4fc698df1cf", "comment": "Malware payload (Mirai)", "value": "4a032fc25e722938835950523ae25e05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614515, "uuid": "7d9fe023-88fd-40df-ad56-86e27cdf0d67", "comment": "Malware payload (Mirai)", "value": "488070117937b16111d93706c29934dec9eb5d67e6f8c70585a4d9fc65d27468", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614515, "uuid": "2756259d-a366-461a-94dc-aa8f324d3b75", "comment": "Malware payload (Mirai)", "value": "13180329ba017679d410f7e28e93a8467c06c5bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614515, "uuid": "7115fcb5-1e0b-427f-bd9a-3144bf6676f6", "comment": "Malware payload (Mirai)", "value": "2053ff903763410cd8be0cd819b57d4c52b33454dc41407858baa6607fd0d46be42ae810d9419a87d02e32874e2357ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614515, "uuid": "677f4103-8c28-4290-99fb-af1d90882419", "value": "12734A0276188E1BEAD74AF0242F5BE083FFE98025E4B988684FD7424635E374549F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614515, "uuid": "92b10741-bf57-4cd1-bd4f-dce1b19dbfd8", "value": "1536:33O2QsWJ+G6Kl1a7Uahyk5LzQXJT9bDMbu4:33Opb3k5yDj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614515, "uuid": "013eb44a-4278-455f-8ae7-f68fef8ff809", "value": 78756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614515, "uuid": "573f8a75-4a15-496f-8b32-997068036088", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614515, "uuid": "ec964bb3-d8d8-475e-919d-7d194a2f3967", "value": "4a032fc25e722938835950523ae25e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70ecadf-de19-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625548839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548839, "uuid": "562c4532-758a-4a38-8e60-9eab400e5ed5", "comment": "Malware payload (AgentTesla)", "value": "86a531bfa7963c79478e937ee52e2b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548839, "uuid": "9518f3c9-2993-4561-b907-f88c38e14a90", "comment": "Malware payload (AgentTesla)", "value": "4896ac52f78034e703736e9cfe3d2cc1b4088e821c2dd4ff55c531c141415af2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548839, "uuid": "42d1d253-ef7d-4f8e-9799-be01175de56a", "comment": "Malware payload (AgentTesla)", "value": "da3c2e182fc5f964688eaf938b24439517eb5971", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548839, "uuid": "9b3a089b-22b9-4d2b-81fe-5e501fb67348", "comment": "Malware payload (AgentTesla)", "value": "651219ddaf86ac8f7239cc92ebd5c6e76b8dc35e9b3ae9d93cbec7b560dec9a61141eac91fc8ccc4c869e92dd4f297ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548839, "uuid": "379163b8-65dc-498c-8f83-61983d3fc62f", "value": "7DC4331E334C97EBB591FCD2FAED74593110128B5FF4212368A898346B3AF64E601F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548839, "uuid": "bc1f04e3-c835-4713-86d7-3ae92e8fc5b3", "value": "12288:tNq93wEWJAdLqdrEQ2Kck75bZAXWZZEy40UNk88sp:tNq9357Q55ZeDm88sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548839, "uuid": "afd81edd-e3ea-4f99-8ecc-b0a282d129d6", "value": 564265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548839, "uuid": "b3c811a3-e902-45fd-ba1b-a69af7942daf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548839, "uuid": "7041054d-6766-43b3-a276-eaa660a6c127", "value": "Statement Of Account.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f3143b-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614196, "uuid": "aafc43bd-bea5-4ab7-b357-72881f7bd591", "comment": "Malware payload (Mirai)", "value": "ce2e7cc22da0d8a0ee353d7d98c5e6c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614196, "uuid": "3deca77a-dd13-4fe3-9608-988af7258505", "comment": "Malware payload (Mirai)", "value": "489eb81bbf49f45a98098d1ef155425833283217ae2a87c7e529b08b62987524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614196, "uuid": "3398135c-9253-46b4-af09-bd377e932c79", "comment": "Malware payload (Mirai)", "value": "943e0b2d201f25d966fbc06c7ba79c6a926b796d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614196, "uuid": "56948c17-4300-41be-97ad-a929622101db", "comment": "Malware payload (Mirai)", "value": "82e88a16ff508983d1f07aba5c3e0f17cbb694d058ba0ea71dfac4f1b38c933d16ad26f5e5f88cfb4e9418310a6826dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614196, "uuid": "e307579d-ef6b-4834-949b-f8a79cc601f1", "value": "A9A3A41D2E229F7DFBAD873947B78B21A14533863AF1D4C1D15CEA012E7024E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614196, "uuid": "1ce0a804-22dc-48e4-9528-d95ed9d00345", "value": "1536:2Jd1xWp1TCqwoYNSNUBw2CwCaV10vfkCZxT9KZlnkxNYHRmGkcTti6w/tA:q1pq80HbZMnkxNYHRmGVTtHC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614196, "uuid": "c17cc321-dde4-4568-ab4c-afdbdac78889", "value": 104444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614196, "uuid": "82b59218-2c66-492b-a931-4d1dce4ae4ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614196, "uuid": "ecfdac0c-876c-4422-80d3-d6412db7e5c0", "value": "ce2e7cc22da0d8a0ee353d7d98c5e6c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2af805-de6b-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625583929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583929, "uuid": "d8b2a8cb-adba-4d99-af5b-cfda4c01b1af", "comment": "Malware payload (GuLoader)", "value": "fb607ca3f043f05808e7d98730fa10d9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583929, "uuid": "e21230df-22c0-44d7-9ee2-850ad4231b14", "comment": "Malware payload (GuLoader)", "value": "49df07013a71ed06c0da72a7443922270c386db381c831d61bfef3a48041dbf8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583929, "uuid": "6757aeb6-0f7e-413b-aa9e-4f90e22b7e73", "comment": "Malware payload (GuLoader)", "value": "c7c3c0fa7058e6d63bbb14cb72ac01cce2d11e3c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583929, "uuid": "4290d6fe-12bf-4288-acc5-0c3af70d6469", "comment": "Malware payload (GuLoader)", "value": "8c0a6c7de35f8adddec53daf38835bc7d7093cd1bb5cf18269815013deb2cfc3499cc6fc66c5a6e47ed326f5a0a3cf4f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583929, "uuid": "38d3a0c9-e9cf-476c-964c-5ed48aa54ddb", "value": "4DC312A228B126C6254615E906DED989A714BF184AC7FD8EC70F0C67CF1FD90C8634BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583929, "uuid": "85106af0-2d6a-4b83-b14a-8843abce46d0", "value": "3072:mjCzYlc2daVUuqrzsKMZS658Q/5cGnxQM30Jlowf:mjpc2Nuqnsj5xJCtewf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625583929, "uuid": "0d185cb5-32d2-4e8b-b12f-aabbf07e6e08", "value": 122234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625583929, "uuid": "2b04ea08-837a-40e7-9dd4-9e1f33bfb038", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583929, "uuid": "a612893f-1959-4596-9e7d-01eaa27077d9", "value": "Proforma Invoice.PDF.CAB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf8b278-de7a-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625590294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590294, "uuid": "5b1970ea-d69e-4148-81a7-56b446e4f6dd", "comment": "Malware payload (Hancitor)", "value": "94bc2648308a61ff0c80f00d485122a6", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590294, "uuid": "b37eb43a-30be-4080-a622-252c6db5313e", "comment": "Malware payload (Hancitor)", "value": "4a68e284c206b9feb5a81d2235a338195db6982c439d088d357fdfb69630f15b", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590294, "uuid": "8f55571a-57c5-44af-bdc1-f72ae38443a9", "comment": "Malware payload (Hancitor)", "value": "9e6709b7553cac06add285c46905cdb4e6be6210", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590294, "uuid": "70fd894a-ef1b-46b5-affc-32abb07c9a32", "comment": "Malware payload (Hancitor)", "value": "778d6651606d3f35cbea00c39c8f949ca6063c340ded1eecbb87dbba8d1f45f6a095cbc4f919f9ff95fa2524569aae36", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590294, "uuid": "abedc618-9138-402e-b103-21325f2519c8", "value": "7015D000B980EA71D5A352764F76E685033CBD214B64CECB339C374E5F3A5E26A357A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590294, "uuid": "82f734ce-111a-4011-a803-33c5f366668e", "value": "24576:5EIZ4wA74D4SQKxZcy8gthDWg+pKmUI+:5+wJD4QZh/qJwmUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625590294, "uuid": "ff4e829a-1eb4-498e-8ddd-7358ec859170", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625590294, "uuid": "2e362de8-e3ad-4ae5-9117-4c0c2e68b492", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590294, "uuid": "40be4d2d-ba9c-4a7d-8747-63cb1fb2ee07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87e4569-de25-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625553888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553888, "uuid": "838d9eb4-3996-41ca-a548-a339f83e29f9", "comment": "Malware payload", "value": "46f65f82bc5f16b70fc5c22b0232097c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553888, "uuid": "3d3624d4-caee-42a4-a287-fdcc18dc8ee7", "comment": "Malware payload", "value": "4afc148a59a81c3a3cf47e2e188626d9b2d4451999310462862f6653b6011349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553888, "uuid": "1543435f-3331-436d-8aac-1f31845d4ff3", "comment": "Malware payload", "value": "7347a6c53d94adb73d63f2c88193a23e65f848e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553888, "uuid": "db62a417-583f-4701-93ba-e6bd11702ff9", "comment": "Malware payload", "value": "0bc43792a49b55f01285deb553acfaebaed54b6aa065b54bb2e0adf22cac5ee57052f5ccc3257aa75a358f495b8093f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553888, "uuid": "c3a823e0-5dae-449a-9a65-580764c08224", "value": "8E3523829ADACD33E4B50F708E76C93668F7BD157645A30B1794FCDF1A702024A36B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553888, "uuid": "f8c97e4f-24ef-410e-be04-12d094c63046", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553888, "uuid": "b4e12617-252c-4ac7-9f19-7db962b62cb8", "value": "24576:9E1Z/VxN6kh9QVQ7bu/g+15gi1SGfNt6SJu:S1Zr4kkVQ7bIge5/DfN8SJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553888, "uuid": "e82637a9-e372-4036-b34f-bfe4dff87105", "value": 1147347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553888, "uuid": "a52b9db2-0387-4518-8693-8c06eb1c842e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553888, "uuid": "5e0a34ff-455d-4fd8-a5f9-57073a150bf3", "value": "46f65f82bc5f16b70fc5c22b0232097c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b03255-de55-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625574306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574306, "uuid": "250b63c9-ff7e-46d3-acd1-82fd0b36c07f", "comment": "Malware payload (Gozi)", "value": "bce6371b0aed287193d8f90f2b1b4441", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574306, "uuid": "941767bd-4ce1-4c71-82d7-f94ec51a4aad", "comment": "Malware payload (Gozi)", "value": "4b631043c6ff0a2fd24591b0564f7b3fc59c46319646b27cec4cf24349227d36", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574306, "uuid": "a12ed59a-08bc-409b-ba8d-622a0ad3004f", "comment": "Malware payload (Gozi)", "value": "2fc4f4c523c701dba03cf1f1e6971e61dc1efcb3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574306, "uuid": "ccf43c0d-6a2e-4ce9-8ed5-47be4defa997", "comment": "Malware payload (Gozi)", "value": "1da5be01529fdfcc8162571ca9a600e97264b6ae124a587728158fa49527002dda9a3101cd4b15e6a6f38c8bd1f72205", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574306, "uuid": "a1bcaae1-2e61-4fe9-a036-c82de24ade73", "value": "3423E0759F001876FECFA8BA417E611F86680F2183448CC7E3B1A2A46B995D57C3DE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574306, "uuid": "68b6dec8-fde2-4699-b41e-50675526b795", "value": "6e9163c62b29a1ccabed40ce8621a95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574306, "uuid": "b5cb33ed-b6cf-45b0-9db5-4f4d0f9ac6e2", "value": "768:nlGZ5Eevswd4RoFgmPsnwx+yXqv4kC9/VWH64A1xbDOhtMhDbPm+K5StOQM80Epd:lGZ5ewOKywnavdM/V+6OzsrJK9WpMtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625574306, "uuid": "655e639a-8d7f-4501-b20b-04662a1f5229", "value": 48780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625574306, "uuid": "dd0009aa-715a-4d9b-9cec-97780ef8ca48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574306, "uuid": "b22ac7c3-c368-45e8-9f59-12727f7c8a8f", "value": "2770174.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755dc716-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593746, "uuid": "9eea90bc-35f1-463c-a40f-eafd005fb3b6", "comment": "Malware payload (Mirai)", "value": "609b000c1df36e8e345240cb844c0e87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593746, "uuid": "f2674641-2870-4ce9-9601-451ec6ccc1b1", "comment": "Malware payload (Mirai)", "value": "4bbf465fd6b70ac482dcab8e13ce4da7962928e7ff365a1828b01368f72247e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593746, "uuid": "e921ec52-2fc3-4a12-ac89-ac891d74fd59", "comment": "Malware payload (Mirai)", "value": "aff6f085a35dfc608832f71b4550aca631120a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593746, "uuid": "d113ea57-596e-4f6d-9a91-b7322f66084d", "comment": "Malware payload (Mirai)", "value": "10e078b9698cbb488994120b0561b10f2f076d5fe4290e6f93fbb127709973926c2a85c317a859e8e0acd65621afadec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593746, "uuid": "f7d10609-e777-460c-a475-55b49c0cdad2", "value": "82B2E155C21A5EF2DBBF8C3419A246E0B3A50F8D4B72CCB2F2D2DF638155C2E01989D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593746, "uuid": "7be4d7fb-e8fa-46d3-a211-db374a059bd7", "value": "384:Bn+fhb79/cRN66PJEFpB5/aWKgZqAkjCjnHkrygv4p67MstxpCVxErM4uVcqgw0o:wfht0X6oErB5/aUZqAIsnEpXixEY4uVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593746, "uuid": "da641a67-a823-4bdb-b1a8-a65a216c2529", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593746, "uuid": "5f0ec6c9-cc6e-443c-a5da-10c90880a89e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593746, "uuid": "e747706d-85bc-403f-971a-f6900c3a3205", "value": "609b000c1df36e8e345240cb844c0e87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32562d09-de06-11eb-875b-42010a9c0053", "comment": "Malware payload (Conti)", "timestamp": 1625540376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540376, "uuid": "5b68a7e8-8c41-4402-9116-66ca762d9d60", "comment": "Malware payload (Conti)", "value": "617ccca7d5753993cbfd1309d1a18e1c", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540376, "uuid": "2eefeb48-15e9-4849-b4c3-4be627a5be33", "comment": "Malware payload (Conti)", "value": "4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540376, "uuid": "f8b6b675-d0f1-4c45-8689-1bb1ce969ce8", "comment": "Malware payload (Conti)", "value": "246813f9a57e030f109bb77742809e32bac89c04", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540376, "uuid": "5e3c7c2f-445d-49e4-9f50-5ddae64a4995", "comment": "Malware payload (Conti)", "value": "17aac2caf351e1e75750995a4bf001801f600495aba5eff3dfb6f48400e93b1eebda13f2ef41e37d05dcda0304203327", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540376, "uuid": "e46281e3-d356-4f5d-b294-bdf4039d4dbe", "value": "23143A15B64E4634F25A98701AFC6DB354A89A38336FC8F7B3C9467D2A25AD27430F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540376, "uuid": "28263b0f-d5da-4feb-a056-abf966620f00", "value": "c2a4becf8f921158319527ff0049fea9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540376, "uuid": "59552f50-ec14-47b3-ba7f-c348deef2291", "value": "3072:CLJGBP1t82ETTwPAobQ3tOqmb14Gul22QZkN7S44EXZN0Rx6:gJEPCTwPp03YqyNulakLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625540376, "uuid": "fc8b63bb-ebac-4028-9c60-19cb34aa7935", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625540376, "uuid": "2d352771-6b3f-42e5-9925-e3b99dfe9302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540376, "uuid": "b63c7ba5-b1ae-4437-9343-35539603922d", "value": "Trojan-Ransom.Win32.Conti.4bfd58d4e4a6fe5e91b408bc190a24d352124902085f9c2da948ad7d79b72618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b528cc-de2c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625556643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556643, "uuid": "20977ece-1df9-4fd3-b596-8a3420309dd3", "comment": "Malware payload (NanoCore)", "value": "e0e0a4ccf10bf2213e65c32e253324d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556643, "uuid": "816e46dd-5f02-4160-9bb1-8fff3701fc23", "comment": "Malware payload (NanoCore)", "value": "4c34cd2ace13b48858742d36abdf97006d0ed85e423feed289b238aa6f85f13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556643, "uuid": "8e2b6cab-8a30-40a1-9ee3-69dbc5fa4fcb", "comment": "Malware payload (NanoCore)", "value": "65d71cda1f9f27fd21f090a5a564576a0efa6486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556643, "uuid": "53e2da75-44a2-4bbb-9ab1-35a5c3b69f0e", "comment": "Malware payload (NanoCore)", "value": "c975cbbee6fabd3b9624a0477f94e4083abfcdb8019f7b7a43f7e8dd312dfe243270c42c8ef564807cdd8f332819f3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556643, "uuid": "f01d3a0d-ffc0-4545-a6cf-c3791b3b6672", "value": "C8058CBA60768BA1EDBFC7380331251C4FE9B37ED25BF6B85D94B18805D0B450A92537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556643, "uuid": "b45c0ecf-5160-4a3c-a475-53e04e21f9fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556643, "uuid": "5c3d5a30-00f2-42f0-ae34-ac23fafb3084", "value": "12288:UH2P6NsBOi5GUESkhbUyvRauvbehU56MF/ymWPpi1YO6yZAM:UH2P6N9UzV6UXWuUYC/ymKtOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556643, "uuid": "e91836ab-aeb5-46a1-923e-00d38fc47c7e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556643, "uuid": "15d9592b-10b7-430c-9f12-b0899c84734d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556643, "uuid": "2daf2493-b849-4200-8e44-605ab0e902cb", "value": "WeASwOPOdNuVKbq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd182cb-de8c-11eb-875b-42010a9c0053", "comment": "Malware payload (RunningRAT)", "timestamp": 1625598160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598160, "uuid": "459ed962-7df0-4f42-9728-b1b80ab548e9", "comment": "Malware payload (RunningRAT)", "value": "ccca5622a897b68c447ec67152486131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598160, "uuid": "5d664f28-f459-4b19-9f65-f487d98f6f07", "comment": "Malware payload (RunningRAT)", "value": "4c580d69b3340f544a71a42bf228f7f6bccfe976dee82c13a957925e88bf71dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598160, "uuid": "2e842c73-dfd8-40be-9000-1bd967b27047", "comment": "Malware payload (RunningRAT)", "value": "3d772b348a8c542fbbb3d777f92b436c19c02053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598160, "uuid": "ec4f7910-78bb-4f92-8554-560939dfa69d", "comment": "Malware payload (RunningRAT)", "value": "3893368749c54300ea150793d73179c1c9e34561873c14a2b8d4c59decacbdf36888e6d9f365a541b04581f1590ad12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598160, "uuid": "be5f16d9-6ea4-49b3-b073-580d476a6b6e", "value": "90B3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598160, "uuid": "f9736911-5f06-4dbe-9a4d-455fce81a101", "value": "7e3107c64f6a7a76d8463e3f374f74af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598160, "uuid": "c1cbbcf0-4c01-4a87-a3d2-511deb0308c2", "value": "1536:vqEA70HzLJksPEOajozLElnqiO2fdJ/tHi:vXTLJkQ7zAV3jtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598160, "uuid": "48c71b79-0bdb-4e5a-a4f3-225b96ff8dcc", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598160, "uuid": "31b3fcd0-042d-4c3a-b300-a4a8a5050730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598160, "uuid": "f1343c21-5702-4d3b-985b-53cafd9fefe9", "value": "ccca5622a897b68c447ec67152486131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88376b7-de8c-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625598153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598153, "uuid": "fa9ca3f7-613c-478f-bea6-ce337da46bd9", "comment": "Malware payload (SystemBC)", "value": "6d1ddcf3849b1691b30ec631dd285ae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598153, "uuid": "58b04aeb-6716-4d62-94e8-ed81c1efd922", "comment": "Malware payload (SystemBC)", "value": "4c9b94a436c517923a69b14f4cdf6324bc84ca5b121b04770665d82ed0989f7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598153, "uuid": "c1332e17-6371-4655-b778-e9fd4a5f9f23", "comment": "Malware payload (SystemBC)", "value": "0c3bb96c7987ea9d0c15793dc8b8518e914d6914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598153, "uuid": "b4c20d33-aa87-4dcd-80f4-2a9267f955f5", "comment": "Malware payload (SystemBC)", "value": "0da62a3624ab92eb9e3c2d0bcfff0d4a5dcb24131e47fe4837bf4111017e3d2d395ffe4e76730df0c6475767ed3372c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598153, "uuid": "55292d7a-f779-4ebe-adec-3b21c3332029", "value": "CE847E36F6D08437D2732678CC5B56949C39BE503E295C472FE82E4C5F39B813AA6293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598153, "uuid": "5055da87-c581-4b8d-becc-ebf8249e693d", "value": "99330628a6833d5db21e94c072c86e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598153, "uuid": "01afb44f-3a39-47c8-8d1d-162939acf6db", "value": "12288:l7YLXsOq4s8Nzb8TiDxgBtM7+PRCE0/1tsN9kqpAnk096k4:KrsONNX8TiDxgBtMi0E0/1tsN9kqpHUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598153, "uuid": "995af140-8c8f-48a9-b73b-f4a3de4dd34e", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598153, "uuid": "38d3e466-8b73-48a2-8b06-df3c17632b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598153, "uuid": "f1ebaeba-e7d7-493c-b469-8d97c96070a7", "value": "6d1ddcf3849b1691b30ec631dd285ae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1b16f7-de06-11eb-875b-42010a9c0053", "comment": "Malware payload (NetFilter)", "timestamp": 1625540365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540365, "uuid": "aa5c31c4-52d3-4578-8bae-27f84db517d7", "comment": "Malware payload (NetFilter)", "value": "ccea678c13f13a8d6438a314e26cdc2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540365, "uuid": "4123ac8d-a06a-492d-8910-7e8103c30b7e", "comment": "Malware payload (NetFilter)", "value": "4ce61ad21f186cf10dbcc253feee31262203cb5c12c5a140d2dda5447c57aba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540365, "uuid": "e70ce026-a60e-4a34-bb48-d480c592ec2d", "comment": "Malware payload (NetFilter)", "value": "3b34f042bfc12062529595706493086fffe9d61b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540365, "uuid": "67ea7e08-e775-4485-9067-4f8a1dcd6da9", "comment": "Malware payload (NetFilter)", "value": "fa5f8e6b25ea1a0f40036a7b8da18fdde0bc58b4ead82caf6325bd74055b0673db09edb1b0e473a4e23c13e0cf752c64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540365, "uuid": "707b02c0-11b0-4dbd-8fc9-1be70d244a8b", "value": "B6138F6258D484A3FB712C7082D8EA57FD7C95720750A1DBA760CDE509723D1FA3922F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540365, "uuid": "4754b631-d68d-46aa-9791-6b1b8ed294c1", "value": "5332d6ec505eef7d22f5da99801112e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540365, "uuid": "f8431bc0-135c-4e22-b2d8-e235e024f4cb", "value": "768:m6x+U4qF2Qq+lXWIulCrD+Kzqp965OYnW/zD2UtNz6KTQMzdIrOAbDE6E:m6x+U4qFbq4rcCrD+Kzqz65TWv2SWOWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625540365, "uuid": "a0646461-7cc8-42e6-a9dd-97952169c977", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625540365, "uuid": "f10c5b11-2c84-4dbf-bd68-4ab19e3b1253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540365, "uuid": "3ef41480-d857-4e7a-8f6c-bb665f325ac6", "value": "ccea678c13f13a8d6438a314e26cdc2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11dc7b3-de6e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625585310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585310, "uuid": "3cbd9a5b-5f2f-4a35-981b-bde3e7199ca3", "comment": "Malware payload (RedLineStealer)", "value": "89c0f24aa904cc9e20a4fb42455ea1a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585310, "uuid": "5db98ea4-8a5c-4aeb-80d7-018c85a82924", "comment": "Malware payload (RedLineStealer)", "value": "4d024ea21830f87d45626c092d8c93456eed565bd9feec02f9a4d6f74134dfd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585310, "uuid": "87af40f1-8b2c-451e-9205-2789d5b238a8", "comment": "Malware payload (RedLineStealer)", "value": "4ad36db2c11d5f14b324da3214e2e47a2dbf8a80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585310, "uuid": "253a5077-7dd6-4bcb-899c-bf0b9746eab1", "comment": "Malware payload (RedLineStealer)", "value": "75aa69246e460af45a604c486a2f61e605231ff60c570d52fde1af1f657a3587ae547c72b1b443d31b3e2b3955e30fa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585310, "uuid": "1a2c436e-efc4-41b6-a92e-2b4b9f6c3a10", "value": "7054E0217980C872C49605309CA8D2B46A7BBC7269B4854B7B883FBFFD322C35779356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585310, "uuid": "290f9df7-e835-4f40-93c5-c3a165490702", "value": "cdab0fef7b5479a045b4ff0657b0733b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585310, "uuid": "c0487252-1754-4efb-8157-5fcdd4782165", "value": "3072:rAN7PNSzrOzG+XXkbe5Oy8ZmKj5vdgO8QCojDyOEuWHVDiShO6TRNctwgAPD5J:gPNSzrWkbkOtj5b8CDS7HpHhO6rlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585310, "uuid": "1006ecbf-0a1c-4c55-8caa-6312c693ed07", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585310, "uuid": "5a9259ff-bfc1-42a3-a18d-894b4b8388c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585310, "uuid": "6ddc043b-4663-4056-b85c-73790b127477", "value": "89c0f24aa904cc9e20a4fb42455ea1a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8f5666-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614504, "uuid": "e9129481-aa52-4e9f-a9d9-575637251a7f", "comment": "Malware payload (Mirai)", "value": "ea9246911f463e855a2d7f5dc0182916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614504, "uuid": "39e72c0c-c9b4-4c94-a0f6-2c8baf31195f", "comment": "Malware payload (Mirai)", "value": "4d8d58fde8b1fa754cc0270f1d0dd9652ab30cbc470252cdddbfeb6005318360", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614504, "uuid": "85a92cb4-9eaa-46c9-bf04-2f700c2e8655", "comment": "Malware payload (Mirai)", "value": "aa04dca8db2a318c5bd35b89332b7f0173b40ed3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614504, "uuid": "dcac4db8-f8db-4bd6-9b89-d8771d1e0e2e", "comment": "Malware payload (Mirai)", "value": "5d88477510563594f95b6a8bfbb2350815968af41668067a022010674ef22d88770a86805b79698f3b16a01d851e4dca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614504, "uuid": "f6f97185-edb4-4481-84cc-5f0f472c3943", "value": "E38329827881AA26CBD057BBFA6F108E331567A8E1EA73438C151F5577CA80F0DB7746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614504, "uuid": "3dd66e72-b881-4fdd-94fc-d87b1d532ceb", "value": "1536:+jBHVWDE3o0RonJUrTVCfOek7Oqlo/vMHyytPhpJeZWaxRUM:+j5VWDETRonyPhTwnbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614504, "uuid": "bb4af905-27f5-4b03-b8eb-4cf84d0ffb70", "value": 84088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614504, "uuid": "8d3c6832-e2f6-4c77-b64b-0ebbb79a08a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614504, "uuid": "e0bdcd4c-dff3-44a5-a08f-8033a801fdd6", "value": "ea9246911f463e855a2d7f5dc0182916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ce5e7c-de83-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625594277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594277, "uuid": "16739b31-9711-46d6-b8e9-757d106de162", "comment": "Malware payload", "value": "eff69b74c8298ae446ed82de872e0622", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594277, "uuid": "6d394d98-6318-46f6-99c4-124345e6098b", "comment": "Malware payload", "value": "4faf63b988908543a01c89a83f0267cf63e1641ee61e617755897e794941478a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594277, "uuid": "f949e2f2-923d-4179-a9c1-34000ae8fb50", "comment": "Malware payload", "value": "9b658e556a48aef597113031193e465147043452", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594277, "uuid": "6150d0ca-1612-417f-b8af-720a45ff7481", "comment": "Malware payload", "value": "5b470477f510542d2fe11c4d666dc6389964b6bfb8e97829abd2e2f9d42032a0c15d5469ef8522e18119ee38fae552ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594277, "uuid": "b80e51e2-1da5-413a-8677-f9c4d0e5b7a4", "value": "3A03E106850144CCE6744CF4365F13899A664FABA8131C5BA2F0FED6DDCE0E8B829ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594277, "uuid": "7c87dce9-6e95-4382-8107-3f826f62a527", "value": "768:okmHoyhJ0dSKpfDy9BtKdGDvI+w6gVNONISz5s3GcpS+0XlJ7nJgGlzDpxYs5:x6oMqxDFGdw6gq6S58mlJ5VrYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594277, "uuid": "b42231cc-8332-48f5-ad72-1c8fd7cec007", "value": 39196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594277, "uuid": "7046cced-153c-4e1b-9cd1-548154bb5b70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594277, "uuid": "eac69f29-275c-42ad-87cb-0944cd4aadbe", "value": "eff69b74c8298ae446ed82de872e0622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83aae61c-de8e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625598924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598924, "uuid": "4fed55f6-b6b5-43f1-9ab8-500b82158c91", "comment": "Malware payload (Mirai)", "value": "9998fa303183bf369862fd8240317eab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598924, "uuid": "c2afe8de-22cf-4a83-8de6-ebd9c0090b04", "comment": "Malware payload (Mirai)", "value": "4fdc964427708dce1e9900168426753bc2bc1de06b002301871f6af5cdc0514d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598924, "uuid": "a98c9c45-5ffc-4bff-915a-2596271b2025", "comment": "Malware payload (Mirai)", "value": "7261e64fa40e6844876562ccec44de0ef3aa5317", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598924, "uuid": "61fb1bf0-1e28-4a48-8e66-d4dcf561ff9f", "comment": "Malware payload (Mirai)", "value": "717683fa5911a4cc1cfa5edfa9bfffff1b1285087b609abb0d29b6a3297aa64f99ba89c3b7048593e807376a0a5e4adc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598924, "uuid": "69bdd4c0-998a-4f20-bb64-f7e9bbdff555", "value": "483302B7095EED3095B8C832DD392FCEE45582CDD9E939B72B80685499820C3AFF5352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598924, "uuid": "01b17cfb-2f48-4a36-af5f-b200e0076d05", "value": "1536:5lpE2AW3fRAYVYpQe6ueLmHBVxUJjFTfn:pd3Gb+LmHBVeFT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598924, "uuid": "8fc5f23e-cff8-4240-9f21-aed9592d8dfc", "value": 53320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598924, "uuid": "c51670ad-a208-4900-b847-a11dad288669", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598924, "uuid": "2750ff11-6a5c-4b4e-978d-7ef62cfb954b", "value": "9998fa303183bf369862fd8240317eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b8cb19-de5a-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625576759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576759, "uuid": "ffe67c3c-2393-49ac-b4bd-0b86596f0c96", "comment": "Malware payload (IcedID)", "value": "dcd1fa0b71a3bb9c11cf0899a6b3addb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576759, "uuid": "617d5117-2434-484d-b3d1-3cedb658bd32", "comment": "Malware payload (IcedID)", "value": "50d9eefeb3f4c066d06dfc84c1f4d2576f1544eeb85d2c9940f6b0932a77dcde", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576759, "uuid": "8b86c008-cd17-42cf-a842-94f8efc7424e", "comment": "Malware payload (IcedID)", "value": "894e9de6e6aa9796236523697905baf0a6c7282d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576759, "uuid": "010b0db0-0115-4e6e-ba7a-02e67efacec0", "comment": "Malware payload (IcedID)", "value": "ea93a4c1fe5ac2f7c3bc68caa372da2f87e5037980be69e7b995ac0af0bee85ca6901d8250d52e43a254c322f422118b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576759, "uuid": "917827d4-4f39-4b57-b7a3-1e4342e18f46", "value": "F2040155E162E6DADEA01C3E70F7414AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576759, "uuid": "bda9276d-7138-4982-8e03-03809271932e", "value": "3072:0DusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:eRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625576759, "uuid": "145314bc-965e-4411-bf5b-562831854fcd", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625576759, "uuid": "61156834-2376-4223-9baa-8cc992d4f870", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576759, "uuid": "af924c2f-02c0-4a85-b6ef-69fd316e31ef", "value": "DeliveryConf535215.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a32589-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625588460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588460, "uuid": "3c7a438c-9215-44a6-8a77-c298e2c12111", "comment": "Malware payload (SnakeKeylogger)", "value": "9abf246fd93d2ca36d02c2c7389fe7a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588460, "uuid": "5f3fe712-604b-414c-b322-2176369bd806", "comment": "Malware payload (SnakeKeylogger)", "value": "510a312fcfeec1d100edf69e1f8a6f0acfbb0116be390849550743a39349b84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588460, "uuid": "97fbcba0-17ba-4b70-9b37-00991e8f3f7f", "comment": "Malware payload (SnakeKeylogger)", "value": "4138b1597326cc42a03b8b6345b70214483fbed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588460, "uuid": "40b74038-0681-4e1e-abef-c9611d116d4f", "comment": "Malware payload (SnakeKeylogger)", "value": "b72560cff003e6b2f760b224654f9f57faa15a742ae6489b34bdba2b64138928eb3eea73bbe40bd0dbcfe01d16610eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588460, "uuid": "0d93c5ff-33d7-473e-bfae-9d38ae2a3a4b", "value": "8C056B3D59BE213792BDD3999BC88D2BF840D63B70217E7898D743A5470AA4379C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588460, "uuid": "b9470c40-a1ea-41a4-8a20-59b7a8ae6e91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588460, "uuid": "b999acc1-31ce-491c-aa98-71ac8b9ec323", "value": "3072:DlSqfUfxvs9pQre4mugvlxpuu3d7cTXKpoukvy7FITfxsezQgUXzIwbmOOcJ3Xd5:AqAx6p14t4OuqDum0I9s9gi/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588460, "uuid": "8b89c7e9-aec6-4126-acca-f678d4b42c03", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588460, "uuid": "00241a02-ec6e-4632-b012-b1acb4ef5899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588460, "uuid": "2b2dac34-534d-45bc-b9e9-e9d5245aecd4", "value": "9abf246fd93d2ca36d02c2c7389fe7a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950e4329-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625588215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588215, "uuid": "15da5a3a-8219-4d2c-845e-52b7c28d063f", "comment": "Malware payload (SystemBC)", "value": "f24e7ee0c457063b44aa7418700ff8af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588215, "uuid": "6193143e-7e18-472e-b892-4f2f3c8a6090", "comment": "Malware payload (SystemBC)", "value": "514f626c85b0d36a44be4a3c5e57ad138ed585d440b621e21d0fe74544794cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588215, "uuid": "e54e1a97-2774-4be6-ad78-e8e0fbc2d730", "comment": "Malware payload (SystemBC)", "value": "01f8c1193c946624941146aa7f4e3c5ca6933b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588215, "uuid": "d8415f58-73c3-4e54-b10a-c936a2949ce9", "comment": "Malware payload (SystemBC)", "value": "df53316729fb7e4ee4b9ddcc4fecac297509451815c5d9d7ba52a5370199304e9fe794941d3b4f22b986957ee1c2ccca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588215, "uuid": "24a226e8-da98-4960-a545-21553b61c963", "value": "8E847E36F6D08437D2732678CC5B56949C39BE503E295C472FE82E4C5F39B813AA6293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588215, "uuid": "015b47ab-9a7e-41ce-b41f-ce4353bb2a4f", "value": "99330628a6833d5db21e94c072c86e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588215, "uuid": "50bb6542-1323-4335-abcd-1bbf4e42f5b0", "value": "12288:l7YLXsOq4s8Nzb8TiDxgBtM7+PRCE0/1tsN9kqpAnk096o4:KrsONNX8TiDxgBtMi0E0/1tsN9kqpHUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588215, "uuid": "54e8817e-a777-44f2-806c-8077f9bec979", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588215, "uuid": "d943a396-868e-4afa-9bce-4d7c74702b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588215, "uuid": "5f1885eb-a8b5-4c20-968b-2c4a1952ffe3", "value": "f24e7ee0c457063b44aa7418700ff8af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffc44e1-de2f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625558008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625558008, "uuid": "6783566e-d5bb-42f0-8bb4-56d6a69ed1e7", "comment": "Malware payload", "value": "a57ae470f5c7fcd242c675d4540abb50", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625558008, "uuid": "2de1bcb5-fd43-46a7-b4a6-aaca068eee4f", "comment": "Malware payload", "value": "5310ad5684488ca2cea9a3994bcabd2bb85cdc99f6cfc3eca77d03761fc0ff95", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625558008, "uuid": "3f4760a7-4c1a-44bc-ad99-276ba456b34b", "comment": "Malware payload", "value": "d6efb5efe6b0922d351ea2d2cd8d330fe06c6596", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625558008, "uuid": "8f7c2b04-1958-4634-add6-bf83e52eef4c", "comment": "Malware payload", "value": "3852b85b7747a6af0c2333872306da6b4a9bdd34642ef184b11a739e85a31ea02cf6eace4191421ad57ea22cb78cbfa7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625558008, "uuid": "f1b7e125-d024-49b9-8cb3-ec05f01f6969", "value": "CC4533D2B76CDE89F658D8AB885F0D40FF9549CF9F1608106BD4C1D6F290B92EE3940A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625558008, "uuid": "6fdfb144-03b9-48dc-a344-318435224bfb", "value": "24576:S7VvzQlRNrbXD6+pvWPuOlXEYDrltt5halyJQwqSR7lwfuWE+X:e+f3XGKEKYDrf/QlyJQwxR7+uCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625558008, "uuid": "760ff488-d0cb-4199-8859-8f9c48bf8d0b", "value": 1220354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625558008, "uuid": "4924ca37-1de5-4d79-8347-11e63bcc285e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625558008, "uuid": "2335607f-83e3-4630-8382-b5affe9d02ca", "value": "Bank Swife slsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7051801b-deb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625613923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625613923, "uuid": "e2d47f14-9bab-48da-b853-aa3c5c8cda37", "comment": "Malware payload", "value": "df2b42645e6baf88259767f9ddbd2afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625613923, "uuid": "a7ef32f1-816c-469f-8b84-205452f73170", "comment": "Malware payload", "value": "533d71561ae54fc4c3e621b417c1e511d762d4b42b1688ceffefed21f46d6044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625613923, "uuid": "8e6138f7-2539-4091-b802-eadcb873f747", "comment": "Malware payload", "value": "466a623dec157037a5d5e398b2f9768448ff52e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625613923, "uuid": "5a5bd266-5a6a-4a43-83b6-6fc6bfafdb8e", "comment": "Malware payload", "value": "42d045dd8b50ca6b2ecc0b393efd2a7fa5cd044863575d6efd609ceb778c7f717e738648f65a7f51287c73872535b002", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625613923, "uuid": "0bbe69d1-e776-4527-8916-bbf443a8eadb", "value": "2FD63328BEDAC1FDF9AD58B2E681E5F4B8C36F5161568131E18D3CEC9838811A323577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625613923, "uuid": "ebdd4255-e78d-44d4-a711-bbc4211689d9", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625613923, "uuid": "d01cec39-23eb-4522-88ba-128f2331a35c", "value": "393216:ayWW4YCKg7jsCvn7asvbPGFYKXl6QpPTcFQblF:kx8Cv7asLsXl5cOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625613923, "uuid": "9b204067-b823-451e-aa73-990c7c28372b", "value": 13098020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625613923, "uuid": "49b429e1-6b30-447f-bb8d-b8e6d907ef01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625613923, "uuid": "4d79f19d-8c57-4353-9149-5cd712265643", "value": "df2b42645e6baf88259767f9ddbd2afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa6fe32-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625553417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553417, "uuid": "05e543e8-000d-4807-8364-0ba55b140a66", "comment": "Malware payload (SnakeKeylogger)", "value": "c8119d886b12dd550b2b898b2729652d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553417, "uuid": "6f8e32d6-a5fc-489e-9145-6bd34c75b5bd", "comment": "Malware payload (SnakeKeylogger)", "value": "54312ea9106139b43ff7ab38cdee369e00aa1b5d6433971e167716e9a55ee4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553417, "uuid": "88276752-b492-4ab9-bbc6-c9e8a85cc0f8", "comment": "Malware payload (SnakeKeylogger)", "value": "a736816d4b58e76345c3da24910181653e5674c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553417, "uuid": "1cfb0956-b70a-488d-9ff8-287223c8746b", "comment": "Malware payload (SnakeKeylogger)", "value": "86888454e0c15d37283a39672f1a7d9e6b9ebf10a1bbfded399f299810cd4d533100c7451265ea614a53382293880799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553417, "uuid": "e3ce4be9-c0ae-4cce-8ee3-8c468322de42", "value": "41A4F12437D9895AD03F8FBE94A27A42837DB7237113E31919D5319D0AB37818D82A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553417, "uuid": "0eaafcea-84c1-4d1e-b874-5d2109ab6593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553417, "uuid": "f197c8f4-bbc2-4016-877d-250d0dce5c8c", "value": "12288:VW2OLZNAwP3foVETDuKzWOS0ht8xvkAEx84:ZwvAKXWWt8xsU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553417, "uuid": "969e3a69-8238-4ed0-a28b-5bd0b751e236", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553417, "uuid": "00d7fb94-c5d5-402d-a511-f5622bdb4b11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553417, "uuid": "57bf0ed1-bb95-4bd6-980a-db5ddd93e999", "value": "c8119d886b12dd550b2b898b2729652d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d060dacc-de3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625562975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562975, "uuid": "65458b0a-c9d2-4741-807e-3e815815a528", "comment": "Malware payload (Formbook)", "value": "318c866ef078ec6d9597aaebed8bc370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562975, "uuid": "4fe6303d-cd6c-4e68-ba9f-2d1cde8880d1", "comment": "Malware payload (Formbook)", "value": "54469ace58ddcfdd6d834574d87003857b0cda05e27a0b8e31cb0b58e6ca105d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562975, "uuid": "45365071-f5b3-4f16-8bbd-52afdd946267", "comment": "Malware payload (Formbook)", "value": "4d0008cb7d64f6fb5378672bc4a2edba43546e1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562975, "uuid": "9442ffb1-0986-4c84-8338-dd9f62f6c195", "comment": "Malware payload (Formbook)", "value": "7299231bfd0580e34d5af7db1830061b5cdab29e4fca50034346d473b3bf75bef1721ee3bc012330d9ae08ab9d371a92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562975, "uuid": "455ae9cf-16fb-4dba-a236-c22d05846969", "value": "D7058DB960768FA1EDBFC7380331251C0FA9B37ED25BF6785D98B5880590B850AD2937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562975, "uuid": "07e62ca2-3f90-474a-a371-120989644126", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562975, "uuid": "a9e63436-d6f7-4170-8abc-3c87a7af624e", "value": "12288:uM449P6NsBe1CpeaRbfTGLHYBXo7039scwiPF+Nc00njK6yZAM:uMLP6NV1CLbboHYBYIZ9+NBied", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562975, "uuid": "d400b6ed-bc44-43e7-afca-24256ccf3e55", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562975, "uuid": "57acb277-a316-4fe7-8f38-c42a4552418e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562975, "uuid": "9b9f06a9-b70f-4645-b082-dc1f31b14067", "value": "318c866ef078ec6d9597aaebed8bc370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5edfe0-deaa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625610966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625610966, "uuid": "8f4e80ce-f3ef-4f29-ab25-f2c3852d2988", "comment": "Malware payload", "value": "13cf6e639bd4d6c7478f438e001beec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625610966, "uuid": "eee3e541-f152-4f18-9741-a861b757e263", "comment": "Malware payload", "value": "548aeca63c758e896a8959a1f0a4dccd5fc87ae57af14916e54a7f4758808db0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625610966, "uuid": "394fdb35-d6ec-4de2-ac6b-e34c09a82d47", "comment": "Malware payload", "value": "e6d1ba18bdb941636a2f03f4199e6fe46c04c3d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625610966, "uuid": "e4291dfa-b3e9-4872-893f-2b9035f1a8ab", "comment": "Malware payload", "value": "d50afbcb32281d8b00883d69f62900cb08a98d959cee42a434ad78580a979c8847682e6e4a7183fc9902e6f31e1219b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625610966, "uuid": "927c9fea-1186-46ec-922c-f876b11ae041", "value": "6A95F10675C8DFB7D18792759980D2B24207FC46976CB0C7F2C1BB9E21717F6422A3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625610966, "uuid": "40028a35-7094-44b1-babe-89fbabf4316d", "value": "fee9a94171107f726d5f8efe9e99a932", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625610966, "uuid": "f44eae8b-efac-4be4-b7e8-bc2384786f16", "value": "49152:p528wME4n6U/COuRMdt/8zexPwT0zZb9Im/xnGi5GvJs:bdFuzelA01si5CJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625610966, "uuid": "35e6d052-5d19-4064-b5c7-fbed88a78a82", "value": 1975640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625610966, "uuid": "db6a1da3-964d-4282-8c2c-ab7108a6dd82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625610966, "uuid": "e067821b-6fd9-4b86-81bd-6c66818232c1", "value": "13cf6e639bd4d6c7478f438e001beec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb760755-de1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625550055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550055, "uuid": "be72fc6e-3639-4345-bc10-8e4c993523e7", "comment": "Malware payload (Loki)", "value": "951dba25a106f229296a5c962e3eac3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550055, "uuid": "61b94d11-42bc-4ddb-a745-9b3b8f4b4d57", "comment": "Malware payload (Loki)", "value": "552dd950f4bef1f3b4323bcd35b0870357c244652da51cd2a1494301d73d790d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550055, "uuid": "88823f08-1a2e-4c0b-b7a2-6dd482712e76", "comment": "Malware payload (Loki)", "value": "e867865f4a9ef9df5bb54e6d75f728b287bca910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550055, "uuid": "62da7dc4-74a2-485d-86fa-95c8c41217cf", "comment": "Malware payload (Loki)", "value": "1f9e71947dee20706425fa68ba47a42bb1db4ffcc5ebf85dbe663bc5ffa27661ac6ea6a5c90a09a59b3c33afb1bb63bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550055, "uuid": "cd42a3a7-4f21-4dbb-a550-f73b920587ba", "value": "8DE46BBA61764FA1DDBFCB381331251C4FA9B37ED25BF6B85C98B18801D0B450AD2627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550055, "uuid": "7ebc3d55-35ca-488c-b274-ffd947084de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550055, "uuid": "5e6a3b5a-f312-4871-8499-82cff0ffc6dc", "value": "12288:8XP6NsBGhZZm7HP4e1kArgZMm7+p+/CXlSeUd00Pl/6yZAM:8XP6NZzZmDP1kA/mi++lSd0El/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550055, "uuid": "88d5cdc3-c8ae-45b1-aea1-811b2b93d514", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550055, "uuid": "01d90046-a8cb-4573-aa08-18c117d914e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550055, "uuid": "d720c9e6-93fe-4a37-93d5-3a0cc54063da", "value": "MTP-????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf68a68-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625588257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588257, "uuid": "05f7c478-fa86-4f55-ad47-3b8de94e1c0b", "comment": "Malware payload (AgentTesla)", "value": "34520ea9ae0e91cbff28d13584244dc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588257, "uuid": "d9a97672-31e4-45c8-a453-bb62562cfa43", "comment": "Malware payload (AgentTesla)", "value": "554f95c190f54b9a2e9c0dc745dfca5dfec13ddffcfcf7fa4d470177a7b3bc33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588257, "uuid": "73aab598-515a-4fe3-b916-297829451e2a", "comment": "Malware payload (AgentTesla)", "value": "e3a520129efc9cfcb806dc6cc287a94649b539b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588257, "uuid": "a95fe09d-2682-47a0-9f3a-f4bac4be5d9e", "comment": "Malware payload (AgentTesla)", "value": "1a62720402d7c1c130a60c82b5cdc18c19190965a4bdf6ec3be9755ace1ca80d519d5937c560cb1b386c600d81558d67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588257, "uuid": "c13baccf-eb21-4d70-a465-688381be2be2", "value": "4F05AD0437679426F421AAB5B047DDF1D628BF526C02D1AB6AC53F8B3537AC5CEC01AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588257, "uuid": "e40782cc-b793-4246-8c3e-038aefeab1ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588257, "uuid": "b825006b-02d0-4fbc-a6b3-f09bce41b9e9", "value": "12288:IqEwRWorJTmDofifEz3Xg77TzYRHQDVXbobT:3WgxfXXg77TQHQlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588257, "uuid": "ee1c7a66-d4c3-4c9f-8fd7-acc6dc1b5643", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588257, "uuid": "1ef523b2-6aea-40fe-b395-9dd829ed84ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588257, "uuid": "e86eaf08-8cb6-4b4e-b135-c0442263babb", "value": "34520ea9ae0e91cbff28d13584244dc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e275e53a-de61-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625579755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579755, "uuid": "cd639419-7d49-4452-84a0-e984995e48b0", "comment": "Malware payload (IcedID)", "value": "a4e97ce76c7a39ee9fa541a3c660a333", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579755, "uuid": "44e86f2a-587c-457a-a9bb-98787e5b63b0", "comment": "Malware payload (IcedID)", "value": "56b6de63e55ae6d81433f309af5b5d29ccfe7ec9d45c644572029256eb2c6e41", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579755, "uuid": "488643d4-4e50-489f-9084-87c6bde1196d", "comment": "Malware payload (IcedID)", "value": "e3bb71833f604da1920424049ea0c15912a6a6b7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579755, "uuid": "19bb1711-ce5f-45d4-a5be-caa5095bca5d", "comment": "Malware payload (IcedID)", "value": "ea460912ab03f6672c0f11f083d6ab7779937f4b7e6219235f5c4a3482814b7ae2207f99ff73120f3dbc74c882d418fb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579755, "uuid": "7d8987d5-45f8-408f-9231-5b69bd8faf9f", "value": "E6040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579755, "uuid": "5515f853-9e30-4543-9af4-5d58cdee0898", "value": "3072:+DusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:cRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625579755, "uuid": "5c8e5fcf-090a-4262-8804-d399db2246e4", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625579755, "uuid": "53953267-ef51-420d-8431-56ae079f3fae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579755, "uuid": "3aa6842d-ed6c-437c-adae-f19a7baeb00e", "value": "List-4527768.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c7b8c0-de55-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625574312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574312, "uuid": "91f35ad5-92f2-48a7-9cb8-86a17e63dfdd", "comment": "Malware payload (Gozi)", "value": "c40709736c45151601de6db50f379d8b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574312, "uuid": "132eef2d-5d7c-4d18-92f1-93acffe3dcb6", "comment": "Malware payload (Gozi)", "value": "56b998448c4cd2240edcf0446c8bc7da54f4568ba99d1f3774c43af202aac995", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574312, "uuid": "c1fe0497-3b31-4eb7-9c9f-47033ec7d694", "comment": "Malware payload (Gozi)", "value": "96fcdac225106f13726477d898a4939ccfcd4781", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574312, "uuid": "be1e244d-2c2f-45c4-9f58-854b51691103", "comment": "Malware payload (Gozi)", "value": "6e3e61ad1a6552640256dc9416c26c1fdf8ecbf9eab452c198e58fd61ad6b18ef4255919150003cdc00125608c87a3c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574312, "uuid": "7d4d7c0f-77c1-42e8-9ef8-e23f8ff9b56e", "value": "9513F1B66E100CB2EB8EA9BD017DA52FC36A0B619724DC47D772F3A435995107C3E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574312, "uuid": "b25b202a-e03e-4b2d-b919-2f055d8d3933", "value": "6e9163c62b29a1ccabed40ce8621a95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574312, "uuid": "6925bfba-5c68-4df9-9b4e-92de07e28291", "value": "768:nlGZ5Eevswd4RoFgmPsnwx+yXqv4kC9/VWH64A1xbDOhtMhDbPm+K5StOQM80Epp:lGZ5ewOKywnavdM/V+6OzsrJK9Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625574312, "uuid": "2f4c007b-ccfa-4447-88e2-fcc62ad64f47", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625574312, "uuid": "9ce30e2b-dd03-4780-89a2-131e2fba3b11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574312, "uuid": "4dd21a5d-7bab-4ff5-8c24-578a38153db4", "value": "2790000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1634ca9-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1625551004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551004, "uuid": "64cd1e93-8771-4952-8c6d-c074832394a1", "comment": "Malware payload (njrat)", "value": "457785e9ebb467a0c4d62cb89de38680", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551004, "uuid": "e35c6517-6a71-4149-b935-25317a9869ee", "comment": "Malware payload (njrat)", "value": "5874bde7e08f1581325fa98e5422d3e2d62edd7d8b2ae4bdbc54a5fa92c0e035", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551004, "uuid": "03ee0638-6437-4033-ae90-a07a31465201", "comment": "Malware payload (njrat)", "value": "f18967378ffc5f1715d300d9ac1d254d2f93c771", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551004, "uuid": "22f12fe0-6226-40be-b7a9-e077c2d7aa73", "comment": "Malware payload (njrat)", "value": "6c78b0f7dfdf5ff6053a5ba63e14979ee8f9029058d393bca6f9ffed1141f8a8431a4ebb4f4541d4f07bc1427746096c", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551004, "uuid": "c9bb4348-20d4-4ed1-bfb1-d04ce0f57ed5", "value": "29451249E3C65A12C44749B08D5EF09B9EC53EB0D2607B280F39BD9E6C79DA1B39706C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551004, "uuid": "4334aeb1-e717-4c1b-936b-0fe87408f1ec", "value": "24576:eeLIl/+TzIp/qOgdd8RXaa48LXkmrPiziu7z7g5Sv76SlODxThd8Wj:e7MIpCOgD8RKa3X5rO7A5uvCRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551004, "uuid": "3528d70f-c76b-4e34-88c6-86656694b99c", "value": 1189864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551004, "uuid": "fea08716-f43c-4c24-9c3b-2fe9aba33428", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551004, "uuid": "f60fdb70-d56f-4ba1-b2b7-6d3b15f4a1e5", "value": "G50 EURL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be501c0f-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625556072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556072, "uuid": "ba98bda2-1b03-4f77-8770-3eae9936410e", "comment": "Malware payload (AgentTesla)", "value": "0376d443b0e1233cb070dbbc10e82963", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556072, "uuid": "944a0e3e-bc7a-474d-8831-b79a80c56c09", "comment": "Malware payload (AgentTesla)", "value": "587eb8ee608b6c5f4fc00a804d05b8dcb97ff5e9b0436f46e89872fcdc803d58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556072, "uuid": "72bce95e-b1ae-4f85-8d3f-c6b8502f6e4b", "comment": "Malware payload (AgentTesla)", "value": "ba99feb09abc8c49be89a8e35feb0912fde2ef1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556072, "uuid": "a4bd5505-5a53-469d-a6ea-a71a8a7a158a", "comment": "Malware payload (AgentTesla)", "value": "dec4d2d9da4b535c7c9ada58df02f6d2eb4511bae5d7cb0c8ef74e319dce60aaf3de44cd211354a657b88433aed3f21d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556072, "uuid": "0bcdd600-8092-4ff8-98a2-278b510440ad", "value": "47057CB960764FA1DDBFC7380331251C4FA9B37ED25BF6B85D98B58801D0F840A96A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556072, "uuid": "a0763b1d-871f-4b59-a6bb-b808dcd430be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556072, "uuid": "b380ee33-10a6-49e9-965a-b8061476c4f6", "value": "12288:BrP6NsBfx1QRUnnY071CYWE7nbTbrRbQePvPX6yZAM:BrP6N4xfnf71vWCbTvRbQe/Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556072, "uuid": "e2b6c0c4-120b-40f9-a93c-ee98249657a1", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556072, "uuid": "2ba2464f-be8c-48f0-b33a-2bfda0fa4457", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556072, "uuid": "29d45ba3-f1e7-43ea-8c37-25424bd1d4a2", "value": "0376d443b0e1233cb070dbbc10e82963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2bda81-de35-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625560553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560553, "uuid": "5d5d9d23-8728-4184-83b9-ad1baba38b03", "comment": "Malware payload (AgentTesla)", "value": "a135281a78c9a107d3c71eec214f7bd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560553, "uuid": "e27413e9-c235-4fef-8638-f011e5661aa3", "comment": "Malware payload (AgentTesla)", "value": "58eb73054029eb65e3bfbda97cba44d3b4c17cfdd91fda015117285b2bdd717e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560553, "uuid": "6a03d12b-7ede-4d84-ba1a-e78ce98ccd78", "comment": "Malware payload (AgentTesla)", "value": "1fef389f75ba7f9a7b8183a4ccf7c947946ab09b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560553, "uuid": "a5ee29e8-0b19-4432-b95f-d26e2933bf4a", "comment": "Malware payload (AgentTesla)", "value": "714fc9c755f8460b0d80d6fe71687807e39da51449df0c2bf0eeb1598d68279e81deabc1c98cd610be760196f6c6a0b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560553, "uuid": "4ead4a51-883c-48c8-9e62-f6a71b1c157b", "value": "2FF47CBA61764FA1EEBFC7380331251C0FA9B37ED25BF6B85D58B19805D0B440A92937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560553, "uuid": "6657adeb-e3be-4795-82d3-2bba90291ab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560553, "uuid": "d6a7f6f4-ae5d-4fce-aff5-3d4393a8cc23", "value": "12288:S/aSP6NsBO5hBgZ9MglcJsHLXSe2ITjstQnG6gbBzAh6yZAM:S/lP6NF5hBgZ9MgyJALCZaxYlzUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625560553, "uuid": "90834b4c-1522-4182-94c0-8c09c80de34a", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625560553, "uuid": "f38bb358-5665-4d38-b30b-eec8be910a96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560553, "uuid": "d04490be-2b42-4995-8e5e-590901dea68d", "value": "PEDIDOS RETRASADOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbbf3c3-de97-11eb-875b-42010a9c0053", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1625602890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602890, "uuid": "1becf5e4-0362-478a-84c7-43fad44d4841", "comment": "Malware payload (RemoteManipulator)", "value": "82f18d250b9262253e3f358b26d8888b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602890, "uuid": "b3e9087b-80cb-4d3e-aa5e-d32a7398acbd", "comment": "Malware payload (RemoteManipulator)", "value": "5903ca7c770eb447d3d83e9dbc28469b172d74a4e9fb552db6c41db8e96db330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602890, "uuid": "38d4a64b-6945-4b62-86af-fdab0b1e4a40", "comment": "Malware payload (RemoteManipulator)", "value": "94412e471583266dd4b89daea0e2ca4238c0ac95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602890, "uuid": "c1005036-c7d8-45a9-8c20-7d7456801db6", "comment": "Malware payload (RemoteManipulator)", "value": "50f3b8fa13dbeaaf1dc31cb481fbde5d4b0a4c18684454bf8625644e99088a684a76b45f8181707ff78120bdb757b6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602890, "uuid": "8253ba39-6863-47b7-8918-878eaf8c81d4", "value": "4166123FB268753ED4AA0A3245B39310997BBB61A91B8C1E47F0094DDF7A4602F3F615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602890, "uuid": "cb1fb653-01d4-4396-8bc1-3bc5bbb1c445", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602890, "uuid": "66076ae8-2290-4397-b2d4-18af2acd5d43", "value": "196608:JJ6WfqG5ful+sSsVcQcs0bEoYTEUtR1Ra:n62qwomYlcsnXfRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625602890, "uuid": "10a1ffbf-0322-4430-960f-a3fc99ab56cb", "value": 7084707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625602890, "uuid": "35b48946-4f6a-4fb4-9f30-8286266e924b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602890, "uuid": "c908b210-37b8-4806-a142-1c5191f1f8ba", "value": "5903CA7C770EB447D3D83E9DBC28469B172D74A4E9FB5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c3e89b-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614203, "uuid": "c5e2affd-c309-44b8-88da-3071e6928d37", "comment": "Malware payload (Mirai)", "value": "f37391fdd20aad29e2be62dda886313d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614203, "uuid": "daddafb2-4b9e-47e4-a182-b8368ccbb26b", "comment": "Malware payload (Mirai)", "value": "59436c75cb78664059c5e9ce23817dd44a78bf1cb7aa9a75241e585531a38943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614203, "uuid": "a7f0a738-7550-48b8-b7c3-d2195fd50e21", "comment": "Malware payload (Mirai)", "value": "e1961ae8bb9ff584e08d9ce08ce609b2071173f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614203, "uuid": "f9c221f3-a48b-439c-97b9-f1ca3198361d", "comment": "Malware payload (Mirai)", "value": "9d676b0961f672b5a8b230c245de1b80afedd5322f7dc413445dcf467f0a862eb236b08b09681b6d0d2eace48db73ff2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614203, "uuid": "96092936-8e66-4304-95cf-0fa60543eca5", "value": "1E7339C8A593E8F4EC28097C2177BB765EB3F23E7139DC8FD3985463A901B02950629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614203, "uuid": "4b8c9b43-e256-49bd-9df4-b6a7bab29363", "value": "1536:fJHnOAfDBkuTDofY00a1iwlaaJif4glaQjkwlM0mXm6SWgv/QoR+n8q3vBCn:f8A1acQaaJif4glaQjkwlM0mFSWg/VRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614203, "uuid": "da078553-3503-4e90-b862-5149a472e3ed", "value": 74908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614203, "uuid": "b0935175-c683-4013-b21a-2c9973646e4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614203, "uuid": "5cefbe65-e1eb-4671-873b-b507137b5fee", "value": "f37391fdd20aad29e2be62dda886313d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ced548-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614181, "uuid": "c321a2ac-7251-48a2-9fac-54d2afcd83e4", "comment": "Malware payload (Mirai)", "value": "f81301505418687707d2da6603c83e18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614181, "uuid": "3caaccdf-285b-4a19-a875-f3f638762240", "comment": "Malware payload (Mirai)", "value": "595dd8ff2b5767fa3b2d334d710a56d169b307af6620e49f921614ce7f8343f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614181, "uuid": "66cdb967-d862-4220-a00b-38bde52dfc79", "comment": "Malware payload (Mirai)", "value": "885af1f747ddc039d86a8e19db2077c03bdfd5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614181, "uuid": "eaca0b94-1685-43e3-8c20-709e69923e99", "comment": "Malware payload (Mirai)", "value": "d5ef5b299fa20ec37edfabe35cb505dade83a3fff186e7a5b9c7a6d4fb746a912e0f4228d184ac9b693150aaf93d1ada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614181, "uuid": "87c8639c-3be8-42c1-8508-2727741bf816", "value": "E7B3A30A7F320FF7E8AFDC3759A52B0528CD550A25A93B39B930D814F64B61F15E78A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614181, "uuid": "002c27f5-3bd9-47aa-8539-a04462dff47f", "value": "3072:cUZPawdXd8RXa+gzJxRBhttPVBPuLAnDnycYR:cUZPawdXd8RXa+ghrPuLAnDnHYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614181, "uuid": "3862f87e-290c-473b-b3bc-397c1321b4eb", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614181, "uuid": "944294ef-d91d-4a5b-a9a0-bc728aa30e80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614181, "uuid": "d240499e-fe8b-4ad6-87bd-3165d411f51a", "value": "f81301505418687707d2da6603c83e18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c7b466-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625588274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588274, "uuid": "184fa8f4-be2d-4a54-838b-ee377563d4c2", "comment": "Malware payload (SnakeKeylogger)", "value": "536fd4110b39d5986d90d62a90a4c9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588274, "uuid": "b878263e-1607-4b42-80fb-011f909a3e13", "comment": "Malware payload (SnakeKeylogger)", "value": "59b7b6c0abf702ed3af7efb41f41378bf126fc718606ca3ff97db27e31f9b1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588274, "uuid": "47c0e6df-0287-4c06-9caa-66c882c763c3", "comment": "Malware payload (SnakeKeylogger)", "value": "01ebf538e540a47cae8b83a4d91aea67e4ae506c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588274, "uuid": "11a29c70-0715-42f8-ac03-d6e0b76bcaaf", "comment": "Malware payload (SnakeKeylogger)", "value": "8b7b6b13d2212a73fc6890a47ba3b31b90001b7c7fc2b541abceca1556fb0e3f1624474943ade33285958761e4574bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588274, "uuid": "d5397f39-b8c2-4bad-af0a-4980b3929002", "value": "43E46C9C3650B5DFC85BC937CAA92C64EA60B47B830BD303A45322AD9D4E59BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588274, "uuid": "133ed88a-0a94-4b10-83b3-5fd59f6c9418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588274, "uuid": "5c02aef5-8c39-4e65-b1de-d69bb6da31c0", "value": "12288:++5ptvXYTCQHUbs7u1ZCOVN6+TUgcGMNjNmyprkzg6Au1tT6aBCjpDKoNByTK0Ku:+atvaZHU6st6+T8bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588274, "uuid": "9f1905cc-373e-402c-bc88-87b24f15533e", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588274, "uuid": "20e3b8c5-b355-4e3f-92cc-df0e257bdf06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588274, "uuid": "6683749c-cf39-4b49-8c9a-432341dc822e", "value": "536fd4110b39d5986d90d62a90a4c9c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ea5997-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625587084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587084, "uuid": "5e742ea2-593e-4123-a06d-7e7f786ab221", "comment": "Malware payload (AgentTesla)", "value": "a18e6ba058817e1cdcc76f43ed8b87a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587084, "uuid": "f9b06017-6327-49e5-98c1-5c322ad14c0f", "comment": "Malware payload (AgentTesla)", "value": "5af59971935a51d745d4305e4c352f4ef384f3623ad7a7b4473b113a97c1b9ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587084, "uuid": "4e3c3bb3-9b54-4d28-b55b-42e5469a36cd", "comment": "Malware payload (AgentTesla)", "value": "33e0533590f9cf305f2e6215880f95ffbbf042b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587084, "uuid": "d27f3522-16f2-4176-98b3-8d6aec9f3df9", "comment": "Malware payload (AgentTesla)", "value": "5947c369b32ad903a1d0206e7960472552f2548a03a207e1e415a4b2f460fbb88871b452bef670ef84d4b62e52105b5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587084, "uuid": "85209553-29b0-40ec-9750-c3c02bd05e5a", "value": "3DE4021C359822AED033EF3A59E43C95A667B533171B910B309F134A8B1FE42DE61776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587084, "uuid": "934cd81e-6ce1-483e-a750-ee07067f5651", "value": "12288:wNcaHS2+wehDlYJRFpJqA22ptRHPsE6JQConU98siAW+hhf:203DlYJtcA3tRvsEAQgysia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587084, "uuid": "b268ceef-08c8-4633-995a-0f148ed15aa4", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587084, "uuid": "35171a52-66ff-413b-86f1-7254a8588a63", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587084, "uuid": "cfe4dd5d-bd09-4598-b25c-aae4e9c79f83", "value": "Yu-Ting#0120210623.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ac83e5-de25-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625553721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553721, "uuid": "d9f2de58-a6cc-4bf9-9693-b1c5d0cde3c7", "comment": "Malware payload (AgentTesla)", "value": "8a66b9333cbb050f8ed985f4aba9803b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553721, "uuid": "26f70fa2-2787-453a-b837-c0764575ddb6", "comment": "Malware payload (AgentTesla)", "value": "5c60d493bc913c9986a8b7007b138b7bc71b2989e3edd4a30bd3cd27ad64db72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553721, "uuid": "4b7400a7-6dfe-40c7-8b7d-bdc2107c9c80", "comment": "Malware payload (AgentTesla)", "value": "369b1ba4e484caf87b276d8e0d8b4bf4e6a51b0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553721, "uuid": "f29d5534-ef62-4646-be5b-20d5a0498d30", "comment": "Malware payload (AgentTesla)", "value": "aaf6a2cb83e1d78f3d8add50f362bf4a24bbe875f26b7e44819aeeb4c7f0bcf9de2ef2b06ff8bd4ab487d65bc936f6f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553721, "uuid": "ab322ae2-639f-4595-bd96-e254fa3ca3a0", "value": "E1559DB16861465ADC6FCE38C3326D3C0FA77E79FD4FA6356944718B32A76830A22513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553721, "uuid": "ad849d2f-ea23-4c2e-98e9-9e20c0ddb0c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553721, "uuid": "14572a20-1f68-4166-ab62-6cd502405276", "value": "12288:X9WTRG6NsBOOaDaDamY0RUZG8XQ8nhDxxcK+MYNHaBaw:X9n6NhOaDaDamY0RUZG8g8nC5FaBaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553721, "uuid": "06c12d53-ed53-4b71-8727-1b3163cb1918", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553721, "uuid": "65fbb338-a4c1-45c5-95da-8cc3509f7d1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553721, "uuid": "08fa3a60-fb43-4e84-8131-090562cd1c85", "value": "8a66b9333cbb050f8ed985f4aba9803b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfe6846-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1625550753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550753, "uuid": "590d46de-7606-4289-9fa5-536ea7dfb560", "comment": "Malware payload (Neshta)", "value": "2ae3982862f50f65b398da3354dedb62", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550753, "uuid": "f7cbc0af-a7ae-4465-9e42-6dcc86681372", "comment": "Malware payload (Neshta)", "value": "5c83d35525426bb9b84809cbf35e8b34960e32078ed59342483d16f3ecdebc6f", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550753, "uuid": "56cf4c6b-5ab6-4ca4-8cfd-30014a09bd73", "comment": "Malware payload (Neshta)", "value": "f36a73cedf7a248698d425a81f798af0a3005f30", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550753, "uuid": "d03de772-614d-49d6-8a41-52b253a48614", "comment": "Malware payload (Neshta)", "value": "dc50a98d757179330f30fe4e6ee8b18bc2cff05bc633fcb16ab1b730ce9495145020ce3fc53dd9010a412087f30b5f48", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550753, "uuid": "1da2fb98-a7c0-49e0-8782-cc315b7a714e", "value": "38451244DEEE5772F14586F03FB3CCE1908BBE20D101762A635D7E8B49321ECAA2C959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550753, "uuid": "defa59f6-0b47-440d-bcb2-695cc5c103c9", "value": "24576:LbiWy6k9EIVvIpQ8Hso1t7xj6ZZDMQ+c5tsIIibpd:LbiWy9DVvz8x1mZ1sIIapd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550753, "uuid": "cd0e2499-2568-463e-89cd-283b479b8ed6", "value": 1277032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550753, "uuid": "e7fd6f2d-3f08-456d-8908-b152d7ccc51d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550753, "uuid": "a0b2049b-b92f-4460-9472-cbcd30d5ce61", "value": "bn.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b51d7d-de06-11eb-875b-42010a9c0053", "comment": "Malware payload (NetFilter)", "timestamp": 1625540356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540356, "uuid": "b8d6dfa8-b91a-4943-ba1c-50fd63ad8e4e", "comment": "Malware payload (NetFilter)", "value": "c664fc54853d9b50d7e33bad5bd7070e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540356, "uuid": "34a75326-cfae-4b79-b271-a28b4da8956b", "comment": "Malware payload (NetFilter)", "value": "5d0d5373c5e52c4405f4bd963413e6ef3490b7c4c919ec2d4e3fb92e91f397a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540356, "uuid": "804ee408-05c4-45e1-a81a-266e06a2c6cd", "comment": "Malware payload (NetFilter)", "value": "3a49efb4cf120b01479c4dd705d8de403e184488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540356, "uuid": "6074861c-e62f-4991-94f7-3e7340b481b4", "comment": "Malware payload (NetFilter)", "value": "efdf32174bd6ee09b37b3f755b20d6cdb34db850d650b5f5ee5991865396d5319bba9fd33eb690ebed6b69de489fc2fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540356, "uuid": "d94c2b54-770e-4ab0-a5b0-6c4d3b50f0f3", "value": "49237D8565A804E6DAA7E978C2A69617FBF074651311CBDF03B0899A1F333D0FE36B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540356, "uuid": "eedc68f3-6c24-4b92-aa8e-e93fa12df968", "value": "03510bfe4b340aa469668e8cb34e8b86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540356, "uuid": "83826d7e-1834-4c67-9828-9b9d96127ed8", "value": "768:ThgiDwVO2SNulsMie6NPqjSgyAFhF4M6ut+ZX2PEroemfH4bOtOS:lgQwrHiXN2pZxwX2PXeSHuOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625540356, "uuid": "a29f6a81-2797-405a-97e4-7dad0c255876", "value": 48008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625540356, "uuid": "1e70154e-d008-4229-9d34-d38a8a03680e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540356, "uuid": "757bd6de-7ce8-49a4-a11c-f6d67b0dc199", "value": "c664fc54853d9b50d7e33bad5bd7070e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1f09fc-de6b-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625583749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583749, "uuid": "659fb537-3b30-4535-8b02-4ac7cb194e34", "comment": "Malware payload (CobaltStrike)", "value": "d11a6865931c25b2defacd20c4fc526c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583749, "uuid": "52d93c59-4a52-4d77-a3ac-9286ee8c0206", "comment": "Malware payload (CobaltStrike)", "value": "5dff57c390cb00a579eba8bba0295e1eab295a43c6a279f8a3bf469f794bf16d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583749, "uuid": "84563d15-08dd-4de7-a5f7-dfd9b2b5e472", "comment": "Malware payload (CobaltStrike)", "value": "bd2bb2306bf83aa945d8259c975f402e7174cb3c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583749, "uuid": "1a4e2751-4239-4886-8d9f-f01250cc1dd7", "comment": "Malware payload (CobaltStrike)", "value": "80acb74af671463c5b453a34c6ae95df86ddc1b749e1ae2c0b6bb95b23c7d791c5b188993a9f29d0d18919995ff6a32e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583749, "uuid": "b6a41bc4-a6cd-4fd7-ae6d-67b94f050f89", "value": "A824E07543B3D809E4DA6A7DEA620476EE6B35078E23DB10C6A1614C7D8B15FF0F22E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583749, "uuid": "a9723cd8-bba4-4369-b6ea-edfb6833d709", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583749, "uuid": "a1f48917-8087-4f92-ac25-47f7b97bd0c0", "value": "6144:db83JH8NRBP9zmLaHjFdtEBK2FfNZdX0Wz+7DMF:EyPEaHjFd6M25DdX0Wz+EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625583749, "uuid": "3766ac09-8b77-42b0-bf68-a2471fbe89bb", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625583749, "uuid": "d1cc10ed-fe40-47fd-8662-b352bb140b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583749, "uuid": "8e5677a7-7c0a-427b-bf5b-65c10747992e", "value": "d11a6865931c25b2defacd20c4fc526c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcdb9f1-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625587613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587613, "uuid": "11c3a980-ae72-4709-b37f-aae0fe03bfaf", "comment": "Malware payload (RedLineStealer)", "value": "3ccfa398e7c9d36f20d2b4cae02efa41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587613, "uuid": "4162c378-3935-4d99-8ea9-9f52ab02b347", "comment": "Malware payload (RedLineStealer)", "value": "5f4768298abe11e157b351aefba6d97703d055b81b795ba09af21d9d36a2a2ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587613, "uuid": "f862af2b-75ea-445d-98c2-00e458d8ec0d", "comment": "Malware payload (RedLineStealer)", "value": "7457840f0cd83d47c48c0c234c6b4dadc61b65d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587613, "uuid": "20b63484-8d65-4d99-9015-589da43d852e", "comment": "Malware payload (RedLineStealer)", "value": "9777b61f5d1461376b9a36a3f71a50f6616d042c6cbe6f55b581fcc66a4e1eaeff133d6872ec02a538c0866e2beccbe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587613, "uuid": "c7db571c-2d33-410d-85bc-5d1de6ffa647", "value": "B6C39C256DE10775F8F34BFD99AB7149B03022093142FA2EADF02544E9FBED08113ADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587613, "uuid": "d0286ff3-642f-4c73-806a-abe16e55b18c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587613, "uuid": "5becce2c-f284-449f-a15a-b1e5a935eb6d", "value": "3072:DBWKZpZueSAg9PgFkRKBS6Vwg2FsSHSgPkOwzyOUzItFDnleyyBpZo:dWb5xlgkKBPVwg2FNyYkn2Ivl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587613, "uuid": "b5a56867-1c96-46e9-8b20-c177b7ef64c6", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587613, "uuid": "19d9dd95-0d8a-4872-94ff-6b6423ac23ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587613, "uuid": "53ddc40f-a185-4942-8560-50bef50a9b13", "value": "3ccfa398e7c9d36f20d2b4cae02efa41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e1568e-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594262, "uuid": "38c024aa-1705-46bd-a7c1-435d13941511", "comment": "Malware payload (Mirai)", "value": "9021692263134e9e7ce570a4b05648ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594262, "uuid": "4140a525-765b-4ab5-9d2d-9c936ba7db32", "comment": "Malware payload (Mirai)", "value": "609d43cac5a7f45222c622eda2c353336a0a94e8178a0ce35a92c5105db049d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594262, "uuid": "39f09378-a433-48fe-8ba7-156fa0fc4da9", "comment": "Malware payload (Mirai)", "value": "4b8ec873d8eaf18399577fcc38e4704fa3310a0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594262, "uuid": "6b63c03a-f6e3-470a-a9c7-0f72a94ba3b6", "comment": "Malware payload (Mirai)", "value": "95a726b4f943f12fa07ed89cb68abab613899b821d546823757f6c74f659a44d5868186a52fac380c0757cfb8f8a3c5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594262, "uuid": "645a4255-e318-4978-a4a6-67eaaa9ff15f", "value": "88C2E1AC1716D5E9C0A920FE4354273A5E100BA1AE83DC031AE9F6D7DE09CB0B4C7DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594262, "uuid": "52bf2d88-26a0-4ca0-8258-10ad42aac1fd", "value": "768:12G214DFyos0+aOIRRa3bkz2uEAJgGlzDpbuR1Jj:12GdDgosnanRRaAz2uEAVJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594262, "uuid": "049fb68a-781b-4e4c-b197-c5f342defe02", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594262, "uuid": "fa8f97bb-de9c-46ad-a12a-3dc8460a84b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594262, "uuid": "b63d9831-cbe1-41fd-887b-0a586d70692f", "value": "9021692263134e9e7ce570a4b05648ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98a6ec8-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625553514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553514, "uuid": "8b7b0712-8ed7-490b-ac6d-5738891745ec", "comment": "Malware payload (ArkeiStealer)", "value": "ff7e0850779dc6dbc2ed917093287c27", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553514, "uuid": "a36d9e2d-6f96-46db-930a-c2447440d333", "comment": "Malware payload (ArkeiStealer)", "value": "60c47c555c49428dd6623e73049c936e7a42687ce6506ee1e6b614585b52714f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553514, "uuid": "57eace4d-ce8f-485f-a887-e54d974e5357", "comment": "Malware payload (ArkeiStealer)", "value": "cb119f417c9a587f7a27e186866945b41ef83811", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553514, "uuid": "13bc6865-018b-400b-85ff-03503ff51e88", "comment": "Malware payload (ArkeiStealer)", "value": "e3396fe3fdd676870659693e9cac415232ff0e9cc769902aa3adc41bf7b53d4120b274b79edaf9f1859bb1f34dd713c9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553514, "uuid": "d51c73e6-1296-41fe-9e6b-54e2a8d0c709", "value": "0715BD6632A05929D7B34ABF03727163093DAD07A916BCCE34A437CD0E3B256F95AD31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553514, "uuid": "465812c7-d531-437b-8bda-d56d8f5a2f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553514, "uuid": "96423f82-c233-407f-804e-2700c8c2a15b", "value": "12288:V6FoOLh8+/0TxIZUX+qf3v2+nUf8ukQ4aOqP9LGCtsNc/l/PH3HSJ3Ap1C51:VqoOLh8+W+I/28f5goCtsNml/PXHPC51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553514, "uuid": "e29afef4-9471-4f16-8304-f00c2a423c49", "value": 896672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553514, "uuid": "950cdae5-53cb-44e8-88c1-b1640cd8156a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553514, "uuid": "3719583e-f386-4b47-b0a0-7e69e56e12cc", "value": "ff7e0850779dc6dbc2ed917093287c27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c20611-de65-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1625581480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581480, "uuid": "4658115c-9854-4e7a-bddb-0d015e27d6ae", "comment": "Malware payload (TrickBot)", "value": "ba828570c9d9105235cb1352de959d2a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581480, "uuid": "f87a819b-cde5-4c7b-b63e-ae3212deda63", "comment": "Malware payload (TrickBot)", "value": "60c9d6daac4ecd247e62b13d7e4f217f1c72dc120e32a8c9ec058683792ce6c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581480, "uuid": "5a574393-f0f6-4308-9561-167cb99449fe", "comment": "Malware payload (TrickBot)", "value": "e45ad1e213a32871d8ed885f453b39f46edce2af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581480, "uuid": "f6c93fb4-6834-4aff-bdd1-5786831e7602", "comment": "Malware payload (TrickBot)", "value": "fa9127dab216dfa2cd9b9e78b401c289bee3c76f29df38ceac354b8390d2b60e1ed597f66b051a25ba73ef3d5a51e9d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581480, "uuid": "f106cb4d-1a38-4dbd-a422-052205f7786c", "value": "40940A0B525AEABDB90274BA722CC79DD8505EC0AF868EDBF1C2C03A5C2797603D7751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581480, "uuid": "66a4d997-08f0-4dc8-a191-42b98cae100c", "value": "bd51a645a9c68bd03b2e51586e5cbdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581480, "uuid": "0820cfc3-8808-418e-a1f4-04fd4e5c86fc", "value": "12288:FY+b2nX3Y6RRu4mskO55uQGB2IusGpbL40KiUo80U2G4Ny8qbyVqRXLCyug2zdFw:0/nJ7lzK+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625581480, "uuid": "ec225427-64ba-427b-a79e-a182b5e84c22", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625581480, "uuid": "65f65cac-594a-436d-92f0-f6f89754db72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581480, "uuid": "73ba88ed-d5f2-4aa0-be87-375edb777e5b", "value": "60c9d6daac4ecd247e62b13d7e4f217f1c72dc120e32a8c9ec058683792ce6c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa1b960-de4c-11eb-875b-42010a9c0053", "comment": "Malware payload (QuakBot)", "timestamp": 1625570677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570677, "uuid": "1329364f-a0d9-439e-8b41-331650ab1ba8", "comment": "Malware payload (QuakBot)", "value": "1f498b538c41c22731cde9f41cf92b32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570677, "uuid": "f2c5a273-cac6-4477-aae8-8c6206cc0684", "comment": "Malware payload (QuakBot)", "value": "61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570677, "uuid": "0a550e9d-bd52-4ff9-9dc9-de084d35593f", "comment": "Malware payload (QuakBot)", "value": "10c78eba96fd5be058bd179f464e88e1478e6d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570677, "uuid": "b6631599-8a07-422c-acaa-8fbd7289d860", "comment": "Malware payload (QuakBot)", "value": "8c9d6199e90a3930acdbfa3d383af5dd73b5d6e7c6b9bf90675770264baf5be1295c66fedd610a9fee96aacd72d39aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570677, "uuid": "43a72986-1edc-4ca6-8fd0-87a53b57051b", "value": "F5C5E02BB964454FD622CDB2C0F019714A69EFFE4275600B36907987BDFEDD28C9068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570677, "uuid": "24bfff41-8a6e-4b32-98b8-2d3f35d9c62f", "value": "674c401da516961661f00658450e8aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570677, "uuid": "6d5f38e7-e36c-456c-85bd-8a8ca674ffdd", "value": "12288:+huHpD2wwLHqpVxTBfGjuLPvfQAdIiftnI/4n:fpD2wwTefuuLPnz/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625570677, "uuid": "c197b1eb-08d2-4086-9a52-75f791e149d5", "value": 2727952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625570677, "uuid": "a6c22e3f-d87e-4870-8b2a-3b904dfc0b1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570677, "uuid": "97c1a2f8-5cb8-4713-bfa3-408015fbf152", "value": "61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1d9ab4-de6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625585357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585357, "uuid": "9c9cafeb-9d35-45b9-bc32-38d1a4d11f0d", "comment": "Malware payload (Dridex)", "value": "59ec4a5b8f358beacd0b701017ffd1ce", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585357, "uuid": "23bec48a-7dd9-45b9-8945-b6b64973031c", "comment": "Malware payload (Dridex)", "value": "618606a83396138d3e5840cc5bd3f5d8e5c32f2e1401606b80cbbd3b197ef838", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585357, "uuid": "705796ce-5f77-4eb0-a6c4-ebf9fa03c722", "comment": "Malware payload (Dridex)", "value": "bd78cca373c5cc38c5e50bad31a17d7dc20b1c38", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585357, "uuid": "7ca8a8fc-fe24-49c5-a260-a3aa3b0496a8", "comment": "Malware payload (Dridex)", "value": "8824fafb7773052d536d6fd831f0b1264407d3b43cc66695999f5f4a50d0811fb8578d8b8ebfee59726703830fa87f18", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585357, "uuid": "fb550109-85da-4716-a0e4-9eccc5dbf1c0", "value": "0963CE21E384287BF1248478F22A5AE7684A6C7BB400EC1461DB714FB747FB61DB8E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585357, "uuid": "c42b72f7-a7e4-4a55-aa6d-746dfdaf251b", "value": "1536:SkhExmhuX843Rg8mbMH3htg3eLmsqU44444444444Hq/:Skhthy82xmgX3Y4Vsq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585357, "uuid": "15560a7f-7ef0-43d2-880e-3ea4568f824c", "value": 69373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585357, "uuid": "065e3ae7-dd9e-4707-84cf-ffc9eadcecb4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585357, "uuid": "50d39201-1d45-46c1-bfaf-3d70c978719b", "value": "Reciept 918944.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1456ad2-de28-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625555191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555191, "uuid": "941a7970-80c6-4969-b26d-bc4eb42de14a", "comment": "Malware payload (Formbook)", "value": "e091243986719da8beebbabebfe3f68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555191, "uuid": "5494b775-a218-4261-8f13-11690e56f999", "comment": "Malware payload (Formbook)", "value": "62d0708aa5dfd883c7734ea50aadce1b5242f9dc7c6e3514731e90e6545d2910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555191, "uuid": "ff7b246e-2f9b-4d6a-bc86-f0fd1f5adacc", "comment": "Malware payload (Formbook)", "value": "343d56ed9bf6421907a974a13289db476b63216b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555191, "uuid": "ca7b5b78-60dc-4500-87e2-5d46f0c4db25", "comment": "Malware payload (Formbook)", "value": "3172e999551c672db6d90bd1d7841e07f4b940976d75893efcf097e75f1a6a426e3089ae8347d88895e44a25112e26b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555191, "uuid": "59c1e4eb-54b1-4686-8f3f-0702df98ecdf", "value": "51058DBA61764F91EDBFC7380331251C4FADB27ED21BF6B86D98B18801D0F850A96527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555191, "uuid": "c2f195ac-7955-4f35-bb86-0812e81b65e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555191, "uuid": "cc5786b1-57db-4569-9143-0e8b8893fed0", "value": "12288:IDP6NsB/3xcKTZ28emXzA8R6C6qQhOJDnJd8VWU1+QktwlqZjT/jGvH6yZAM:IDP6NU3xcmvH6VOJDnb80UgF6uveHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625555191, "uuid": "028c8bf7-cc55-4f05-8241-a20d775cd3a0", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625555191, "uuid": "9a24c608-7cee-45dd-8710-ed06806d565c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555191, "uuid": "f7b2d3c6-79e3-4787-8770-137a0653ac87", "value": "AFS Co., Ltd..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca40af1b-de31-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625559099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559099, "uuid": "853af47e-e345-47f0-a6a5-fcdc67ccd0c5", "comment": "Malware payload (Gozi)", "value": "c6bfea479b46b9eb7a69667e0165179f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559099, "uuid": "6b32ca77-8070-48b0-87f3-36f909167d0b", "comment": "Malware payload (Gozi)", "value": "62dbfe723197430a3af1ec9262fcd2a5c2bfc8e81b97c313101f0a5388d587fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559099, "uuid": "808c6cbe-d622-439e-8489-302b002ccdca", "comment": "Malware payload (Gozi)", "value": "c7f449ab51a47791a8f3041f0a0dce7c6feb06c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559099, "uuid": "ca9bd96c-ee6a-4715-9dcc-c84098056b29", "comment": "Malware payload (Gozi)", "value": "f35d056c3ea2978ab6a014a653c99a82c506f86eb609e3bf1110dd930776ee11d00fd8f593090a0d1dafaea5d619cdce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559099, "uuid": "5d6c37d5-28e3-4fe5-b432-1e5bf00ff54f", "value": "6F847A00BA80E031D6F212724F29E585536C78A80B715ADFB3D82E5F5F798E36635B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559099, "uuid": "a0eb3b63-531e-4fbf-86b0-6afd5b567976", "value": "4c29865e356872ef0757b58734cbbb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559099, "uuid": "c407b71d-d32a-4a0f-bbae-6eb371491be6", "value": "6144:vC8nRa6tXFOspzA7n6NZVeC8i795fubASK9beZTX3l8Eo:J0SVOsphVWi7PWoBeZTX36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625559099, "uuid": "f9c1ffeb-54ae-425c-ac66-4fc0ec645a32", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625559099, "uuid": "240069be-1e70-4178-bfd9-d26572fd68f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559099, "uuid": "24eda146-1afe-4af8-b253-767ce28194ec", "value": "60e40fb428612.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f994b58f-de78-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1625589672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589672, "uuid": "76dec658-08c3-403c-95bb-b4f0c7b6fcca", "comment": "Malware payload (DiamondFox)", "value": "2f7da8aa79c08b26b9376521f17a8198", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589672, "uuid": "6e9cddda-0d22-4f1f-93f2-9a48947b27bb", "comment": "Malware payload (DiamondFox)", "value": "637d1e6dd62ef51303e06f606edbe979c9c1d42cd580343564427ad49e2592e1", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589672, "uuid": "ced0e661-3074-4794-8b31-687f115e031f", "comment": "Malware payload (DiamondFox)", "value": "5b0b2392c4cffebc7b21a4f43227c32a49cb7169", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589672, "uuid": "2432938d-1e8b-4642-b7ae-e25dff347de3", "comment": "Malware payload (DiamondFox)", "value": "ddc5859d9950e80b1d3bded0d64c6d697052f5543c46b1258352e1f936af84d47e5a736e83386f837ae6ceee7bd182bd", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589672, "uuid": "326caf16-0816-486c-9156-961fe2398042", "value": "2306333137E281F2E1814138C949BBB233B9C7D81BB75AC73B955F0E59AC8A5911B4CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589672, "uuid": "7b908995-31cf-42f0-bec8-6fd5aa02bd33", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589672, "uuid": "1524c75b-600e-4621-9b73-9a666f1ab052", "value": "98304:x/qBjNFXClpnxUxc2Z1Qw1LCe8EmfySCvLUBsKNNFpaPR:xENclpWrZ1V1LXHLUCKvXap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625589672, "uuid": "e960d917-51c7-4ee9-9a90-0076fd3dd2fa", "value": 3872970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625589672, "uuid": "4df3f154-487b-4bcf-99be-5866d87f2867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589672, "uuid": "2cce3259-3a26-4168-b344-0cea9a7a15db", "value": "2F7DA8AA79C08B26B9376521F17A8198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b7d30e-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594010, "uuid": "02a2f024-1b5a-4442-b999-6770572d6912", "comment": "Malware payload (Mirai)", "value": "0ee0dca03b75a10e61829ef2f7c57ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594010, "uuid": "51e4e5fa-e472-4165-8692-745dc1ef48b6", "comment": "Malware payload (Mirai)", "value": "641fcba704ed1d69bb59a640c8a57c53b059bfb60f6a4aedc2c6349f4badd58a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594010, "uuid": "3263a8d0-df32-4f2d-afb6-f2c258b06584", "comment": "Malware payload (Mirai)", "value": "9378abfd014346a40015b3abe4c9d725dfaf4648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594010, "uuid": "2680aced-12d4-412f-ad90-26906372fc2a", "comment": "Malware payload (Mirai)", "value": "08bfc860e5c1ac5bf1da9ef7719358339b04047f132ef0db179c2fd488c7d64ba926562b976271fd90cfdc0262a3a519", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594010, "uuid": "03f249e0-86e9-4c1a-b45a-de6878910c0d", "value": "0D230851FC829A26C6D0237AB67E558E332163D9D2DA7257CD209F107AC661F0CB3F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594010, "uuid": "5fed29e1-87a7-411f-828a-448ef6ca03cc", "value": "768:suueKYlDX7zSxznvVrSIworH2aPTmRi7DA+uQPLEV3U1/C/6BNO1v:ZKuDX2znvVeIwiH2EDbQV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594010, "uuid": "f49769d2-5410-411e-8bfe-bcaa8c650bc4", "value": 47476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594010, "uuid": "0059d8f6-44e8-4397-9650-65fec6349182", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594010, "uuid": "45db3f13-9bb3-47b4-a370-07ab29430f9b", "value": "0ee0dca03b75a10e61829ef2f7c57ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6672fb97-de25-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625553777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553777, "uuid": "8c4e56d0-73ed-4c30-a624-aede3b93ee1f", "comment": "Malware payload (NanoCore)", "value": "7fe6c8e06683b27692abc5afb1a76198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553777, "uuid": "4bb123a1-0bdc-4ba7-b867-0c69c5df8f8f", "comment": "Malware payload (NanoCore)", "value": "647e820900272cc662ccf0ae12baaf80f387b1c4f50c70ab8af390ddd88f235c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553777, "uuid": "bc38b33b-b5e3-45d0-943c-4bd0aaf81dd1", "comment": "Malware payload (NanoCore)", "value": "b354221b16a379bdf713744ea378fd10d9b7c5fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553777, "uuid": "2c59c715-bacd-4857-adcf-2d3a4f6f3b49", "comment": "Malware payload (NanoCore)", "value": "742c4df2899b0df14753f3bfc1c07b1a2eb264a674704eeefffccbbe5e1e0aedfdbca076fca06eb89a0e066274a1b735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553777, "uuid": "1f992373-b2d9-438d-b620-60afb890412a", "value": "34658DB16871466ADC6FCE38C3326D3C0FA77E75F95FA6396884714B31A36930A22513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553777, "uuid": "4e5d7ec1-a712-4b8d-a4d4-fce6fd29d2d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553777, "uuid": "02ed642a-2fd4-46a7-8e31-006535593069", "value": "12288:7gewWJ6NsBga9aNaEsDEt6SNMNKUENwvowY2jXNlUn/hxj90hP09Kv3aQaN:79l6N9a9aNatEABK6voX2jAslaQaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553777, "uuid": "8976bc7a-0c9e-4fb9-973e-e28232e01681", "value": 1415680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553777, "uuid": "5553f50f-e038-4ca0-85ee-f61acae91998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553777, "uuid": "6cca6ff6-5e8e-40c1-b473-6e9545b46f0f", "value": "7fe6c8e06683b27692abc5afb1a76198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b0806a-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625584181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584181, "uuid": "e5b34b19-71f2-452e-92d6-d35240256975", "comment": "Malware payload (Formbook)", "value": "1d86cca5122d168b816f951429ac04f5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584181, "uuid": "5b6643ac-b7e2-4b66-a70b-a1d25e886138", "comment": "Malware payload (Formbook)", "value": "651df35058ee2545227583034d38d0821d14712649f956c4daa21ddef618dd82", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584181, "uuid": "7878bdd0-fc72-4a2e-97bf-b0d1a1964427", "comment": "Malware payload (Formbook)", "value": "05ed38e64d14f21a97ed8c01f69650d124df4cc9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584181, "uuid": "b49e709d-3dec-4d9e-ba5c-b4c7b9d93cb9", "comment": "Malware payload (Formbook)", "value": "355f293e83aa0b235b02c0ebe12a0cdc95157b2ffd90ef3712e66766b50a173264c448eca2f10564a74024eff80908d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584181, "uuid": "b9d3e066-5bed-43aa-93e4-85e5068c7da0", "value": "F84512A74F4EBB66E02688B000AA4F11E32EAF9D6D093020E58F774D75B4634F75B56C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584181, "uuid": "5d4315c1-22fa-4f97-95b4-436f8981f81e", "value": "24576:s5ZTvbUHnYWh0TafLSNBd16WtGoh6ZPZynZOaKMKc3oJGPvjqzrjYgAlItlq+w:s/UHnb3WV1YomPZqkarH3qGPvji0Ii+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584181, "uuid": "80ee08d8-ac86-4fda-8afb-465e023cd930", "value": 1277032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584181, "uuid": "4277ba53-4b89-44ea-93b9-5b32dffcd3a6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584181, "uuid": "9c595a44-733c-46fb-adf8-3717387feb4f", "value": "HSBC REMITTANCE COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfac2288-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625553498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553498, "uuid": "0c9d03ea-a2b4-41d4-b9fc-13a4194adf5b", "comment": "Malware payload (RedLineStealer)", "value": "054edb32a15626e1e1a92ed795ed2363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553498, "uuid": "c2f617f4-3c2b-4fd9-b532-d9ed360b96d8", "comment": "Malware payload (RedLineStealer)", "value": "65f5e70174b24bd7ecb1072e1b7e0f73648c75ddb40ee194210175c2a25f7c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553498, "uuid": "6d5075cb-298a-4d4f-94af-33aca4d4c7b8", "comment": "Malware payload (RedLineStealer)", "value": "3c8bde60fbb879eb5ac4b510264dac576f57204f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553498, "uuid": "012f67ff-a889-439b-bff1-ef9813c02893", "comment": "Malware payload (RedLineStealer)", "value": "5163842f9fad9426ebec653c1ac95fe5e4aee8519a5f7a9bc06e5cbfa5133b1745757f8da56214fc07932a051bc4d178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553498, "uuid": "b15336b0-cf29-4c20-a6ab-18fcfb32411f", "value": "4A54E01036A3C833C45285309968D2B0667ABD726A74D847B7D43FBF5E322C367BA356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553498, "uuid": "86dc1e85-5f13-49ca-9b92-154442cde8be", "value": "c58eb80dd7c7edcf65e9fdd47369dac3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553498, "uuid": "1a3a1e7a-6206-45bc-8833-41b45a6737ff", "value": "6144:RNenbCJTh374Hobx+I0dJzeH+JwQZ9bvd:RNenbCX0HIMIU5eH+eQZtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553498, "uuid": "46649a7e-68aa-43a0-b2d2-6d7e5caaaa39", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553498, "uuid": "b565a5a1-2a1b-4a6a-bd20-f5117d705b5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553498, "uuid": "60038973-6b50-444b-a3e8-8a09743ed16f", "value": "054edb32a15626e1e1a92ed795ed2363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1cdb57-de63-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625580391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580391, "uuid": "1bdf8a1d-779d-4093-90d8-6b6832958fdc", "comment": "Malware payload (IcedID)", "value": "3e2afc66345eddb45171d0b8960a29e0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580391, "uuid": "c48c6a13-2fd7-4031-befc-3af8b9a4f351", "comment": "Malware payload (IcedID)", "value": "662cc3dcd3f62194aceebcc8091e8269550ff52c2d5ac89994138ee8bbee8cf1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580391, "uuid": "abf7e385-7f23-4fac-94f6-da435169ba57", "comment": "Malware payload (IcedID)", "value": "eff1a6354c3be9f1afbda214a264c3c4d207e91f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580391, "uuid": "267b2f39-182b-41cc-8b2e-358a5fac347b", "comment": "Malware payload (IcedID)", "value": "7201d03e017c96a0bdc1a1c241ca56247a33bc051bd7f4cb48fe4a4b8fd4012ae5dec3e770e82937090d70acf90fcd12", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580391, "uuid": "f3fb67b2-9a4a-4c9b-aae8-eb36f9d8060a", "value": "F7040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580391, "uuid": "89e99ee8-c6cb-49a5-ab6f-9866525293f1", "value": "3072:EDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:ORcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625580391, "uuid": "c04e983e-a588-4c60-a5ec-5245a862cb38", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625580391, "uuid": "e9529768-8093-4ea9-b469-d773bda8289f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580391, "uuid": "71a1ff02-cdc6-48b0-99cc-4060913ab620", "value": "Vac.list07-2021-6014910.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f2cfef-de41-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625565667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565667, "uuid": "7b414bb0-faca-42ba-9dcd-168bf4a052f3", "comment": "Malware payload (Formbook)", "value": "38a11d5ba2ed91631d443b0fad223ca2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565667, "uuid": "04e02d8a-bec1-4b26-99df-54693e3ed233", "comment": "Malware payload (Formbook)", "value": "664484dfb0bbbef8bf25f0174447112f7733896f24bde007cbf97ef2e7f3d14a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565667, "uuid": "9f0411dd-c8e9-4c39-9915-45a4fc13b0c6", "comment": "Malware payload (Formbook)", "value": "96a403b07b0839a8ddadb6ec00016c484eb70652", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565667, "uuid": "de7f4bc2-7b2b-4674-b32e-5ac85a8e140e", "comment": "Malware payload (Formbook)", "value": "378c86e365157f024b01f974b37cd9482cfb1756889ccd382751751ac393abce9d5cbb9e095e6fe160d5278c88589a05", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565667, "uuid": "c87e9015-0df6-469d-a95f-c00c81e6ebf6", "value": "5DC423CD6F1AB343EE0B14A5D61A40B887D06D94261D2E27D9EE823EE953D07733609F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565667, "uuid": "99ee7f50-edb9-4672-97c8-088000b122bd", "value": "12288:6H9d7zXoVD3stsqyUUeeGox7eznsVTM8s9H/F:6vzXsD6sIA8nsVT4H/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625565667, "uuid": "9147c322-8857-452c-83f7-4168141e362d", "value": 595783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625565667, "uuid": "4a410f0a-a8ee-4682-8940-16786fab5490", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565667, "uuid": "f4d5178e-ac45-46a6-b214-7a09d450fd59", "value": "Manorama___RFQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4f09f-de32-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625559578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559578, "uuid": "9c0c6564-7834-49a9-84c6-4c90ab7aec46", "comment": "Malware payload (AgentTesla)", "value": "acec60f0953833c375532ca3438a2eb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559578, "uuid": "943514fd-c56d-4b6d-8801-7caa553eab19", "comment": "Malware payload (AgentTesla)", "value": "67a9ed854dd12e71270ebd7bb9da03031b26730b1f33b462732a056025093873", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559578, "uuid": "66b1b78f-ab6d-4813-bff5-1f02cfc91b2d", "comment": "Malware payload (AgentTesla)", "value": "0f7508eea0dbd0631d479e346a6b3a45931785ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559578, "uuid": "ff84b87d-ba73-44c1-8563-ff0edd7836c4", "comment": "Malware payload (AgentTesla)", "value": "6ab4372fe3437fe07a7c52b3c13145a64c37a3f81a8bb6c0050716430d290b4574298c2b4274221b193ca79c7acdc028", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559578, "uuid": "566ae4e8-9ca2-4ad1-87fb-c0cf188a6ee8", "value": "AEF48D9C7650B6DFC85BC937CAA81C64EA6074B7930BD203A05712ADDD4EA9BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559578, "uuid": "b20e4fbc-98f1-4d90-a6ad-b22dc52d1026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559578, "uuid": "5019f94e-9d44-4be8-a718-acee0d9627e7", "value": "12288:uoBDjKfPeJxN7yE50h+Q/AsTeTX4cJWpOefWDeRNhyS5KGBrCqMBpz/MyG/zPwXw:3OneJz1o+Q/AsToX4cJWpRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625559578, "uuid": "794b608a-ce9b-4930-ac7f-18f54727503f", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625559578, "uuid": "7ce365b2-e911-4a15-bea5-e69f1e36d08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559578, "uuid": "23834d5c-0309-4525-a0be-b4c15022d53f", "value": "kopia potwierdzenia transakcji 07.06.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1699a2de-de29-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1625555361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555361, "uuid": "f19aad67-6294-4a25-ad34-c32388c9fe33", "comment": "Malware payload (Heodo)", "value": "32b68872c41087ad35079e2f3d23375b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555361, "uuid": "b30ab598-1410-46a2-bd5b-0d309b185c09", "comment": "Malware payload (Heodo)", "value": "67aaeba9641a61d45661c336d68ab5ddcdc690e96d3ab9659f79276e6f0e7882", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555361, "uuid": "3ac0cc81-e9de-4dc0-b3ce-c3e225f91d7c", "comment": "Malware payload (Heodo)", "value": "c326bd4d285508a6064fec6e81c7ba731c7729b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555361, "uuid": "86e658a6-7c6e-44d4-b08a-4134e94662cc", "comment": "Malware payload (Heodo)", "value": "9465b0beb726bff6fcd0ccf10f4acb18a32598a2061e9fb822926388377046d2ab4e80bda5cb77bce9f0552b243c3ca3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555361, "uuid": "100d2704-53bc-43ad-91a3-0ceafb4875be", "value": "849622C167C10510D80A3EFA182EE53D4B5DAD5A6A23B48CB4D478D17BB66814EE3FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555361, "uuid": "7cbb2b88-5e25-4dda-9a32-a8155bb57c91", "value": "196608:4QByKK5yc1cePyGboQIYIR1frmmiShJTY8WywhGucyMDXTS/iB7Q:4o5K5yc1RPPNIjCUJkjhW5jS/i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625555361, "uuid": "a55ee099-6d61-47c1-b7a6-1835ea0b63e3", "value": 9240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625555361, "uuid": "739c88e4-1038-4ec9-a4a3-43a8afbcb93c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555361, "uuid": "15c27827-e584-4d0e-b9bc-c9fca1bbb9d0", "value": "32b68872c41087ad35079e2f3d23375b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7d3c4c-de4b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625570301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570301, "uuid": "2dadd85c-24fa-4a8f-9141-cdc1a6fe71fe", "comment": "Malware payload (AgentTesla)", "value": "460c7d2a605cce8545b8f16991f078fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570301, "uuid": "38ecaac4-adbc-49e4-9185-8f02818eff1e", "comment": "Malware payload (AgentTesla)", "value": "684694698befc0d91a4f10ec255aa9cd49b6fdccc43999104cbde61c21c99dec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570301, "uuid": "e2abcff5-4382-4a58-9928-29ef9c157ba1", "comment": "Malware payload (AgentTesla)", "value": "1d1cc6d37c032d5312977e6cbb77161d39dc3c9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570301, "uuid": "2145ed05-9fcf-4af8-be89-7d9bce2854f5", "comment": "Malware payload (AgentTesla)", "value": "bc0c061382f198bf42fa6fb5a61deb18f1da60e182238cb9f6f7890bb8d47abb3937480a25028f1206c3b4407a39cc08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570301, "uuid": "b824a8c2-bbaf-4f4c-bd7a-fc449ff813a0", "value": "04F47B9C7290B5DFC85BC936CD943C64EA206867430BDA03A85322AD9D4E59BCF351FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570301, "uuid": "8e669865-eb7f-433d-ab53-c86b9a86d26c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570301, "uuid": "7ccf1070-6372-4522-8da4-4dad3b4ea385", "value": "12288:coE9hzusT8SNCKkRNSkUD/IZU0NpugxM+lDOej0PMcnuaRNEOyj1REY2soR1EOeU:VSTPCVNfm/OU0m+M+JOejcMlUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625570301, "uuid": "7887d9b5-92ca-47f1-aea2-59484cd25d0a", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625570301, "uuid": "6d019fec-b524-41bb-9163-2edb26b19655", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570301, "uuid": "6ed3acfe-72a6-4529-9448-5ce67e4a3393", "value": "PO 000420 MMHE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784eb164-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593751, "uuid": "05966a6a-1d97-4dd9-a833-78fe9ab19bcb", "comment": "Malware payload (Mirai)", "value": "94f782c46b1a3eb1b8d6e7d67615b993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593751, "uuid": "c2220894-8389-4f2b-b9a2-9d182c33000f", "comment": "Malware payload (Mirai)", "value": "68b6473b1ed6985c74581ed368df29dc258df357b59887a356c4b7e38c8f17ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593751, "uuid": "b19d4b69-84f7-4b89-8d94-bac1074bd530", "comment": "Malware payload (Mirai)", "value": "7e76e56e9db0a5bd5c1c1133d59ff3379d97b0d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593751, "uuid": "ffe832f7-0f1e-407c-a11c-8f863a36ad85", "comment": "Malware payload (Mirai)", "value": "34fd366e59a9211d55ef0052cc9e4a2f679804fe9728ba20cc206afe317e4aaf6253ce2c36da7148c6967da42e379073", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593751, "uuid": "5ce30c23-c206-4202-9ac0-0458fd73849a", "value": "0583840E7E218F7CFB9D863887B79E21964833D627A1C585D15CEA011E6034E741FFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593751, "uuid": "af6f6cd6-393f-4db9-9929-80dbad98129e", "value": "1536:BQVXV8BNGZvgI6FSel1DzmhkNWHn7iiBaXdaUPhAjjP2JHLKyA/9Dkd8mg:SVqBEWI2WkNmcPhAjjP2JOy/Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593751, "uuid": "20f51f96-2ec0-48e4-bb44-8fcf964590ae", "value": 84408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593751, "uuid": "3f51033f-6dbb-4a5a-aa33-2f013c48faba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593751, "uuid": "2a6660c6-f207-4a97-a730-786763fec759", "value": "94f782c46b1a3eb1b8d6e7d67615b993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119c632b-de33-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625559648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559648, "uuid": "f73bbc83-3819-4c65-98b1-831aad9c0aea", "comment": "Malware payload (RemcosRAT)", "value": "eae393deff1b049d238e6f4272447b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559648, "uuid": "8dd9d822-3720-4eb6-b997-88753184685c", "comment": "Malware payload (RemcosRAT)", "value": "6a002be77cffaea81dc275fd37fbf52d30b842d464387df1be651053d3727b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559648, "uuid": "def156ec-2422-411d-8851-3fdfef83969b", "comment": "Malware payload (RemcosRAT)", "value": "8efa19c0a8986cbaf1921d0c187b4b96c7ac9090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559648, "uuid": "5942874d-3573-4a29-b067-d05d8d7aee02", "comment": "Malware payload (RemcosRAT)", "value": "0cf5c7a983e5645be300e1b2233943c053fe38793ca15b715bd601e3d49ba8db3cac40d82dfd5015eb19044ff9cfea15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559648, "uuid": "097328db-8766-40f7-9b0b-c89923d85a4f", "value": "4FC48DE2F9E294BBC1622A79FD15D3B8D8523F201D152C4866EEBC4C4F351A27F1648B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559648, "uuid": "7e85db05-8ad6-4143-9568-ee1dc9e96ee1", "value": "70d030a9fd82f51130e72119c5287d7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559648, "uuid": "201efcf1-d087-4173-a019-8d45d9889085", "value": "6144:K+MPBHMMWgb4ZLCwnKqVpAa4wJ04h9eo5ceLqoVNsvhK9STb3jMzqdUFcDVQ:fM5HwNL5FBhUM6vh3TcXcJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625559648, "uuid": "692911ee-ba9a-4744-abdf-1906757e57e5", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625559648, "uuid": "5723c0ae-0f19-46db-986a-11cf48062945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559648, "uuid": "e796b4e5-1d59-43cd-a5ba-94901ca31cef", "value": "EVOREC - PO FH87565635456,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a404ce95-de18-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625548297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548297, "uuid": "2bc72d79-ad3a-470c-83be-67ce9ed07548", "comment": "Malware payload (SnakeKeylogger)", "value": "1e95296d32bdae680afc245dd62a54c0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548297, "uuid": "2f9d0941-57e3-408d-acbc-f74e5d9ed3df", "comment": "Malware payload (SnakeKeylogger)", "value": "6b5ae330c1263b282d032e40602e846e908964c4ccd8605fb8a65971159a51b3", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548297, "uuid": "457bd0d4-0af8-4b6b-bbe1-f5fbc7f45a9d", "comment": "Malware payload (SnakeKeylogger)", "value": "3bcfe8f3d3db82d4a8ad51fbd41e43515e01f917", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548297, "uuid": "1f0a0913-ccb5-468f-a01e-577fd20241b2", "comment": "Malware payload (SnakeKeylogger)", "value": "96e0663df4dfb59b95cac7972a91d2e96af2a1932832e9edc5b2ead11fea1f710d556073bf73cab71652729d2afdfb3c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548297, "uuid": "26932148-66df-43d8-aecf-08c2f9fe24e4", "value": "4BB4236C4C81A466C27DC5813F6A6171785F6E3874FA68778683C03A328F39ED7E9185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548297, "uuid": "882d89f5-b4a5-473d-bb3e-259415204179", "value": "12288:L076s7msTg0jogXIzjRxTDuCdl7+thd0+ecoajwmCpYn4UDcA:LoTm6gyoQIXTCCdl7gdleVcwm5Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548297, "uuid": "31ca996a-c067-4c87-9fe3-be1cb0ea3f74", "value": 529421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548297, "uuid": "a947b250-a763-4f46-be31-31ed6fc20e0e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548297, "uuid": "1881b7ae-0d3a-442c-affa-5b7c4da735d8", "value": "Saudi aramco tender documents-BOQ and ITB.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e30f2d-de38-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625562066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562066, "uuid": "5f315c64-5fc5-4ed1-be8a-f29c4027afa3", "comment": "Malware payload (OskiStealer)", "value": "00001effb01cec7a867b5ccae0325fe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562066, "uuid": "3e94dd78-1083-4314-8184-d659da528978", "comment": "Malware payload (OskiStealer)", "value": "6b95b02847bc1eae8b9b97da0cecb7f85f554314ecbea6affe44319ef1b5206b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562066, "uuid": "9dd7ff7a-83ac-4d9f-ab17-504afd33504a", "comment": "Malware payload (OskiStealer)", "value": "b739d4641afc15cb9b63a39bdc9c3a9b9cd05f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562066, "uuid": "aa3f357a-368d-4aa6-a6c7-618f545b3093", "comment": "Malware payload (OskiStealer)", "value": "f8595b1087bd85854b48c65210b4aeedbb857ac7c328344d68cecb40a711bf6913b6afa5041860258ab0e6e5cafd88f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562066, "uuid": "5d53ad06-79e1-4b73-853c-4dec952088cd", "value": "D8056C7A20768BA2EEBFCB380735555C0FDABE76D10BF53C6948714900F0B5506AB62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562066, "uuid": "3b77e0db-1954-4169-a74b-6a732e465993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562066, "uuid": "b81df34e-7b68-4c5a-a659-65df39b10aa9", "value": "12288:zKP6NsB5DOb4tOmaMrCFdjBoDNV1vUDEFbG4ZUlnwYdzzY0BcEjZjL8DP:zKP6N6DswmnjODNJlknddXBHjBcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562066, "uuid": "3169ae5e-65f1-4f72-9a85-1b47094a5b92", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562066, "uuid": "15919778-0f8c-48d5-b63f-8742828023a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562066, "uuid": "4c0b8fba-49e9-4978-a085-fe2515f6fc22", "value": "00001effb01cec7a867b5ccae0325fe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ec542a-de35-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625560709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560709, "uuid": "9aa0307e-0555-40f9-82df-123d07fc88cb", "comment": "Malware payload (Formbook)", "value": "e52f8fd67c90111f1c472055a460b19c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560709, "uuid": "15f4b88b-0b74-4712-8604-8ebdddfe92fc", "comment": "Malware payload (Formbook)", "value": "6beb1c98dd084d00ddc25288e809c3732fc921544b0ff48eb20a214c0e1e3c3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560709, "uuid": "a867ef7b-3432-4a0b-a71b-27e3fb0aa9d9", "comment": "Malware payload (Formbook)", "value": "278a31fdd5e5ab15ec714f0ed5eab0a03cd72c34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560709, "uuid": "c7e3fd23-505f-4ccb-a937-d1efb4ce029f", "comment": "Malware payload (Formbook)", "value": "55b8080ca5a14d334511f7162babf25ef5239a6604fac552bfc3a4d96157698efdfba1888845f4450e12bd263c59c562", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560709, "uuid": "ad04b27e-0d34-402f-a28a-d10a6709dacb", "value": "FEF47DBA60768FA1EDBFC7380331251C4FA9B37ED21BF6B85D58B19805D0B450B96923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560709, "uuid": "63c0a5aa-3e34-4f12-a048-e575b0210819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560709, "uuid": "833cebc2-c185-40e4-bb00-221afe6fde1f", "value": "12288:FzP6NsBun/A5nuZY7cW9MC59FBHYxQ3RN+HZZrMJwY+RqvuKG6yZAM:FzP6NN/A5nulZ+FBHYxvMxoyuKGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625560709, "uuid": "7fede5a9-3b83-4702-8358-f40a904f007d", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625560709, "uuid": "eee49fd5-d348-4525-b627-acee75685d7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560709, "uuid": "e1a78bc5-d5c8-4f67-b79d-087aaec782a1", "value": "e52f8fd67c90111f1c472055a460b19c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f798547a-de1d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625550585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550585, "uuid": "9feafcd9-9448-4730-bb6d-ce96cf5a0989", "comment": "Malware payload", "value": "1f12983abf957529a5e84e26a8657261", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550585, "uuid": "9a1accef-55f3-418a-86b2-f71806ae0912", "comment": "Malware payload", "value": "6c3f70d8b8289a1ab1a2c43b07c666a31903e17e2eb0632f55d94a81e1d502d8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550585, "uuid": "7aa318a3-4a09-425f-b752-682a07939119", "comment": "Malware payload", "value": "bfdf3757d2e2b20d2a14d10ace4ebd3dd97c13b9", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550585, "uuid": "28d4a2a7-4917-4216-8bb5-ce79bfc76030", "comment": "Malware payload", "value": "46cf1356a7087f7f605b50b89975fbbaf753bd166471c8f7ff141aae38d54b1fc4e447004360548718e07f6ac2ca1331", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550585, "uuid": "2b533aa1-85b5-41f1-b198-b62e73b24d14", "value": "5945122A9449DE4CFCCACDB4361D67AE440BC87774891254D61B32F10B6B3624BEAF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550585, "uuid": "d130d5a6-61a6-4582-b840-2be00f3743f4", "value": "24576:P9awgJYGvVXSSG2KibGkq1kh6ppx4y4yvmr0hy3MExfUAnYYGRI+hd18Lh:P9f3GvViZijq1kc6y40KyqfZ851mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550585, "uuid": "b29a877d-650a-4820-98f2-4caaccc15880", "value": 1238344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550585, "uuid": "4dff7a39-1259-4060-9979-0e0b15eb0024", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550585, "uuid": "16ccd3a7-112b-4e6f-a6c3-f5d0d949d05d", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779ce068-de18-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625548223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548223, "uuid": "5d8ca018-cbbf-417a-a373-d7ba760ab26f", "comment": "Malware payload (AgentTesla)", "value": "25e1c663e03320cd3bacddccc62e162b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548223, "uuid": "aec00e0f-82f9-4bf2-9197-f9458189d2ba", "comment": "Malware payload (AgentTesla)", "value": "6e2334100ce6870c4514641402272be6059ee35f27569796097c7dd0ac612917", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548223, "uuid": "883f09e4-8410-417b-b383-f98131b4e229", "comment": "Malware payload (AgentTesla)", "value": "e8b972aea984d564e5f0f526fdffbafb2108f2f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548223, "uuid": "d564819e-9551-4a80-afd9-b579004feb67", "comment": "Malware payload (AgentTesla)", "value": "10f0781c76a5156d56196e0d5d1106d17e4fb1c912b693047b93626a7268d9e2fccd5313a69af57e2af7214c8736a958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548223, "uuid": "81810a74-0a5a-463c-a2db-ed18a0e4ac49", "value": "5BF4D06815F8999DF5FF0B7ED9A89110CBF4BA52A643F75C2EC010AC1CA3B41CD86267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548223, "uuid": "cc07f458-0c65-4b76-9a1b-ff063319b1cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548223, "uuid": "4e137036-7e3a-4fa5-ba90-219e03c895bb", "value": "12288:snY8Pl/rXY6ynayklIGKkAqxjAOhjEouuOxxGAI1pD/:s/XMaplIGDAqx0OhjXOxIAI7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548223, "uuid": "884fb195-ec24-4311-b897-19f32923eae7", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548223, "uuid": "0ed10acb-690f-4903-a7a6-d2db35f189ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548223, "uuid": "413e307f-b2d1-4561-b429-2498dd0e0ec0", "value": "TT slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d8b5a1-de1c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625549753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549753, "uuid": "9754d02a-4867-4b46-a486-9bd93de20f53", "comment": "Malware payload (NanoCore)", "value": "6fda2ab725080eb308afe72d86053300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549753, "uuid": "065c7d4a-65e0-4949-9d19-567dbeead511", "comment": "Malware payload (NanoCore)", "value": "6e3db0a91b646aa46852f9e9723c0b77d12f387e9f424e986e730d906609d470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549753, "uuid": "5df5e42d-0d60-49a0-921e-11be061489d7", "comment": "Malware payload (NanoCore)", "value": "aa0e350ae9ac06c285f7747417c072527f5e23a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549753, "uuid": "9d4cc701-dcb6-47b3-a563-ee444344d061", "comment": "Malware payload (NanoCore)", "value": "5c4e2ed08ac6804bea881599b211a900b4ca531bbddf0a38ac05d5f839cbb774d2012745459cc86c76f73f1d65bb1b6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549753, "uuid": "958d1358-eb80-4ae6-a125-836d21d81b5c", "value": "9714CF167BB88A2FE2CE8679611212139778C2E3E8C3F3DE58D454B65F267E106071E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549753, "uuid": "bca57bb6-72ab-4332-84aa-b7f253d32622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549753, "uuid": "d5bd62aa-103b-4cc5-a8e6-6f25e74d7b66", "value": "6144:QLV6Bta6dtJmakIM5sj4/6q39JX8y2uq95V4X:QLV6BtpmkE6V995VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549753, "uuid": "4c80ae1d-9f46-4092-9784-48108c03b1d8", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549753, "uuid": "885b47a6-00ee-4602-a7b6-68dcf5256e2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549753, "uuid": "7c4c90f4-ae51-47c8-acdb-31471cda3ebb", "value": "6FDA2AB725080EB308AFE72D86053300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72633dcf-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593741, "uuid": "2e8c7b49-2c3e-4f1f-86b4-70faa183bbf7", "comment": "Malware payload (Mirai)", "value": "c7dc86b30ce3ae3a04b8dedb48fcd4c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593741, "uuid": "663810ca-ce4c-465e-aef6-adb1a5a09306", "comment": "Malware payload (Mirai)", "value": "6e619a359cc8b689448c6b1b7f1e727dc8ac7a270e27bd086e282d595fdce36a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593741, "uuid": "630e1597-f895-4b20-a8e6-98f5937e9cae", "comment": "Malware payload (Mirai)", "value": "d800e72bb93cb682331556edecd585b9b6c788e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593741, "uuid": "deb964b7-e39c-40cb-b237-5ee48b112ca9", "comment": "Malware payload (Mirai)", "value": "244b184e5de78ce91b3bc94e28da0edd8a4a98f52f2fba1f6382592d4ac54bbcfeac7a3eb8327630c5809071d42fe237", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593741, "uuid": "55854a4c-5d74-4fbb-8cd9-a786b78fead1", "value": "2A5339E9F4019E3CFD4BAA7A48164E0AF821739192930F2B63B7FDD36C325A55D06C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593741, "uuid": "5509cde8-5dfa-44bd-a188-7305228179d6", "value": "1536:cLYfI9t2wlt5xhkQ7dJbEUiL9lEE0utKvgT8W:LclZrEUiLv7dKYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593741, "uuid": "13f6ccbd-96e5-49d3-a381-85a56b99c8f9", "value": 65408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593741, "uuid": "031e79cc-9f22-4228-9cd6-dbc5394f0ca4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593741, "uuid": "26d4e26d-5f0f-4d57-8dce-8350140eab4e", "value": "c7dc86b30ce3ae3a04b8dedb48fcd4c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbff4f1-de90-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625599588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599588, "uuid": "5fd3f900-4f47-47c3-828f-a8d46d2e2ebe", "comment": "Malware payload (BitRAT)", "value": "fe1716ac14261bc46aee505acf175f81", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599588, "uuid": "8a4e8159-7e57-4357-b499-a41d6f0b8cc7", "comment": "Malware payload (BitRAT)", "value": "6e730c9ebcefb8b84129a88d5050245653387897500f0c07cfffdcfd2384d92a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599588, "uuid": "426300e6-10df-49c8-87fd-dcf2c92f9a29", "comment": "Malware payload (BitRAT)", "value": "b623278b988718046de4e2b830a82e9d08b99b2b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599588, "uuid": "2dfd6658-f646-49af-bc10-cc7f531f0ce2", "comment": "Malware payload (BitRAT)", "value": "a6a55a415b1dc0c0ceaa1b2cd452ad189a9b2fe5352caec41b1def432931c48be4a18f2372f188f6da2f60964d0cb407", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599588, "uuid": "c3ec8d22-1524-42cc-b7b0-500def08716f", "value": "B3743CBBF5908E74D0AF4CB89F5DD0B51A3BBE898C186DC102713FCE9A7E6014D4568A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599588, "uuid": "b2b2095f-c4d4-473f-869b-cae8ef879e0d", "value": "ceba136373653b95286a4675351b92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599588, "uuid": "0415865d-1819-4493-a2a0-25402d401668", "value": "6144:SuiWeaezmZJE0TCWq971t/ATb3qzjSiuPnBRL0elpbTYwgr3J:Pep6ZnWWq97nITWjSiuPBR5lpbTYwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599588, "uuid": "5ff3fd32-9de1-40b2-87e4-459f77c85ed1", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599588, "uuid": "cf541234-609d-4ca0-864e-6970cdc50c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599588, "uuid": "4ad39e1c-3fa3-4f9d-8342-6abfbd93ab65", "value": "Flwphoptcdyxlxhpejlfjgmsyzqkhoqweu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad04df2-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594023, "uuid": "46085660-f452-47e1-aabc-137983dbf171", "comment": "Malware payload (Mirai)", "value": "5e214be583516df3117e2f686101281d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594023, "uuid": "2566923c-8ed3-4510-aa2e-042bf0798d76", "comment": "Malware payload (Mirai)", "value": "6e76d0beeb2061f293d5bda0e2cf317215ffd6b19ed68de7c3a6f2c83802974e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594023, "uuid": "900eb46f-da08-40fc-b9e0-1ec44dfa8652", "comment": "Malware payload (Mirai)", "value": "e9d3adc70ef82683864e2eff2f88e73a0c54aa87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594023, "uuid": "ab0bb617-39ff-47c9-ac6e-2c05bfd93766", "comment": "Malware payload (Mirai)", "value": "7c62f885de3d1d60f088748641e7026398b58f2e3c4e80b47218da8b5ff4ba4ae89ba3e87bbffccb28a3e3a0cfabd41e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594023, "uuid": "518f3ba7-b029-414d-9f50-ae1e2bfa25c2", "value": "9F839319BF610FF7ECABCC3749A91B4528CD655A22A87B76B930D418B24B20F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594023, "uuid": "af172cfe-1894-40ad-8677-b2fde379be40", "value": "768:k/lRbt/9GxwbqnopKRPRW2I5+uPGJ/gtUTB5sZeTe+beCfbiUpvZ0CkTuXi7syBu:k/t/cxwaoUF4PGJxBsGnb7fuUZZ0Z/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594023, "uuid": "7590ea28-0b21-4979-b6e6-64da1000b275", "value": 88232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594023, "uuid": "87aeee8f-4de7-4ca6-bf6d-9aa16866c0aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594023, "uuid": "5f31a4ad-668d-4d79-adb9-3cc6ba0163e8", "value": "5e214be583516df3117e2f686101281d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94d2ed7-de8c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625598208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598208, "uuid": "36f0fc84-4de9-458d-8554-64766456030f", "comment": "Malware payload (RemcosRAT)", "value": "db6d1eadf3bfc69ac72965056c2c742c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598208, "uuid": "3019cbc6-5333-47fe-85d5-a09e102947e1", "comment": "Malware payload (RemcosRAT)", "value": "6eed5350c18b26f6aadaf28e5ceb48ca742db7fbee28fbe9aa7f3c552651e048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598208, "uuid": "c23f1d67-0c04-43f6-a653-6a8d7e00dd5e", "comment": "Malware payload (RemcosRAT)", "value": "90665623257e1d011c1b8e4875268c04e4e843a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598208, "uuid": "81211cb8-54d0-4ce8-a8a0-f94cc634cc70", "comment": "Malware payload (RemcosRAT)", "value": "0751e98cfe853651c6cd72222f09e6754cdcc2093420f19fda9142b53d3f4037006e3f3a7003d4b218c51b52286f00a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598208, "uuid": "3dcfe53c-aeab-457d-8f5b-c6a52d8d395f", "value": "68B4124760458672D9950DFBA839B3C90EAAFC170722C5E8642F7DF8BC722950BE5383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598208, "uuid": "374cf921-dffc-4cf7-98d3-2006d3cbc301", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598208, "uuid": "b4bda11e-f12d-4db5-a22b-46851f40fc2f", "value": "6144:4YzOX6+Z9dREWqp1e0yq4OOsXsdTRF9TfNOip4hximOtIUzoqh8yNjYDcp1bc/:Pzy9dR0i0yboITRTpOA4h4GUvjScp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598208, "uuid": "b2c80971-c285-4f55-9e7a-b8a6f18857ec", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598208, "uuid": "b3b5aca2-f770-4368-aa62-af1644fd83fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598208, "uuid": "4a05cf51-5e08-43f8-bafa-957f9a51b5e7", "value": "db6d1eadf3bfc69ac72965056c2c742c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edb9d59-de80-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625592929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625592929, "uuid": "74203f6e-5354-4249-ba27-92c969290b12", "comment": "Malware payload (Hancitor)", "value": "cd7e2ac74f739efc610a4f0849d61825", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625592929, "uuid": "bc9d48e0-c48c-4852-b231-001b702cb175", "comment": "Malware payload (Hancitor)", "value": "6fd21392a247d3f5cc83de50e1006010c438b609158ac5e7b6408627fdd4aa0b", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625592929, "uuid": "61bfcb75-aed3-4be1-92a5-5d43c13bb676", "comment": "Malware payload (Hancitor)", "value": "e13d9c0482baa3b7712119de56a40b1dedbb9f28", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625592929, "uuid": "09a612a2-6972-473d-9dfa-8b39f5962046", "comment": "Malware payload (Hancitor)", "value": "4bf98365b5c629e13359703334e9d05636e9c33774af3b8773c7dbe2f9139efb3d90e700a2c0462b12ecaca3ddb19aaf", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625592929, "uuid": "5ec2fb91-f106-431a-93e7-8664c01433ad", "value": "EE15E000B980EA71D5A352764F76E685033CBD214B64CECB339C374E5F3A5E26A357A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625592929, "uuid": "46f2c4ca-28a8-4449-9642-19b6bc0aa580", "value": "24576:7EIZ4wA74D4SQKxZcy8gthDWY+p/mUI+:7+wJD4QZh/qxhmUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625592929, "uuid": "497f054a-f1ca-42f2-b697-79bd6f138b58", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625592929, "uuid": "d44f82ed-6cf4-4948-ba15-01ac7917628c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625592929, "uuid": "6672070e-e2d2-46de-87e2-1411ccc8f6ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1475a1cb-de7c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625591006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591006, "uuid": "c6b64506-0ed0-462d-829b-98eb992edac9", "comment": "Malware payload", "value": "4e7112bb69b572315e3059bd59ac3d50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591006, "uuid": "70baa2f6-3fae-4d09-a72c-702449dcb564", "comment": "Malware payload", "value": "712d7a702a2545d59293719631ef0ab1a6ce9a050f300bcdbe702d202ba14caf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591006, "uuid": "04847aae-aa85-4b65-b47e-89e9bea27600", "comment": "Malware payload", "value": "383acc25c806ee9b2ad2dcc7705c68694735028e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591006, "uuid": "afd3689b-8370-4fc3-b271-791c145c073d", "comment": "Malware payload", "value": "bcc613e3fd25fd31fcc9e8e569d9e677aa3de5b2b424b39b5ffbc9b9443be81b7fdd9a96ed405d5a94d8b0a43a9e8faf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625591006, "uuid": "6d9acc05-bab0-431d-a0ec-c061e2fcb130", "value": "F9641246EF36AD2FCF002EB316DB4B9EAC6D765A41CBF0A4B9C1804F13A11C97E52255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625591006, "uuid": "6ce59364-481f-44d7-8c42-0726154a9e5b", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625591006, "uuid": "791358e8-d6d2-4a74-bedd-93c8d1752d82", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625591006, "uuid": "3b376cbb-0d18-4026-881a-519b80996862", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625591006, "uuid": "494c65a2-d3cc-4c1a-8d35-44102eae4c25", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1c3026-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625586935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586935, "uuid": "842f3893-5cd2-4cb1-9918-9e28df443a05", "comment": "Malware payload (RemcosRAT)", "value": "23ea1c13952f27469f6f27e4367254ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586935, "uuid": "8886272c-6675-4803-9ef3-bbb2dd2a0c7c", "comment": "Malware payload (RemcosRAT)", "value": "71b37b08c29c3da6a2ce10a171c87767ba77dee171d94b48a56e4413e30b2169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586935, "uuid": "000a18f6-bd8b-42d0-80b2-9c3fd04efe66", "comment": "Malware payload (RemcosRAT)", "value": "72bdbcd8778a3c6cba05c5cb8082388264ca02c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586935, "uuid": "7471842e-7baf-4f0c-a73a-1f4b80ff2363", "comment": "Malware payload (RemcosRAT)", "value": "a87edb65b7c3b6fb4891cc640bb1e350f3ae3a68fdfa6d9d8c726e4340af62c5b1056cce48cce652f82763bd90c905fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586935, "uuid": "b5868d08-2a02-4d2b-9332-4548c4e8b7f2", "value": "5EE48C9C7650B1DFC86BC936C9A42C64EA607477930BD303A45322ADDE4EA9BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586935, "uuid": "b0405a26-34ea-4534-acc2-583bd31c8722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586935, "uuid": "c33c7985-b848-4c58-960a-90f7e8081850", "value": "12288:xMZoV4wmfyUp4dd6rYxlNoneq3M8J8z9aJu+/dmcw8wTra+zje+NUbfCTQ6:um1gvrolS9Kau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586935, "uuid": "3b646bb7-6d49-47a6-a4b4-6a6ef500d387", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586935, "uuid": "03bdcbb8-9d2f-4521-a30c-bd4888896bc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586935, "uuid": "2ad697b2-ccd8-4f1b-b00a-9a86fb1c6b02", "value": "23ea1c13952f27469f6f27e4367254ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97ced57-de8d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625598692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598692, "uuid": "40e1feef-5cd9-4d1e-ba0e-7abbf3d85013", "comment": "Malware payload", "value": "135b625746c95837d281a18767310669", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598692, "uuid": "d2d8b76d-716b-4e51-9073-13573513c561", "comment": "Malware payload", "value": "71d43dd5594e4d74bc9c4e79f13089f1f8938831f8155c49025d634cb9ab2423", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598692, "uuid": "cf5409ad-1b31-4ae3-88de-ad60c31bd8f6", "comment": "Malware payload", "value": "29af0a4ccdb02a563da36ec95a4873a95a25daa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625598692, "uuid": "ef14e92d-90fb-4b04-84d4-306e216b838d", "comment": "Malware payload", "value": "19b91b88ca76ba8414a3cec842b8ab990c12eba00f5a807f569bd538bf6fa152ac8c74224905425f8cffb7542268bac7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598692, "uuid": "20782b30-298c-48f6-8631-508b7327daf8", "value": "4074E08675140536CA990EFF8829B3C91F2EED071735D0A8647B3EE9BCB658097E0397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598692, "uuid": "5a820fca-ac91-471e-afc4-cbaa80a14db0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598692, "uuid": "b94043b0-64da-40c6-b098-441873408c9c", "value": "6144:E1269MCctiw7I8/pDvJnpVs0Nxea8NdxWLaY5fP:n6Mtiw73/pDh71uxWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625598692, "uuid": "099b1bae-5bd3-4381-925e-67fe9e917c79", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625598692, "uuid": "7e335d28-b271-44ee-ade1-81ad211d4fcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625598692, "uuid": "a8e722d2-39c4-4502-8a32-d16f5e4dbe8b", "value": "135b625746c95837d281a18767310669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88563ce4-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625586905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586905, "uuid": "197dec9f-ab2e-49f1-82da-3c03a2404f1f", "comment": "Malware payload (AgentTesla)", "value": "53001c5112da0cb57eec1b029ff01759", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586905, "uuid": "2e07251a-a2f7-412f-9ddf-46a7e98e7240", "comment": "Malware payload (AgentTesla)", "value": "725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586905, "uuid": "2dac630b-ada8-4c3c-a029-effe33e865fa", "comment": "Malware payload (AgentTesla)", "value": "839eee20a72b4d48b83366788af8bc6e9b9e8bcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586905, "uuid": "0e8835d9-2a9f-4374-963a-0b82ac2a5682", "comment": "Malware payload (AgentTesla)", "value": "23beaf1feea600ce4d5e9718febab4e61523ce187a6cc505bdc3e5c9e79068793f154c0615bec90967525b1c746ef8e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586905, "uuid": "a93496e2-dd15-4f5b-bb82-bf32963872b0", "value": "9D84ADD8701034CFEC17E0B2AD5E9D6066583AAF831F82076113779D9E8F693DE27866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586905, "uuid": "ee71386b-26f7-47a5-9b14-0118ce99fc00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586905, "uuid": "3e83f7a8-bab1-46d9-983f-9eaecd5452d5", "value": "6144:v57+zH1LRCvlivznmgRUgG4I8XrToTNDGPz12J1hfoYEECKWL1FzYafs5QWjlDEX:B7IrNP9o5CSoYEEC11FRWQWjlDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586905, "uuid": "58a84582-09b0-474b-8f9f-22bd2f3448d3", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586905, "uuid": "3ff5c037-a569-4df3-8a44-7287a7b34728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586905, "uuid": "78513996-d1b1-4230-bb46-469adde94c3b", "value": "53001c5112da0cb57eec1b029ff01759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbb92d7-de65-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625581304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581304, "uuid": "fdef71c2-3aa9-4333-93d9-78f8e9253e02", "comment": "Malware payload (Formbook)", "value": "3569ede0aa89e4e45138327e7fbdc182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581304, "uuid": "3b061484-8d48-40bd-9f68-fe2faf9883bc", "comment": "Malware payload (Formbook)", "value": "72ea41f7ce02b41072d1dce424f9e4a2a7c9e414c1038d26a11f685a3371473e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581304, "uuid": "60735d62-a65d-4e3a-8246-79bde15496dd", "comment": "Malware payload (Formbook)", "value": "c70ae89d262a8d56982d9a2035ae526f3092148d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581304, "uuid": "54220075-a668-4d02-a42a-9f5a566be78b", "comment": "Malware payload (Formbook)", "value": "d0255bc5875be2f796c8a1e9e26dd9365893cae54baec9fc1a482f40f37fb0fa209ddbc4f014b85d277b14493675cfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581304, "uuid": "f3a00214-008b-401d-88a9-f142c1f5f1a9", "value": "E4659D3576729F95DC7FC7384731E13C4FB9AE66E217E6B46CD8388A24B0B410A16623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581304, "uuid": "5efb95df-a700-4522-bf7e-405492e19541", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581304, "uuid": "5e3f3913-47b8-405b-876b-f4137d5aec16", "value": "12288:1ob5aIMVjLz7T6IiOcej3gVZsZZZsZoReMHakDjBW8BBJOsUwv+uEPzxvaM/HgOg:piOtReMHl3zJTUkBM/A9HVWVaPTnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625581304, "uuid": "30cba80f-fb20-4c17-a8b4-84ee5e3da9d3", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625581304, "uuid": "873ec5d2-489f-4d39-89a7-07431a62199b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581304, "uuid": "92a35bcd-7c30-46ae-9837-bee35a441528", "value": "Enquiry#List For Order070621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d363e6ba-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614519, "uuid": "bf9fe420-9183-43e5-81e0-ea742f84268c", "comment": "Malware payload (Mirai)", "value": "1ef633f6e2aaa7d7f50a43c5f3933b24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614519, "uuid": "74a27d1f-3a34-46be-81bc-2b314f97dba8", "comment": "Malware payload (Mirai)", "value": "73da8d028cc4596da748665c3d3033a54c98720ffc0a70f70f71043efdf3d217", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614519, "uuid": "cb0b5bff-8d4a-45d8-aab0-80a62c44e853", "comment": "Malware payload (Mirai)", "value": "faf356ae3f08724bd2dfdcfd585b2332b767aa44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614519, "uuid": "23a2b0bc-921b-41b5-b06e-136318464e83", "comment": "Malware payload (Mirai)", "value": "174534fc547710ffe0b3dfa60da7400f3fbc56763e318ebb756e04ab8aed417d20fae83e6c7d523a8c530c6e9e6b26b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614519, "uuid": "84f26818-887f-46e9-8dfb-fbaa0cd9aecc", "value": "A2739E65C028DDA8C66446B8F55988364B13A00986733DF7DB8287E640BBEFCF5097F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614519, "uuid": "3b5f9fba-38f6-4bce-bcc2-99ac05baac1b", "value": "1536:c/kl+iKJpai777UGfyvLFBemgeisYLY24Rfs3HL4oFanhCjCji:c8lwr1yvLPemgJLY2+f+rzanh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614519, "uuid": "952cb892-4d57-4a64-a4ff-0f124d767fea", "value": 75608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614519, "uuid": "d0b60d7e-e3a5-44aa-a001-0c861acfddd9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614519, "uuid": "db7320f8-7bc2-40fc-9a5f-da8e6d8a53c4", "value": "1ef633f6e2aaa7d7f50a43c5f3933b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a5a664-ddee-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625530127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625530127, "uuid": "5a500c3a-c2a0-4b92-b285-482ebee82c64", "comment": "Malware payload", "value": "bf32d6d01a0dd6802045e154b481175e", "object_relation": "md5", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625530127, "uuid": "ca0d296d-b324-42b2-8f02-9c09dbede894", "comment": "Malware payload", "value": "7695a56e0540a2600d9882cf9e504c1b25cadb2368bee8789afa53b5c4e74809", "object_relation": "sha256", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625530127, "uuid": "7545c66e-5040-44c0-a8a7-bfde32dea83c", "comment": "Malware payload", "value": "c48118654aeacc8a1067e86c2b670b91c15fe724", "object_relation": "sha1", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625530127, "uuid": "06267c86-6927-4794-9852-dfc3be344e81", "comment": "Malware payload", "value": "ff7f2a3739cce7cf143bc051cc82d2350ed3d911c321702ea3f495a49029276b3aa199f18818f37f050eb62391070ef6", "object_relation": "sha3-384", "Tag": [ { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625530127, "uuid": "b29f20b2-f0c3-4f2a-8693-6d00395bace1", "value": "F17533ADA54F4F436EE8E93F0BD4549909E80426B051150E7A729BF3AB07C273B61F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625530127, "uuid": "80d35bdf-611d-4cfd-aa55-55c2e90eac7b", "value": "49152:z3jc9x0CtdVaPqKo8alWs3nz/OwcsskDRAtioLFg:z3oPdlaq98Zk2/kDRALFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625530127, "uuid": "bf1546e0-6289-4cf6-b87b-0578063a36e2", "value": 1616577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625530127, "uuid": "1afbb010-5a67-436f-b081-ce16aa47bb1b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625530127, "uuid": "d26863e0-b752-4685-8719-4cd68f1f29fe", "value": "mod.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becb7ceb-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625552637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552637, "uuid": "cd6b5fd1-04c8-48de-a61d-471e1efb5268", "comment": "Malware payload (SystemBC)", "value": "825a13bbff9b5cc4d1f19d896aa31c64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552637, "uuid": "5d450be7-f522-4fcc-9f6c-654ef6251f71", "comment": "Malware payload (SystemBC)", "value": "78047ece6080c704f47d91545e8cce53095342a4595b9e20ee5efeba4c679e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552637, "uuid": "5d97194c-e02e-451a-be55-339e4369c484", "comment": "Malware payload (SystemBC)", "value": "a2026995b7871f84fbdd86f2596d51ce4f05f8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552637, "uuid": "ab66e891-b478-41b4-b474-67845dd86fb3", "comment": "Malware payload (SystemBC)", "value": "6d59920963c47798d0454301f6be8e1311a8210841d54ff5308e6e17e390f19bff81f4a4bac0dff3cbb3aec69391a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552637, "uuid": "47cc8554-1cb7-4546-ab4c-695b32c3eed3", "value": "92058C22F2914837C573363D9C1BA758A83ABF112B3CA8866FF51D485F3A6813D35297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552637, "uuid": "2dcd89d3-2d6a-4561-845f-61bdf758fc9e", "value": "41e286bd81e15d36bb9bceeebfe46ffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552637, "uuid": "6819fdd9-7472-4253-a58d-7054c546c15c", "value": "12288:mGpmnrfAsq3NCRRi57t197JQdQ97co9JWPXa+LD9HyrUG8CD8A:myarofgRin1PQGdCPXa+LD4UG8AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552637, "uuid": "b783296c-2eee-47ea-8f9c-dac600f5fdd9", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552637, "uuid": "d71f3733-46ff-4590-9df2-d7f765df4128", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552637, "uuid": "3223c15f-c6d8-49e5-9647-709df9a28e56", "value": "825a13bbff9b5cc4d1f19d896aa31c64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814b49f3-de71-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625586464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586464, "uuid": "b63a2992-c973-4ef9-a325-78e0ab0eb121", "comment": "Malware payload", "value": "ad124894b2f35645cc2ff02d58626964", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586464, "uuid": "e552b3c2-aa83-4ed0-b7a8-a8ccae62a963", "comment": "Malware payload", "value": "79fc92cfced8506495957204db2ce4a5fd083481685cb864efa201f7d5fc3464", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586464, "uuid": "af38f8e0-4d44-4e9a-943c-392025375634", "comment": "Malware payload", "value": "3051238eea5b119c139fa49c9aec55a077a33713", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586464, "uuid": "81859dbd-625a-4a6c-97f5-ac5b0cd53edd", "comment": "Malware payload", "value": "4d5c459a79ef3bbce9cbe07ccae96c61ce7add0fb193a265268561b477987bb128d73b6b14bdfe3ad1ad22333ece5d3a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586464, "uuid": "8fb46ec2-b9f1-45fe-9b75-b95ad27301bf", "value": "B884459411CB82B2E6885E4D35C0B1895A35FE9630CACC2A63AECA71DF557F62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586464, "uuid": "95e1b556-1976-43dc-a9c6-de90ff7522cb", "value": "3072:9rBrB2BrBjhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHQhNmfhi4txeHry1oziLmNmT:bVcVj+hldzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586464, "uuid": "ab3bd4c5-1ee7-48e3-be49-c9ce22fb3c05", "value": 377263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586464, "uuid": "0fdedd99-9189-4f06-9700-7dac5df74293", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586464, "uuid": "3ee9f56a-c3f1-4c21-8f6e-efc798f71519", "value": "0002788.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5725eb-de00-11eb-875b-42010a9c0053", "comment": "Malware payload (PredatorTheThief)", "timestamp": 1625537820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625537820, "uuid": "9267bf1d-8e94-4738-abe8-23620d0cbffc", "comment": "Malware payload (PredatorTheThief)", "value": "d6ba86e1ad45396ed8982ba957c98744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorTheThief", "colour": "#D47396", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625537820, "uuid": "19827e3c-0291-48b3-ac83-a7250c56fce2", "comment": "Malware payload (PredatorTheThief)", "value": "7a0831666570daf4e684efb6330ad50b6b792d6515d2cbe2976b39a568fed340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorTheThief", "colour": "#D47396", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625537820, "uuid": "a024d925-e1e6-460a-9e25-4465ce18cc29", "comment": "Malware payload (PredatorTheThief)", "value": "0325527f68d157f235d3219e9e64e5c5bddb1c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorTheThief", "colour": "#D47396", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625537820, "uuid": "788d1793-b42a-4e5e-bae9-5586fe1e3da5", "comment": "Malware payload (PredatorTheThief)", "value": "2a66d8bae04ad77800bc852e0a8208d401666e109a3d7c23efd7ad5d9e62af23be1d6e0307e292a6fc05a462aed519bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorTheThief", "colour": "#D47396", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625537820, "uuid": "1372388b-df25-447f-add5-7c9781581f78", "value": "85E412123C90D072E473A4301857D1AD293ABDA1D6A95E87B78C3FBA6F312C26B75346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625537820, "uuid": "5c4a9093-83a5-4ef1-8621-21496975fc21", "value": "003506e6827227a38566737581b07dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625537820, "uuid": "ac4ffaf0-6246-456b-923c-3c53b59a96be", "value": "12288:y35crvQLUvz4+JV07bce8zhsklqphitBRoV0O2s4rGJyA:45crvu44+s7Ae8zyLphkByV0Q4iJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625537820, "uuid": "70835ed9-b53b-4713-b31e-8960227a08de", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625537820, "uuid": "eaa81fad-07b3-4850-b2b7-288fafd8c0d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625537820, "uuid": "1586a855-f9fd-4b20-8890-710224b7a351", "value": "7a0831666570daf4e684efb6330ad50b6b792d6515d2cbe2976b39a568fed340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf165d19-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625549658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549658, "uuid": "71e8ec7f-c3c2-4a94-a399-2ee81e49af1f", "comment": "Malware payload (SnakeKeylogger)", "value": "c18351e4dd289982f99e54f21e46b74f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549658, "uuid": "5240e8dc-cf38-4878-94c3-644883f45060", "comment": "Malware payload (SnakeKeylogger)", "value": "7a1134e1803e5a226110d7c7706a164cce25a2ed23e872cc47a0879b22487e8d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549658, "uuid": "df660a0e-3888-40ed-a8ba-c3e69dca3f65", "comment": "Malware payload (SnakeKeylogger)", "value": "1dcaa32866a47dc57c0f1801a12778766e1bd853", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549658, "uuid": "75bfe91d-1159-4a75-9589-1b332a58bba5", "comment": "Malware payload (SnakeKeylogger)", "value": "8c032dccf02a1f0f60f26947a686f5919946dd949fc60e2cc06380c8092f8415e8e46e3694808f35054123d15fe6f2d2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549658, "uuid": "85a74f92-612a-43ae-8d44-99768330a2a1", "value": "D2A42371BE544F176536F946D0080B7C6B68B82F7E36688837B1A3BD200F4BE6950F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549658, "uuid": "437686ec-9b63-40a0-a1aa-cce5b716fedb", "value": "12288:Ac/4YF9DewhXpd7uBekGxBEFpljAICg+jAdQLKfj4WyJtLgVZ:Ay4Y7eWXp5ONGzETljAI+AqLK7fbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549658, "uuid": "3e4be42a-8dd8-4201-9e0e-e322320877de", "value": 481044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549658, "uuid": "761bdf07-d2c8-4a06-bed9-e1d4245428a9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549658, "uuid": "eacbf677-4613-4589-bede-36c2484645dd", "value": "specifications and drawings.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995b439c-ddfa-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625535394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535394, "uuid": "f09b0c4d-7e15-4621-95ec-8d8487da1c18", "comment": "Malware payload (RedLineStealer)", "value": "5574293bc53a6d755fb587f4df812d99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535394, "uuid": "12f41a2b-a36a-436d-907d-b578caaa03ae", "comment": "Malware payload (RedLineStealer)", "value": "7ae4b1290aa4d0f4f7985604c7ab31f82ee88f15e1a94042723ecc45f141da46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535394, "uuid": "d2a57478-3be2-46aa-bb31-47cf00cb88f5", "comment": "Malware payload (RedLineStealer)", "value": "b75d7cba57a27a43db7085fc3f84d1a3038b0c10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535394, "uuid": "4ac54977-a8a7-4c44-a3f2-043cc4b7e02c", "comment": "Malware payload (RedLineStealer)", "value": "636df2ec52431c80cbe916fb15846ab0690b2412cf1158e23a95bbc4acd9ff5cabfe846c793c45de6e6dc38b755167da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535394, "uuid": "9d4d7fa9-4e4d-45ab-9bb1-94a99ce1fc6a", "value": "E284372864BFC01985E3EEA12EDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535394, "uuid": "e4452ab7-1cf5-496b-b73c-7c3b9dad4d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535394, "uuid": "984d361b-2ecc-4334-ab28-600fb7223f6a", "value": "6144:tG5Yqofb/kbre1LhHFRwpWBBBBBBBVBBBBBBBBBBBiBBBBBBBBBBBBCDLlb6Tb/J:Q5Y3fb/kbC1LhHFRwpWBBBBBBBVBBBB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625535394, "uuid": "69f712f2-d0cf-4aae-b497-05075a1daa45", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625535394, "uuid": "9dbbcaf6-5e62-4193-8041-70f2ba7ce9ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535394, "uuid": "bd3c2cd1-c963-4019-8126-986a6dc28644", "value": "5574293bc53a6d755fb587f4df812d99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e1d8f9-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614208, "uuid": "ec047df7-a6bb-43af-8ab3-89972a023157", "comment": "Malware payload (Mirai)", "value": "bb83a984f15050c84297b3080ba89ac2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614208, "uuid": "8b0a044b-feb7-4a6d-ba46-eb5021dc97d8", "comment": "Malware payload (Mirai)", "value": "7b65c7fd5477e7c257b92e125a592f03fc6f5217b0281fc17f0f79606ecfd44d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614208, "uuid": "96ab6646-ad35-4908-89cf-503f485a23fa", "comment": "Malware payload (Mirai)", "value": "21e58d431abdcd2bda532cd984b552f8920cc403", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614208, "uuid": "8fdc7a83-f02d-4cc3-ae51-ab41ede1240d", "comment": "Malware payload (Mirai)", "value": "592e52cba90760f4bfa84163eadae669f006647713bd37aa4f077c997350865fdfe098db8b25f04e8f1f396af0f80ae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614208, "uuid": "fc03329a-6fdb-4b06-af3f-850c0b803cb5", "value": "87931981B8819E15C6D417BBFA6F008E331257A8E2DEB213CD145F6477CA81F0E7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614208, "uuid": "771b917e-fe58-4b56-b585-e309a4643350", "value": "1536:ZRnvd+2HmdNB8go9+vmYDIyYzcnWuySPI9mrsplDKZUoQBKXAVan2X+F8Jyv31s+:Pd+L8p9gmuIPzuWXSg9mrsplDKZUoQBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614208, "uuid": "9b63e453-faf6-4b15-beab-020637a6b494", "value": 92700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614208, "uuid": "94885e28-3341-4d5f-990b-362f260c196b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614208, "uuid": "ff12ba17-f519-4ebd-aa06-e0eb434e027e", "value": "bb83a984f15050c84297b3080ba89ac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba28a61d-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625556065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556065, "uuid": "c54de31a-9f1a-49d3-a906-e5fd03df2c30", "comment": "Malware payload (AgentTesla)", "value": "53b057776158aa0ef5625f7dc4f6aaa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556065, "uuid": "af64577f-8991-45e1-8bc5-b589933b5f10", "comment": "Malware payload (AgentTesla)", "value": "7c7323889466fa08d4a797ccdc8403e10953dae98d1f413bf39d82d7d9f89e5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556065, "uuid": "abe42350-8454-4662-a03b-99671b257cff", "comment": "Malware payload (AgentTesla)", "value": "f99dbd70378e6fb72c02e40ad1cad973619c9b25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556065, "uuid": "d8327162-8a03-4dd0-909a-629f2ec59a25", "comment": "Malware payload (AgentTesla)", "value": "254872c04808220f177d579f829fbc6d7a4df3dee315ec9ef755427fe566f749bebb87fc81a918c52378c9e6b0dc7af9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556065, "uuid": "48f675b3-7341-499e-9299-4437e0db1f87", "value": "58F47CBA60764B91EDBFC73C0331251C0FA9B37ED25BF6B85D94B58801D0B854AE2927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556065, "uuid": "aed5d964-29f4-4d4b-a8b5-6a1203b6dec6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556065, "uuid": "14bb268d-f0e1-4f8f-8826-3adc3f03889f", "value": "12288:WPknP6NsBruQXno3OP9Ub7GKFLHRSymOvEsZwye6b6yZAM:W8nP6NEuwo3VnvFL9E6wmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556065, "uuid": "3ce49684-9d85-4aad-9e80-9fbceea681b3", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556065, "uuid": "b18e78fc-8dc5-44fd-8beb-e99018e8ebc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556065, "uuid": "d8330dbe-8942-40d9-ac07-f6ebdf69c98e", "value": "53b057776158aa0ef5625f7dc4f6aaa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30df848-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625586628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586628, "uuid": "c2ccbc90-96f7-4d77-aabc-c0ee15167701", "comment": "Malware payload (Dridex)", "value": "c2b80fa119a1f182a24569df973f6b44", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586628, "uuid": "47729c39-edff-4eea-81b1-2c9780c2e5b5", "comment": "Malware payload (Dridex)", "value": "7c80c1cbca689063977ae3ea76bf38553e02819ecb28b48ec2b1c7d4633e6052", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586628, "uuid": "aff8f0d1-3e43-4ac6-b454-5f98defefaac", "comment": "Malware payload (Dridex)", "value": "68fd23b3b2acb7969ad4958a0eae8408b0c6aedc", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586628, "uuid": "e50447d9-bd6e-411d-970c-2544dccf38f3", "comment": "Malware payload (Dridex)", "value": "f5154cdf03fccd6428736aafa225dd443e3d1bf298886bbb18a84a9a41ec72e5176e57629cc35b03092bfbe9bbc3d68b", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586628, "uuid": "7f9731df-797d-4e0d-a6c2-7f7cdda2a490", "value": "1D04E140D3CF2884F9971238AB9564299D2C39A7EEFEC979C6D4DB4DCDB35A080AD1D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586628, "uuid": "b04fade6-3286-4966-a459-8b40fab76074", "value": "f978d36888801e6e304b48aa9b0d79ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586628, "uuid": "843ac029-d0ab-495b-886d-132c50436440", "value": "3072:3JWgjeWy6Qn2EjqWHBFtvLSmZIMr1ckoXYZK1+5RUQ3cg5NwrSl+2wxvvVDqwl+a:30gdy6I29sSqD15oXYZTBMYwrSl+2wxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586628, "uuid": "6e76271b-3f4f-4312-bae2-49af88476aa2", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586628, "uuid": "68332d11-3d5a-4658-90d4-86155aac6a92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586628, "uuid": "6f83fa15-9ab9-407a-916a-a86405284eae", "value": "flnam.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d1212f-de88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625596491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596491, "uuid": "114c738e-102f-4ab8-a13b-06e71e8dbb66", "comment": "Malware payload", "value": "a6b2e3c82d54e9f70561edfc55a035f3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596491, "uuid": "9dad6660-a488-400b-9284-6ae49d67e13a", "comment": "Malware payload", "value": "7d35d2dc34fb22505657c228734d574a07c2bc3e2ba9812f23638cfffe799e75", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596491, "uuid": "68f46ec4-56c1-42a5-be6b-902ae24b04d1", "comment": "Malware payload", "value": "72aa1ab3c9ffb5930701b55dfa248e33c17cd7a3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596491, "uuid": "4f93272e-0f0f-4fb6-baf0-ab8c6e74d776", "comment": "Malware payload", "value": "315abface7e5b9f3e9e1ab71be5cd7da49f4b8234f641c41947cd19fe1e99a4cadb58be600f56ad2353b4a0e501cfb53", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596491, "uuid": "a02bb1fe-5d82-4e57-8fa7-8f294ea47e5d", "value": "DE84459411CB82B2E6885E4D35C0B1895A35FE9630CACC2A63AECA71DF557F62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596491, "uuid": "82604a1d-7c68-48ec-9140-28db527669f0", "value": "3072:9rBrB2BrBjhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHFhNmfhi4txeHry1oziLmNmT:bVcVjPhldzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625596491, "uuid": "36c52d32-2695-4b64-b872-623d999cf3e5", "value": 377263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625596491, "uuid": "c1fff1da-6070-4f76-89de-220dd2568260", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596491, "uuid": "3be764da-59d8-4ce0-953e-66e0951bff8e", "value": "invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b226ff46-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599431, "uuid": "d6a2a0aa-0713-4e60-802e-f2466b24b9cf", "comment": "Malware payload (Mirai)", "value": "09a5059472cdf04922aa4986839f4227", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599431, "uuid": "4f3404ba-48aa-455d-9698-47d16f9f157e", "comment": "Malware payload (Mirai)", "value": "7ee42782dd0a1358720e4ae9bf2941a3188e8c173d17fe59a2ba6042206ba038", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599431, "uuid": "d4d68538-e700-4fdb-9bf6-1d764f48e171", "comment": "Malware payload (Mirai)", "value": "79a5fbe0541534de5dc2ac872e68ae3aed793757", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599431, "uuid": "48d0f25a-1326-444a-9326-ee0aec1450b6", "comment": "Malware payload (Mirai)", "value": "3774899b22d071683cfc566c0ae639afb7dad00450a60c7217aaaf8e5842e0df478ded73582a2e7f5dc9d82682681956", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599431, "uuid": "3f21da49-3366-40ea-9886-5350bef845ce", "value": "ECD2E132928E3F60D2A4D437531A838777DB6FB954AF12A3E8501F26FA8251B0D73356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599431, "uuid": "9cae136e-7c64-4138-a6e0-259eeb8679f9", "value": "768:6wEDtNk0Ia0r/4EBClgNr5aOEbSSfChBmWKLs3UozJ:W6e0r/VCsr5abPzSzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599431, "uuid": "7b965661-5ed9-425b-9e33-13d51e120cba", "value": 29540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599431, "uuid": "789f6b74-9cf7-40dd-b954-422ca8781d7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599431, "uuid": "900d9f48-aac8-4e26-bdf2-16ffc349e7b7", "value": "09a5059472cdf04922aa4986839f4227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d14705f-deb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625614186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614186, "uuid": "4152762f-d6db-42d4-a597-8f4d38f1c9d3", "comment": "Malware payload (Mirai)", "value": "83fd60abc2eebd28e3f530571cb6de01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614186, "uuid": "01c7e168-7e7b-4482-a04f-2636297ebc12", "comment": "Malware payload (Mirai)", "value": "8047090e6daa2328ad5344e3ef04ab78b76350f03ab224f25e7b9a484b5df498", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614186, "uuid": "dc3a3a45-974a-4d43-bcf5-fb136e31ce1a", "comment": "Malware payload (Mirai)", "value": "ae46a7f29760c03e4e8150cf23752a331dc3de8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614186, "uuid": "c197dda0-9b7c-4623-bec7-c8ad5391b7f4", "comment": "Malware payload (Mirai)", "value": "23b48e2458e46b5da10be2c3c7fefe3e35881c37fcf0e5e147d07026a7c5742861a13b1fe59de4305171e7219427be54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614186, "uuid": "dd05242b-bb88-4260-8dfe-cb95137000de", "value": "BD531A8D18421E2CEAC6ACBD58354F0FDD94231091970B1BA2AFFDC33EB3269EE15955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614186, "uuid": "fcf4edbc-a608-4303-9ff2-74540c4663e8", "value": "768:LBoRJ8ngu7alopBabepHMp2ZBVZ//vcrVEJ7W4wdM870Ruz+f1pr4hPnpsIQel8i:NoRIT76opBabMtzT270Rwg1pEhPpsTCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614186, "uuid": "75ff5ff6-9bcc-4455-9f7a-3656b3d8820a", "value": 64884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614186, "uuid": "4abbd8c1-90cb-4e2d-b16b-6c4b402c4075", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614186, "uuid": "d3c6e5fe-89a2-479b-a21a-c7118ff043bb", "value": "83fd60abc2eebd28e3f530571cb6de01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8ba24d-de20-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1625551695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551695, "uuid": "18605ecc-9cea-4a4a-ac03-275fa4c5a9f2", "comment": "Malware payload (TrickBot)", "value": "bd2d5129f9d0e0d3d987adcfe1ca0e9c", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551695, "uuid": "4513cb70-2d85-45cf-9586-995d14244332", "comment": "Malware payload (TrickBot)", "value": "8203d7f821b46260d541ebac2ff8d05be1052e86d500ecddb0010f855943e179", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551695, "uuid": "95ccad3e-acc1-4290-9006-e6d7688cb81a", "comment": "Malware payload (TrickBot)", "value": "133025553eed6bb342131e029e9b4dc53f0db004", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551695, "uuid": "8832b196-c6ce-458e-86bf-c6014a89c8a4", "comment": "Malware payload (TrickBot)", "value": "9c0b6aa261be2f2da38e665e57fd3661599b55059db6b2b87efe7efda64111a1b58f2463897059ea39ffad8bbd43cca2", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551695, "uuid": "d70ce133-b820-4fd5-b694-50f1d0018e2f", "value": "11E433CE2B7CF15CCF8448FC6E1C08D447055986D7B56840BE16978B7AB49B1A3A8FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551695, "uuid": "75ef0de0-e5e6-47af-8ccc-1caacbcb3c95", "value": "12288:BJSf9Ob6A8D+ldNBCitXtOI9qO2OfdgP1H7meJi43:BUOZ8D+3NBC46Z1JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551695, "uuid": "3c30c4d7-a8d0-49f6-a8b2-2d332edaf27f", "value": 676607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551695, "uuid": "06a6f33e-538b-40e5-87b8-99fdb0169686", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551695, "uuid": "74670bb4-37fd-465e-9af8-82a9ecea1251", "value": "CompanyList_1664585363.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80c28b0-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625587818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587818, "uuid": "d01b8f74-0e14-485e-8a8e-d5d3b9174d04", "comment": "Malware payload (NanoCore)", "value": "ed445c25db258c1b48eb141ea92f3c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587818, "uuid": "2169c008-c91a-4746-bc33-fe721a5584b4", "comment": "Malware payload (NanoCore)", "value": "832b52f374f6f80bf3c1203bb4aa9a93c19e0d10f98bf3d528fb09b4a529f8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587818, "uuid": "2b017b02-a276-4bdb-a18c-b1af6e690875", "comment": "Malware payload (NanoCore)", "value": "91ec328bc0f85ca9ea03d1ce2a5d2503d826af38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587818, "uuid": "57aa2ed7-3584-4960-b948-f9927a1c0f94", "comment": "Malware payload (NanoCore)", "value": "8edd434f309ce95198c746aa1c8fffb4ba478e9b29f82a0c894f7a5224eaf06f7fa60df70be5c9b1b5e2ff232025da78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587818, "uuid": "cbb736ed-fd43-479b-82ea-5f99d52a5824", "value": "89E4CE64339B5156F0728AB5B583ECF1D66ABF612E12E14B19C03F8B39236C1CEC156E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587818, "uuid": "1bed3603-d963-46fd-a4ce-2ef2437e40dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587818, "uuid": "b0c1e5c9-ebeb-4467-845a-2fea2451ad37", "value": "12288:HqEyDcFWpI32qb/2RyHZ9eeMJ3D90/gI9UEYrJ3z9b10:ggcC3s8jy0R9UxrJ3z9b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587818, "uuid": "694f2c0c-3612-466a-952e-11fa020c88ab", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587818, "uuid": "94c5755b-8854-4c9d-854b-4b662bc72053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587818, "uuid": "56b1961c-f74c-4642-b9e1-31a14ae03299", "value": "microC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4add515-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594281, "uuid": "4a9ee9aa-cf75-43d2-9ab8-6e3e77becd33", "comment": "Malware payload (Mirai)", "value": "24d8016ebe31e29c2d49d341beaba2a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594281, "uuid": "7c96cef7-6fb8-4b72-9d0c-335ab2170551", "comment": "Malware payload (Mirai)", "value": "838efea4381d14423b96212ecaadc6f0ddae0c1fd158c2ade90493f65b1bf092", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594281, "uuid": "93872a46-e338-463f-80fd-0290610cace6", "comment": "Malware payload (Mirai)", "value": "2492f71c0dda6ddfba3b9024230bd01929422d47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594281, "uuid": "dedbb8fc-181f-49da-8232-39f2a97c185d", "comment": "Malware payload (Mirai)", "value": "06d606c2d13af206497a36b6d2fee1f664daceb52cb4db4a1a3e06e6f5a8004de415717a7944d044c8787cd4c24223b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594281, "uuid": "ea342f0e-23a4-4443-83a2-d6545aca4beb", "value": "2B533A12726C0E07D0971EB4293F1FE087BEEED021E4F585264EAB568636E73154AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594281, "uuid": "05b55bd5-1755-47bb-b944-83db1a3fe56b", "value": "768:Th+k2ZsqdG4OP0KondionXRV6YRBaRHwmZXcjwZXK5qdE9W4EUqh6ZW2el1o15:fXqkgKanX+YOuMX4Ex2eL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594281, "uuid": "181c0806-11a4-4c9b-b3cc-15492630253f", "value": 62560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594281, "uuid": "b88bf0ea-77da-4f29-b4d7-5a4d7af2be0a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594281, "uuid": "66ee0f50-f803-4e19-92c3-4c2e8c9edaa4", "value": "24d8016ebe31e29c2d49d341beaba2a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc16bf44-de8b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625597783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625597783, "uuid": "9851f5f6-e17b-4cb3-a8c9-c7b43759c7af", "comment": "Malware payload (Formbook)", "value": "b69dc9fdb93a1b433ff256b1f97e5322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625597783, "uuid": "43f51e3c-b0fb-4682-8483-4a0c41c9ebc1", "comment": "Malware payload (Formbook)", "value": "8395de2fb2940f93de9e2058bae551d3631bb5e93b23b396c5042532f0d2de58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625597783, "uuid": "8212af74-068d-4a5f-842d-6bb6a289884a", "comment": "Malware payload (Formbook)", "value": "b4677d1bec20f1813d24836fe2d66079987e0e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625597783, "uuid": "0dd6da5f-aadb-4f8e-ac78-d35ed7b3f07f", "comment": "Malware payload (Formbook)", "value": "7af03b30da57ead0d6dc30aa851916f201a82e38429a1916a30761481aeb035ac48c916f393021f504a89de51b1affcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625597783, "uuid": "9e3061e8-79c8-4a6b-ad34-29fe1a8106d5", "value": "80553B3D11B19A83C46FCBB46B6DE73E0F522ABAD316D6353824B09E38517E40D62937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625597783, "uuid": "a63f855d-a2c6-4ff2-80f2-b382f790a6f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625597783, "uuid": "e164817a-ff76-46a8-8984-f20c408e67da", "value": "24576:4dQKI6NGYQw9QXSZIMxWrYCnCLWlqZs5nE:JTaQXiIkinCClqW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625597783, "uuid": "d24bff07-70ea-49bc-8197-85e429b4cfc4", "value": 1341440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625597783, "uuid": "222c9d3c-c8ee-4ba2-bd75-c861cec67fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625597783, "uuid": "865951f1-6b26-4d04-99b4-74b725916910", "value": "REPORT_USD65371.35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b0dceb-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625588463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588463, "uuid": "278f23ab-cf37-4033-9334-44352cb9431c", "comment": "Malware payload (SnakeKeylogger)", "value": "730c3e11f32160328a8ec15631e91b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588463, "uuid": "39229f27-a4e4-4ebd-9e1a-d51344cbe47c", "comment": "Malware payload (SnakeKeylogger)", "value": "84a07c64cd318963d10bad4eead98e7f186f136d7e74725cabac4246b56e1712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588463, "uuid": "5e651d2f-29a6-4410-aa26-0edb12616465", "comment": "Malware payload (SnakeKeylogger)", "value": "aa411afd2e805b7bec40090290df4ced6cb41c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588463, "uuid": "2d349519-6f10-4af9-91c8-fd7dba8798bc", "comment": "Malware payload (SnakeKeylogger)", "value": "95ad8e97604c26498003bae56253cfbda66c1dc67869f833e2ac38984b9abd4d31b03b2b765146af6f40bfa0a449bef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588463, "uuid": "fc516980-4509-41a3-b433-9a4839593247", "value": "12559D3576728F91DC7FC7384331D23C4FB5AE66E217E2B568E8389B60B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588463, "uuid": "03a8ed29-72f3-4808-a67a-d6f516e45ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588463, "uuid": "5cdc2755-7864-49f4-8ca3-79c7983a4885", "value": "12288:0Mon2/BRG+l4BYaIMVjLz7TCViOce+3gVZsZZZsZckk1FuxV7ZtvKfms5R+eJSWP:0Mon2/BRG2iOE1FuHKjJCbpaPonfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588463, "uuid": "89fec47e-127a-4cfc-add8-fc15c66be935", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588463, "uuid": "a3a8715c-f43e-426f-bb60-8ecc758896ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588463, "uuid": "20197599-45e1-438c-a4a4-8bfff64ddeb1", "value": "730c3e11f32160328a8ec15631e91b52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86d8a00-de40-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625565565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565565, "uuid": "cec703a9-a797-438c-9847-adaa64b90687", "comment": "Malware payload (SnakeKeylogger)", "value": "9ca0806f39893ac6ae0c95bb5c075546", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565565, "uuid": "2fbd36f1-a500-4793-8d71-f1b3528a6a48", "comment": "Malware payload (SnakeKeylogger)", "value": "87d41a48bf0352879c87e185e359fc15edb09c0ff0daae5e137aac2b6a3a22a8", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565565, "uuid": "f2aa09f8-7a65-4f7c-8cb1-df0adfa6a645", "comment": "Malware payload (SnakeKeylogger)", "value": "82f9b5b1f32cb9db927745ee8ff80270140709cd", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565565, "uuid": "42fad04b-c039-420c-8ee1-0decc0645fa6", "comment": "Malware payload (SnakeKeylogger)", "value": "302e154e34cb1d1d74a1a329ea435f0ba4ed5e3a435f74b3a5f05283f426f739491d6ad60bd56ef3671d6a9b2d4a78a7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565565, "uuid": "7e6d475e-aa6f-41bb-bf30-c6af7d7798c9", "value": "2CC4233ECD507A55072BB520E04F82D88B6D4C9F2AA53ECDF10065A5CE562F4D364EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565565, "uuid": "fe8b2c78-bcac-421c-8df0-22fda059fdb2", "value": "12288:IF9VnhVry9bsbmMLG5a/z00BmNxKtCnLnYwAEJLV5j4mD:IVG94blLG5q9OKKKOfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625565565, "uuid": "235d01d5-868c-4f8e-88cb-4231d2fa4c23", "value": 551082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625565565, "uuid": "1253856d-2cb6-43f1-9fde-4b26a9f0cade", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565565, "uuid": "48bd6cbc-d03a-47c7-8bde-b1e6e2e85459", "value": "Payment Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5912f2e-de65-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625581425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581425, "uuid": "856a8d77-0f44-4aeb-9b11-b5061df1d1b7", "comment": "Malware payload (Hancitor)", "value": "83fbc27ee2d49a9bc2ff082d965530a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581425, "uuid": "269330ba-646e-43c7-9471-a2b7db64e987", "comment": "Malware payload (Hancitor)", "value": "893a905733f177ba900a82f4170e5b2ded3bd9cb35ca8cc04d0eb3346b549ceb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581425, "uuid": "623a10c1-1afa-41de-9eb1-0bce90a088eb", "comment": "Malware payload (Hancitor)", "value": "b22b8cf58588c684524e7ae3d2d2aa799d76ac10", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625581425, "uuid": "d09810bb-8a95-40c7-8704-750ae6f9e936", "comment": "Malware payload (Hancitor)", "value": "65fea843dc059d84b2edf84167dc061e91fdd83adc73772a3a87c2035dda67762a714f3dd5c440e9d42bc6a845a04462", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581425, "uuid": "86085c2b-9faf-43dd-956f-b3607670771b", "value": "0C547C007940E570E6E322778F69E645437CB9200B619ACB33DC1A9F5F7B5E2663A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581425, "uuid": "ca6eb8c7-5ef1-42c0-aac9-4c1f92de8197", "value": "66ea5ae56a1ad0183ee81e788900c71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581425, "uuid": "0d6d7810-92ac-44fd-8c9c-5d7d661e8679", "value": "6144:FzU8/N+o/63ha1NcmZglxvDf7U9RG7yH+:mM+pZmWlhWQi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625581425, "uuid": "aedea296-f2f7-4753-973e-f29b2bbad323", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625581425, "uuid": "465d19d8-9a12-4f97-a434-30bccee1cff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625581425, "uuid": "5a8e3f2d-6c9d-4099-919e-27a400531e26", "value": "nimb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9746d4a2-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625549564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549564, "uuid": "93b4f549-3037-4af4-841c-039be15bd9dc", "comment": "Malware payload (SnakeKeylogger)", "value": "ed57c1c7397b4503c170f93e9878661a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549564, "uuid": "f2bd0e18-932a-4663-b4cc-2d983034d3e8", "comment": "Malware payload (SnakeKeylogger)", "value": "898903bcbcce6dacdb39dab8fd336e8600798b4069dc73b4825cf27d6c6b4084", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549564, "uuid": "415955c3-2550-4125-9221-be2ebce42cd4", "comment": "Malware payload (SnakeKeylogger)", "value": "bf8da0c522b3adde613477a8fb3836067bd2f553", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549564, "uuid": "f69aa5d1-d14e-43e1-becf-7313a0c5eab0", "comment": "Malware payload (SnakeKeylogger)", "value": "c95e2bd96a2da691f6d6c580702e97f9b61a26597942becd02902ab3f15ed532375b6fb9490b21ee5c23cd10f82377be", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549564, "uuid": "382d8b2e-6f79-43bb-9cb9-37581acc7b12", "value": "15C423A5A9D80AB4920E97BAFC21E155DF50A1E4CE4F88D841D3F11828F1D662FDE07F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549564, "uuid": "3e7b5eef-756b-4bf9-b88a-576c072fb0bb", "value": "12288:Xtvpix/Kh+iDlSHAr2WbanRumTCysDD7QykI5r:Xt+K8aoHqQRpKDIykI5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549564, "uuid": "99b73b4d-4e40-4f00-8edb-572ed9e0b5f3", "value": 554219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549564, "uuid": "d07cd107-4d0b-4ec9-8bd3-3fe8046ce552", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549564, "uuid": "1c0e0500-9ba4-418f-aaae-d2ee4412ce79", "value": "SWIFT COPY - Invoices 464A62042150 - 25.485\ufffd.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4377f1-de5b-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625577059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577059, "uuid": "f0b22cec-1952-41c4-b23e-e423dcde3629", "comment": "Malware payload (IcedID)", "value": "732851906622ca3c151360bdfda8b3f2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577059, "uuid": "6b085da1-4c71-4eb1-8a1b-b6f663ac872b", "comment": "Malware payload (IcedID)", "value": "89aabd4ab6b696b3e9f74a04f27c4bc12f90b3a30855a403767ed525baec1736", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577059, "uuid": "519869ff-2a0a-4ca7-90f1-57d686fb7ac7", "comment": "Malware payload (IcedID)", "value": "8a365e71a0fc1f1ae38faef239ab085001b5f83f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577059, "uuid": "c6c7ba49-492f-420a-a172-cb19597ac50e", "comment": "Malware payload (IcedID)", "value": "a385f36d5b6573468b5fc895493d2c5bc9ad0e3f6996c1c9ae86428fa9d1653e792bdaad49b861d9a1b38d3d73583949", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577059, "uuid": "d1cbddc5-c000-4c1a-8d09-15c0085f55cc", "value": "3E040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577059, "uuid": "13455984-bb18-45ac-8b8d-871cc6d23118", "value": "3072:iDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:QRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625577059, "uuid": "19594af4-a596-452f-9674-ae66a3e42cbc", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625577059, "uuid": "96308431-8fd3-44e5-8fd0-d0286b6903dc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577059, "uuid": "393149fc-3efc-4f8a-a902-ca31b6a75a8b", "value": "Purchaseconfirmation-137606.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0a0d87-dea5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625608739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625608739, "uuid": "b9b4c097-ea04-49bd-b837-a13b4562fbf4", "comment": "Malware payload", "value": "842d16f5bc020dd549b8c6e79fd39603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625608739, "uuid": "d26d4b63-2da1-412b-97c3-f5046fe615d6", "comment": "Malware payload", "value": "89e803fb3d77bd7c8ce32b32eaa6832dd37dba1fe675ac46cce0cb297646dc0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625608739, "uuid": "647c72d3-c95f-4596-b92d-2790c092a573", "comment": "Malware payload", "value": "9889a9070a2eec23d05a09012c6873b5336db876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625608739, "uuid": "50bf5fd7-03c0-48aa-b7df-ac5dbd583182", "comment": "Malware payload", "value": "cbcaec41073c38b39ba9eccb1a7deb16ffb11217edf86f19ddffa087c4c457d97c2d6ccfe79bc6a07f7cf09ce87563eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625608739, "uuid": "91f28f44-14f3-4949-b79b-53b1180a6f74", "value": "6C157B06F2B581B5D16FC03B86A6865AF77238915B3087CB52418B2E2F372E15F3A771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625608739, "uuid": "8db8def1-a480-40d1-b0e2-e81e3c4ac5f5", "value": "9d4aeed4e0b676f10fe027a16f07d864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625608739, "uuid": "7b42636d-1536-42e6-ba65-a6d460edac71", "value": "12288:HWJ+sWVXVQBmhAq7tAdrLY5Fg/YfAIvae4MLHvUWSpPqqCwX4i/Je7ZUYa3cyJ:M+NBhAuAdnY5Fc6aZSMF9CwImJetUKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625608739, "uuid": "50dd4658-3eb0-4f81-b77e-84b6e81ada74", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625608739, "uuid": "1305e716-031e-4997-b508-c41571f685ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625608739, "uuid": "dd745df9-0206-4e8f-a7bd-cf9163b852d5", "value": "89e803fb3d77bd7c8ce32b32eaa6832dd37dba1fe675ac46cce0cb297646dc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcced890-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625587047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587047, "uuid": "fabbf385-9fe9-4d0b-b8f7-7cbb056b0e1a", "comment": "Malware payload (Loki)", "value": "eb78191bde1949991aabf77ea599ea88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587047, "uuid": "ddaf74f2-2397-4197-b4c2-e063b3aaa4e4", "comment": "Malware payload (Loki)", "value": "8a0ad791edcb0ee362e6013e5b86204205b5869aae17294f14047ed26f1dddd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587047, "uuid": "7b37475d-82b7-42b1-86f2-f5ffb8170113", "comment": "Malware payload (Loki)", "value": "f13acb0bc1bb00b5295b85ba27b9e27a1bffbfdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587047, "uuid": "6fd4626d-0f63-4a6c-a022-96097c456070", "comment": "Malware payload (Loki)", "value": "4c91abd7392fe4151a5e002da0290f98cd55d5f4064d7218f1360d1df774abf748d5b276786731f3efa8e12f5ce54b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587047, "uuid": "8cccd14b-9caa-461a-9956-3ce2b5b7c8db", "value": "E2559D3576729F91D87FC7384331E13C8FB9AE66E207E2B56CD4389B64B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587047, "uuid": "a35bc07d-7b0b-439a-ac02-deff06d94e8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587047, "uuid": "a2ed91c7-12fa-4bc4-b6ed-e5c2d226a4f6", "value": "12288:ZkFJaIMVjLz7TLGiOcez3gVZsZZZsZYJsvHIq26+7r9V65xKXZVvo9lXOH6Y88ve:qiO1aWF7reXKLvJ7yQafnfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587047, "uuid": "32b06d15-3879-46ed-888b-bd0a21bd5c98", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587047, "uuid": "993f3832-889f-4d8b-82e7-9666e883ab81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587047, "uuid": "bd47b60c-2ee7-4e62-8766-1b3e3aa5be33", "value": "ZUZK0PMO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cd1bcf-de25-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625553877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553877, "uuid": "4d44432a-c7d5-4f0c-9de3-af6c0eb01186", "comment": "Malware payload (RedLineStealer)", "value": "111c583c71fcc9931d28e8b572d45e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553877, "uuid": "7620a835-ebf0-450f-bf58-a8e16d8d8c31", "comment": "Malware payload (RedLineStealer)", "value": "8a8422381089a6e96de4992a945f3c5238a6680a1f1af7d585e56926e6f35c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553877, "uuid": "3263f0dd-c0c5-4e5e-844f-ae6efc2814e2", "comment": "Malware payload (RedLineStealer)", "value": "a7a851241081aaa70c04464c55c20c626bee9961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553877, "uuid": "c5f60066-0fe0-4f58-8976-756ac0fb644d", "comment": "Malware payload (RedLineStealer)", "value": "76acd215a0787bb265f0c749e4648d5c349d4c907d2984fe3852b42cdcc2b99712d5ae0de3f222c2e7ae3ce074fd930b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553877, "uuid": "08d010a6-ea55-4c64-83f4-f3a6a9a3d087", "value": "5954D1113690C433C5864C35ACB4C7B0AA3AFC727A749907BB983F6E6E313E1957635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553877, "uuid": "f0ed305f-fb8e-43f8-9f03-a0bbe5c2b763", "value": "22c3d9f1d8085bb13dd0a450e9ee111f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553877, "uuid": "01a1bcb3-c36b-4059-b1eb-95d5ab232464", "value": "3072:Fj311FOXRD+tETp7mKgL6N/qdFx1MST5fH/KrSPUpCWMkkZD/ht5sjgD:FjFOXR6tEVsLm/C1M+/KWMbMPZDhMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553877, "uuid": "cff18add-bc4c-4e8d-9f36-3fed25f669c3", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553877, "uuid": "743394f1-71d5-4ffa-8304-18dd650b48bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553877, "uuid": "1bae94b0-82a3-40e8-8c8a-c53e663e7c3e", "value": "111c583c71fcc9931d28e8b572d45e86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf7c6e9-de3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625562727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562727, "uuid": "dcbe47fb-dc60-4d2a-bef0-52ac02b83fa5", "comment": "Malware payload (Formbook)", "value": "c71f136a10c7c2f067f0a551a48f8ff6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562727, "uuid": "f882199a-a2ad-4e3f-8efc-e7345b1d4578", "comment": "Malware payload (Formbook)", "value": "8a8cc0347be5e13c27bbb82822db989e8c47896d8e23944a8f5f419f4b6989ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562727, "uuid": "92644533-7f84-4c03-960e-11c74acf734a", "comment": "Malware payload (Formbook)", "value": "a3bfac3f71eb6b1e1519d42ec8e01f4aff4d8d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562727, "uuid": "8c1389cb-5f33-4a64-be31-0818dc16a154", "comment": "Malware payload (Formbook)", "value": "d76520bf8985ff6b50d3aa0136cb3d4e8d01e7e3860a2225b1b42d53e418233affee6b9ce3c82bf6c520904e3f6c6b9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562727, "uuid": "01a2d90c-81c5-4e66-ad25-b71f3207d7d0", "value": "73158E7A60328BA2ED6FCA380735D57C0F5A6E75D14BB67814C87D0B30F1B1507AA92B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562727, "uuid": "55e2fd3b-795d-407f-b0eb-d251e2600053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562727, "uuid": "7aa91f2a-5ff8-4ddc-b598-50b6eafd2e59", "value": "12288:tOk6NsBknXmuGK6F+VGWtJFo+8QcwldWngDdzLGCJMLtwoYjL8DP:t76N/2uGK7Vl6+85wlzhzLdGw1cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562727, "uuid": "7376769d-2a68-4916-b331-36908ab8649f", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562727, "uuid": "fb7e14ed-ca85-4b04-967c-5fa16e53f526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562727, "uuid": "67c68897-4740-4907-ae62-da1be9c826e4", "value": "c71f136a10c7c2f067f0a551a48f8ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb8164a-de06-11eb-875b-42010a9c0053", "comment": "Malware payload (NetFilter)", "timestamp": 1625540339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540339, "uuid": "3b08ea73-8092-409b-9e14-706bc1a5044c", "comment": "Malware payload (NetFilter)", "value": "87f5eaf496607894c350dc206d2aff62", "object_relation": "md5", "Tag": [ { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540339, "uuid": "1e740c27-72c5-48d4-a326-5a2114b43a8d", "comment": "Malware payload (NetFilter)", "value": "8b7737a33688801760aa5359dd0f1feca169d35098aac02791ec3128287b83f6", "object_relation": "sha256", "Tag": [ { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540339, "uuid": "5990d8eb-2ff5-4cb2-a497-69c992ffeca5", "comment": "Malware payload (NetFilter)", "value": "62c8956b46d083cfe8f353ddbe53c10707263643", "object_relation": "sha1", "Tag": [ { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540339, "uuid": "27a2aa2a-ed2c-4945-bbd9-5d05276852b9", "comment": "Malware payload (NetFilter)", "value": "30d9966e7f9223d5913cb42f16dec21aa8ba80b002cbb07c1b3dd7f846a6fb8ba0113fa72a2c31d145a5b84ab8f71a45", "object_relation": "sha3-384", "Tag": [ { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540339, "uuid": "e3a7af7e-a6e1-4501-88bc-7625c5137f0d", "value": "3B33F2DC7644A68D452FD26B3D201CD2CFCA96C22F25B1D25B29B08684A4A516A34FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540339, "uuid": "706afc87-0566-4a00-9963-8bbe5965fd94", "value": "768:MC2R3GREhb587+1PlUMQR48TiTUq7/7ZF4ICj0fzAckomQF5BV65GYolCnYbb:02Reb5aa9U1RjT4FfCcA7opDBV8DGbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625540339, "uuid": "5322db17-7cbf-46f1-9a44-7d9baf10464f", "value": 51094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625540339, "uuid": "a65c0db8-3725-4ea1-9c70-b0c0053147a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540339, "uuid": "26489315-8098-4d75-96e1-f80c7ae51ed4", "value": "NetfilterRootkit.07.05.2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a197988-de63-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625580385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580385, "uuid": "f736db2d-4488-42e5-aea9-d7fe351d3946", "comment": "Malware payload (IcedID)", "value": "8b631bad0869713bdfb6ba803d971283", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580385, "uuid": "a4d5e3f2-2046-4def-929a-5b72bed2bb40", "comment": "Malware payload (IcedID)", "value": "8df7d1c0c37a519963e31bd2c7fd34b1cb5de232ee3bd9b1ab89878054d08715", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580385, "uuid": "aa5f8891-9590-4975-9107-82a06a3064ed", "comment": "Malware payload (IcedID)", "value": "74e21a99c75d20c0bd76db5d1a77c39b1721dfc7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580385, "uuid": "6f9a766a-f2c0-486a-bba9-c5a3d8b6e8fb", "comment": "Malware payload (IcedID)", "value": "afe245a6848e4203a36b00a14a6b3e6961216836b41b0d6bd3de9ca6e539d05728e9b82991b8e710f2a9c01530760b90", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580385, "uuid": "83396664-32a5-4c57-88d9-00f7672f9f4b", "value": "81040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580385, "uuid": "5ea8c01b-9204-4c49-b65a-29499ea506e5", "value": "3072:EDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:ORcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625580385, "uuid": "fda050a7-46be-483b-98b1-8a057e7d7d05", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625580385, "uuid": "d2111705-4f22-4e5f-b79a-b151dfc1b40d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580385, "uuid": "6acbb4a2-a136-44fb-bce7-592f9658a6a2", "value": "PI-9823472110866.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176d1a70-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599171, "uuid": "8e5558b2-d397-4eef-96a0-07d1273c8a63", "comment": "Malware payload (Mirai)", "value": "7cec24385a199b05795b0fa5e518ef8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599171, "uuid": "6568ebc4-3ba5-45e2-b40b-fa102adfedf6", "comment": "Malware payload (Mirai)", "value": "8e86629abf94d1ad6e9e4f1383b5ca8eda03381e9f5aaba015fdc2534a3b7f35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599171, "uuid": "5f0a7977-212d-438d-828a-5dbc42713756", "comment": "Malware payload (Mirai)", "value": "3ce1c8f60138fc043d6609185224ca87a184adc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599171, "uuid": "6ea592f2-62af-423d-bd31-3271f2787ad2", "comment": "Malware payload (Mirai)", "value": "a93bd59d9029f2770327a95f9b9f03d2cf0b1f0dd0a2eaf97f0c53356e099d2ae4a305064582cd2719638d979aba4afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599171, "uuid": "7cde990e-2528-4d71-b63d-3119c57659ae", "value": "12539EA1C5ACAD98C6698679BF00C9399723D00466E33EF6D642C797D017AECF049BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599171, "uuid": "b5cd23ba-1fef-4c12-8fe8-f08d74e02219", "value": "1536:l/Up07qqwahwtZgUObslgtBXxtfs3Ye5cW1tHCFdaeA:l8plLOZmgtBHf+BX1tHHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599171, "uuid": "23417f04-3039-4490-ad78-1599d6cd7f39", "value": 63740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599171, "uuid": "9e5b101e-2e29-4b8d-b1ee-7f71a5d206d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599171, "uuid": "3e45877f-0915-4831-a5c0-878c1ddb7366", "value": "7cec24385a199b05795b0fa5e518ef8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b166396-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599178, "uuid": "87eb49ae-fd44-49c1-9c95-fc5941aa17bd", "comment": "Malware payload (Mirai)", "value": "6deaebd67973791a8c58a9ef6fc77973", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599178, "uuid": "e2b4c8da-473f-4da6-814f-e0d5dcef9b93", "comment": "Malware payload (Mirai)", "value": "8f0f6b82b107ffd47605e67cb1740b9ee8bb9d38b86c61997b27c8189ac53fbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599178, "uuid": "8d52471f-ca1b-4600-bb13-aa62a04b1ebd", "comment": "Malware payload (Mirai)", "value": "5b239fede624882330c4465c817d315242e5d342", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599178, "uuid": "01520b1c-996e-4fe1-96b0-85558b8f1402", "comment": "Malware payload (Mirai)", "value": "4a9898219088a19504eb7a91cb61c823751124c2296535f9fa2deb1819924ea36044e9d06c439f1e632ddcf22d7df794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599178, "uuid": "0f4e6d90-1794-4823-8d77-0249d3db0417", "value": "ED333A8DB5212E6EE9D69CBA80675F0DDE552210A493070BB3BBFDC33933264FE15809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599178, "uuid": "a9bda409-fb6e-4d87-85e8-b8c1075ec9d1", "value": "1536:IEiRGyiTm92Kr5a/Nm8wWn8I7Pehg1phq4:VK5almC1eQphh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599178, "uuid": "363c1613-5b06-40ac-a01d-6c2b91be1e16", "value": 52360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599178, "uuid": "7a237fb6-7394-41a9-9356-240ae4f47449", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599178, "uuid": "a18f2fce-d50f-4578-b2db-23c31310d647", "value": "6deaebd67973791a8c58a9ef6fc77973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfb032b-ddfa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625535345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535345, "uuid": "88557860-e474-4cdc-b70f-0013a5aacf38", "comment": "Malware payload (AgentTesla)", "value": "5c6d089823fe6cbf46eb1c58d3f5d783", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535345, "uuid": "2a389666-8d95-4394-a357-64fcab53cbc7", "comment": "Malware payload (AgentTesla)", "value": "8f4dbe7c34d1156f4dfea370d4a71450cee77d2b2ac9b4d26ea2d58a7874d372", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535345, "uuid": "80d5dc08-bdd1-49b2-a250-79c35f5700b0", "comment": "Malware payload (AgentTesla)", "value": "3373282e1fbab21d63019d72066428dbdca4640d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625535345, "uuid": "367b592e-9efe-43bf-852b-7a7ee122e3d2", "comment": "Malware payload (AgentTesla)", "value": "aeb0dfed084dfb7eb5f1136fd5cb3576ad2530b4758bae8eb912921f96d9da210865345063a803af13746e05f32e77e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535345, "uuid": "2de1c143-a911-474d-b633-c63eb1ae9d1a", "value": "24059EBA60768BA1DEBFC6380331EA3C0F69AF76D14BB67418C47C5730C1B550A66927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535345, "uuid": "c7935945-51a0-4250-9b97-f8df8f7d5654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535345, "uuid": "1b459fdb-901e-4cd4-8587-b28422a1b45f", "value": "12288:f6NsBRnXmuIqeti7PY+50WuyDAs+9zl0:f6N02uIBtyg+CjKuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625535345, "uuid": "9637f0ea-4094-4288-8364-a60ed5e2d002", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625535345, "uuid": "ca9df193-14b8-40f8-95a3-dbfdd19b6a29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625535345, "uuid": "fd55998c-0963-49e2-b501-06c8bb124186", "value": "SecuriteInfo.com.Trojan.PackedNET.908.6785.10250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea06d439-de19-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625548844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548844, "uuid": "accf71b6-1c6d-4681-aa92-15759c748c4a", "comment": "Malware payload (Loki)", "value": "ea7c17a8ee34317441e966ab1aa05284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548844, "uuid": "8e201b8e-119c-4417-b50e-0323587ca8e1", "comment": "Malware payload (Loki)", "value": "8f4fa446b714f0fb5b5885876439d973077414a69648ebfa61cc169bf94abb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548844, "uuid": "af1cc9bf-93eb-4b9d-b135-430a064f6466", "comment": "Malware payload (Loki)", "value": "44d017a903a3247283e6d319925d154816e7497d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548844, "uuid": "819d3590-9e5d-48ca-9323-02f54dca91e6", "comment": "Malware payload (Loki)", "value": "f2a67ff226efcc7b02dcafb88c3f355e8745fcef371ae4fc759e39349921edcef61c534a3988eafaebc2aca83763e883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548844, "uuid": "0cfc94b9-f756-41f2-b791-3a153ce2c6e3", "value": "79E46CBA60764BA1EEBFC7381331251C4FA9B37ED25BF6785D98B18801D0B450AD2937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548844, "uuid": "6553dd96-3694-4190-8b9d-0f744fc78d96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548844, "uuid": "89b3d045-93b2-4644-a719-5b539498b296", "value": "12288:9tP6NsBz3e7Fwic0w8L1bLTF65ZwyJfGEgiTKW6yZAM:9tP6No3eeic7obXF6FDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548844, "uuid": "6637d076-492e-465c-a69f-4ecf9e330e64", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548844, "uuid": "b51c7c6a-a319-416a-8c72-d2c80840035f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548844, "uuid": "dd459848-7402-4186-acee-1363fb5bcc56", "value": "PO 210706-02A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d057fe11-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625556103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556103, "uuid": "33046832-2f0b-48ec-bc8d-c2fed97ab4bd", "comment": "Malware payload", "value": "04700bc9109877a6a8982877e363e034", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556103, "uuid": "72f79116-841e-4469-b3d5-a9deec786722", "comment": "Malware payload", "value": "90501147f79c6e1984aaf59d8c90893b8cb8ab866b8e55dc57a7ef56cd208aff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556103, "uuid": "6ba1398d-ae17-4109-9c94-603f6cda1238", "comment": "Malware payload", "value": "8b4839ce486b34d8aafe98edeff4c20ce4a1077c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556103, "uuid": "9dd50ebc-5829-4a14-9196-544dd20d1d3a", "comment": "Malware payload", "value": "b3834c240c7f6a6fd116b7be44592c67f205df546a0c6428d33bee03b2eac759e2547859c6a465da6ae30779b393b339", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556103, "uuid": "53d5f053-9c33-4883-8c66-4da65250a5f3", "value": "84D423C790C9A24A5F192279389F5831463EAF5EACEE395015E5F58C8FC6FB1CC38492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556103, "uuid": "c7f73d24-154f-4d78-b0be-a5047ca74431", "value": "12288:4LA5yY6Q2ez46Ht1eEFKMGYHzY3L2mGsH7sdDrtCSf:XAQrj1eEDHs2fo7+DV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556103, "uuid": "bd0beaa8-fef8-4b08-a43b-b2a2a58210ed", "value": 623963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556103, "uuid": "1e9593a2-a448-4e74-8d6e-5dbb8f69c98a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556103, "uuid": "95904207-8aea-401a-8221-661ea8171458", "value": "new order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f340343-de21-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625552074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552074, "uuid": "59825f51-eac1-4aca-aff7-d88dafcd9828", "comment": "Malware payload (AgentTesla)", "value": "9744d2b7cc31da361a6970308b3e8b0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552074, "uuid": "b0b99adb-9995-4449-b4c6-2a334afd12ba", "comment": "Malware payload (AgentTesla)", "value": "91f6f433ca07f192b872c8adbb18881997c7315a47bf21220e849395b0f35989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552074, "uuid": "06506f05-48d7-4ca4-8c14-f58187ad3bf7", "comment": "Malware payload (AgentTesla)", "value": "670bf408fbd1b02cc48caab19526e9b08046d115", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552074, "uuid": "ccb14766-9e98-4f97-9de1-e46a00ba50ff", "comment": "Malware payload (AgentTesla)", "value": "271b16c416b69dd7101e3252747672a92b91b83b25798452080ddaa701e7beeed2d26b8e082b874b4462c04cd541044e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552074, "uuid": "6b42bbd7-0bf1-42ca-a965-397d23d7f5fa", "value": "2DB4021837E98D5AE43F8FBE9492B201877DF2636603E35548D112A91DA3781CCD26FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552074, "uuid": "1b2b4687-55f0-48eb-ac8e-2c08c6b7c702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552074, "uuid": "6ce4bf76-01bf-4f9e-a1fe-2c7235a1e77e", "value": "12288:+W2OLNRAwEX6FP1V93bS8FCNR7uxWokJiXo:SwEX6FpudXuxWXUXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552074, "uuid": "5c2f6fce-8ce8-407f-a824-1df8808854a3", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552074, "uuid": "5e8258b0-29c2-47e3-9dab-411310b8ab39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552074, "uuid": "50efd0ac-1a18-4f67-a94e-290f39fcfccb", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b197a8-de20-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1625551553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551553, "uuid": "4a2d5665-d14b-456f-aba7-3decf3369ca2", "comment": "Malware payload (QuasarRAT)", "value": "a7384920300ccaf69e5da411ec4cb3e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551553, "uuid": "4c45ea39-ad20-49ba-bbd8-b2debf9ea42c", "comment": "Malware payload (QuasarRAT)", "value": "92e66be0b7c24b96cfa89154c5ddf622ef8cfdf189fd7653c794ec03635f731c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551553, "uuid": "cff90bb0-d581-4b19-9996-994e41b4de7e", "comment": "Malware payload (QuasarRAT)", "value": "964f617fa6030903614af113f91c38e1c2898ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551553, "uuid": "f8995975-168a-4be4-a234-ec00d951cf60", "comment": "Malware payload (QuasarRAT)", "value": "acbd04458109bb0cde8922870110bce1cfb0576c3445745ff7fecbe6a17f1e10a04cb35836e3c00bb01fd2f316e5e341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551553, "uuid": "b0c96069-230a-475f-b98c-c99013a6a5c6", "value": "F0E469808EDFCEDFC26F227FA41A5D825ADEC316065792D4EB464D31B7812638D264E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551553, "uuid": "2edf177c-7ad2-4cb6-bea9-91f3815b59e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551553, "uuid": "4c7f908a-11cc-4163-a12b-f66cd9eb9c0e", "value": "12288:xXWIXpF7vI5dxGvN0wYoXCxxaiyVVVmy2M4FqIOCtPNSzGFiiDbZ2U:1T7vIAN0NAziyVVV1h4xjPkz5iB2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551553, "uuid": "4b1a9dcb-8a79-490b-8d2c-11c5726a31b3", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551553, "uuid": "80a5a504-5b30-4c08-a490-7ed00305dc8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551553, "uuid": "bc62d55f-da23-4995-937b-efc5df9d8d83", "value": "a7384920300ccaf69e5da411ec4cb3e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819d9973-de5c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625577445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577445, "uuid": "a15ac57a-dc09-4cf5-9214-d6afbff5633f", "comment": "Malware payload (GuLoader)", "value": "88794627c018c3a15b84767c49cfdf2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577445, "uuid": "f1af40cf-8888-419a-a349-fa07ea216d47", "comment": "Malware payload (GuLoader)", "value": "94f4ae590ee86d414202b7e94ee0902170e6342546a14b4f6156a7f7ea8937f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577445, "uuid": "e121aed5-a147-4af8-ac37-f33319d0e283", "comment": "Malware payload (GuLoader)", "value": "b6ad6d7022e8432ab0b82ddc5af0c82836c98785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577445, "uuid": "ecd54e95-d666-4235-8870-adfd52265bea", "comment": "Malware payload (GuLoader)", "value": "51752492faba3ab60eb8dac2bca1b654b42326130467bb812ba5ca590ba2a5e2cbcb2647b036ad28a32c5f88428f590e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577445, "uuid": "1afedfc2-63fa-4082-9728-b32f8ce46d41", "value": "F8C38D63BAD46CA1FED24A3115B5C8763526BC3274935D8B2341FAAA7C3095372B122F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577445, "uuid": "6e390863-4541-4802-bd4a-98713c36b971", "value": "773df40b486ba5eea01d9fbfa70abb4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577445, "uuid": "2fd8a8dc-cdd0-4aae-90bb-1145cbe82323", "value": "3072:6ldrsiwxKbmbsRTFzO7nNrLzxXDhBY/p+Ul2W:gqYgwFzONxXDg/pR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625577445, "uuid": "bfba7b44-1edb-407d-bce9-ad2a24ac3a28", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625577445, "uuid": "5229e1d8-8319-4b87-9f71-e1597fd36b9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577445, "uuid": "f420dba4-7be2-4ecf-ad2d-f778850d0835", "value": "SKMBT MT103 Ref 5-07-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940752c5-de69-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625583060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583060, "uuid": "5f6e7837-091b-4a4d-8786-136bb25019f9", "comment": "Malware payload (Loki)", "value": "25d74feda8fb7a80280921361b61b9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583060, "uuid": "6cf8e555-f5d7-49b4-be3b-a5db9e590170", "comment": "Malware payload (Loki)", "value": "996474e9de0e7a9ac180577488e2d3603eef101a84f1b04400681ef28fd7240e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583060, "uuid": "3079313f-fb58-40cf-ade8-a7fa23bfceed", "comment": "Malware payload (Loki)", "value": "40c67610230eb6bb8db8d470ed889b6fcf53b7e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583060, "uuid": "282645a1-3f87-4218-9456-36f54f4ace71", "comment": "Malware payload (Loki)", "value": "e7f0b3f6769c6da3f48f4c6df29f343ce399132de0c61ce1edd8a4e540c4889b1a17d22b8c27a3e6927812a613288a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583060, "uuid": "5c4d3433-8232-4784-87fa-00967ce22198", "value": "FF558D3576729F91D87FC7394731D13C8FB5AE66E207E2B86CD8789B24B0B400A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583060, "uuid": "dbe77c4b-5686-401d-b8e1-c6ffd3b3a3ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583060, "uuid": "2bcd6fba-a8b4-4b0a-9832-18a607f94233", "value": "12288:5eaPaIMVjLz7TVdXiOceE3gVZsZZZsZkunsP8g76+bqbdw7Ohuq9Kl2vUJsPHN5v:6iOqM48g76La7hq9uaUaPEnfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625583060, "uuid": "38359563-6afd-465f-91b5-29be2431c367", "value": 1371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625583060, "uuid": "3cf8688a-3ee9-4923-8d5d-3b3542802c27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583060, "uuid": "30fd0ab2-e535-4001-85f5-687f410a9c93", "value": "C1-091284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0de4dc-de79-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625589814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589814, "uuid": "c4ff538e-099b-48a7-995c-8ceea46652c6", "comment": "Malware payload (AgentTesla)", "value": "5000e9a1b7dc59fb3de43c710edfbb09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589814, "uuid": "64d52a14-8e6c-44d2-869c-a14e4297c2ca", "comment": "Malware payload (AgentTesla)", "value": "999af9b550ed7a68c528d2691bfa040c67289550bb878c2ace8fcb2ae9c7ef19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589814, "uuid": "b1d2de86-2025-4abb-b855-daea3d4088f0", "comment": "Malware payload (AgentTesla)", "value": "c716ae2463dec931e1e6614a615762410086bb97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625589814, "uuid": "c5b5f850-5a5a-4c21-bd32-fae89a266f9e", "comment": "Malware payload (AgentTesla)", "value": "77009d3f170166e7e568bd192e9fb7eadaf29a7e5971d5f5b679bbfd20101c78039a5e63dd2bf13c891da344b7af71ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589814, "uuid": "50befee9-ad2e-4866-a020-6fd29204bbd1", "value": "41D4CD1033A7425AF0668AB57093ECF0D66ABF652E11D25B69C43F8B3523BC1CEC156E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589814, "uuid": "78b6b050-07ed-4bc5-90fb-1d01b9cacf7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589814, "uuid": "320d1d75-90f2-4f78-a961-e37ebc7d578b", "value": "12288:MqEqWG+8a2kYFlStvRpxv0TDWHH9fl8EsdA:ZWG+8VkYO9R0TaHHYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625589814, "uuid": "5414989c-336f-4ad0-9055-b52694be87f3", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625589814, "uuid": "e79d07b3-7bf2-4966-a3cb-75923c11841b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625589814, "uuid": "243c01a6-af4e-44c3-aebf-5fd919bdf5a4", "value": "5000e9a1b7dc59fb3de43c710edfbb09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfac1100-de70-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625586193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586193, "uuid": "701e2047-5fb1-4ad5-9885-f7e88c72fe7e", "comment": "Malware payload (Dridex)", "value": "75fb211a9b1555d2ff1725bd2436def5", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586193, "uuid": "edb493ed-c633-4e40-89a6-400828a81eb7", "comment": "Malware payload (Dridex)", "value": "9c153adf77d3aafa19aa1d1389803a16e0fca51a9b3caa5ca3c8353277fd7483", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586193, "uuid": "91d2f40c-a970-4274-b0f7-d8a6768b6fdf", "comment": "Malware payload (Dridex)", "value": "875930cc449d3c5c08119bad49750955fe51dc41", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586193, "uuid": "9d94c4d2-62cf-4181-afbf-4cb9344f8026", "comment": "Malware payload (Dridex)", "value": "0a3df710a5b2d07976796c78a3d88a96dc1ba58de58dfe2f495da6d95e85c5b17e225e98490918e04327f9610ef961fa", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586193, "uuid": "49a293fb-1467-4b68-892e-ba7a5076df53", "value": "E863CF84E38A087BF12550B4F2255A8328458D3BB501FC21D4DBB59FAB8BFB91D78F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586193, "uuid": "35e6b7c1-cf9b-43c9-a78a-0ceafc955df1", "value": "1536:SkhAAoVs2xyuddhRipMtSfvYOdtg3eLmsqU44444444444ZrojxH:SkhAAKs6ytIGQOTY4VycxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586193, "uuid": "e40d6159-a9ed-4a67-b5da-08673ba1ebac", "value": 69576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586193, "uuid": "a209cb4b-b228-4592-8d31-1b415b2fba46", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586193, "uuid": "a86ec1d1-b193-4dfb-9bae-02895c63314d", "value": "Reciept 8767556.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3912da0a-de61-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625579471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579471, "uuid": "be38a3bd-6d34-491d-9f9b-1462191aa643", "comment": "Malware payload (IcedID)", "value": "26dd94a1108bb7190c188eacb3d353a5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579471, "uuid": "61bba998-26fe-42aa-b5da-46cc497345ed", "comment": "Malware payload (IcedID)", "value": "9c422676a3a9fee8bf036220d927feab80503846c52912dc829387a68428ad89", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579471, "uuid": "d65e7069-165b-4f44-8866-dac39f6aabcb", "comment": "Malware payload (IcedID)", "value": "8ec75c0b4ed6c2dd1e7f4813e356996e822eea89", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579471, "uuid": "90711876-c9f1-44ea-8dac-5ae46da4d2e7", "comment": "Malware payload (IcedID)", "value": "fd90fa04b3dabba82038a224e0e8795cfd92c30f0e88db2bb376e7566e58753234a31d7f977b00005ba4c56df32595dc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579471, "uuid": "731fd837-e436-4265-9fb9-8ab234d31d6f", "value": "77040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579471, "uuid": "a92e0b25-16de-4e0e-8716-401619698f6a", "value": "3072:sDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:WRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625579471, "uuid": "cfbc8cd8-7268-40ab-8e55-a9af1459764d", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625579471, "uuid": "428c37b7-cb02-4865-b767-2061d102dc87", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579471, "uuid": "a1a954dc-e32f-4976-b8df-6223150de95b", "value": "HRcontacts7752205.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c85097-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625588245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588245, "uuid": "a16cc1a5-67a2-4e98-8b0a-7364a57278e5", "comment": "Malware payload (SnakeKeylogger)", "value": "fb2d36b9739eb7f17b7914d142644f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588245, "uuid": "f63d5874-43f7-4034-b303-be571e8c24d2", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf85e58b7cb62b39376e36ebc8fadf0c40f21ce98f36fa9016521a8158b4881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588245, "uuid": "dd8c8f1b-e308-46e5-8f2c-f6599de05d4c", "comment": "Malware payload (SnakeKeylogger)", "value": "c0b7df47c847eb268791dd6256193fe3a2db6cf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588245, "uuid": "bc7cb030-4774-458b-869c-7e31db221a04", "comment": "Malware payload (SnakeKeylogger)", "value": "31da96c4b9061f49b48d7a52700bec2c7c06b1573e50885945a2daa41a4e3c424cb864e8ead2d0f0e8a7382663e74cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588245, "uuid": "ea0640b6-6b8a-4bd5-af05-cf325b2f3576", "value": "A7C4CE1437A74655F0768AB57493EDF0D66A7F622E02E24B18C43F8B39236C1CEC156E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588245, "uuid": "038a01a8-a92a-460f-857d-71b8ffd22d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588245, "uuid": "9b98cdb4-c2b3-459a-a06e-20cfc046d4fd", "value": "12288:SqE15VnPHGlQ8Enr1CFCfczlzL7YB7wW:4TPkQ8EnBE0cBzLA7wW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588245, "uuid": "3fbe521a-8ed5-433d-83e6-ce55fb9c3144", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588245, "uuid": "d1f2bde0-0e67-479b-8013-9cde2fbe1bc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588245, "uuid": "3b968a60-ce39-4087-a5b4-dee554ff91f2", "value": "fb2d36b9739eb7f17b7914d142644f49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8c9edd-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625587020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587020, "uuid": "1f85dded-3c23-48ff-a288-c6f9d63a3970", "comment": "Malware payload (Formbook)", "value": "ef2f499529fe38a5133c4c08a6b0ed44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587020, "uuid": "3f64fe1a-1962-478a-b49c-b2e7ce95d052", "comment": "Malware payload (Formbook)", "value": "9d465fe3fc27bab164ac25f622558e9b474edd1c5e818968f06c43eca55c9fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587020, "uuid": "1daa3be0-8fd6-4d20-a2bb-882c69ba6b7b", "comment": "Malware payload (Formbook)", "value": "c6be007c5b6b6d864bad31b65e1aea4bc6cca9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587020, "uuid": "cdb5d076-6c50-4e12-9f2f-a382bfa0cfcb", "comment": "Malware payload (Formbook)", "value": "f665dea2cc88feae20ab4bb46dc47186c65ba9375e98d03f4386c792a609c015bfcdba1760e033d900a048361e649d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587020, "uuid": "25d41c74-ceb0-428e-9ef8-a44033348dc7", "value": "7C255A76A072CE62DEBBD67B0320F53C0F5DAE758586B27414C8BC07FCB2A558A51923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587020, "uuid": "795faf43-bb42-446c-8506-bfe9f3b02b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587020, "uuid": "aa2c8853-1ed2-44c7-8788-fe50add088fb", "value": "12288:E6NsBQnXmuniOK5bKR0jOYIdQ5pFypnjmwzRDJ97IJ2NWA9EoY:E6Nz2uif5rqCpgpjJdb1WA9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587020, "uuid": "d299f640-cb34-4bcd-9ce0-b7ab62a1be1f", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587020, "uuid": "d79cffd1-947a-44e1-8786-800e4c28b5d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587020, "uuid": "27be2a18-7d99-453f-b201-28467616fb27", "value": "PURCHASE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da045866-de72-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625587043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587043, "uuid": "5d37ce33-0be7-4525-a157-d251f4492fa9", "comment": "Malware payload", "value": "0c2ff1498245e766efefdcfe4fda93ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587043, "uuid": "091dd5f0-0128-42ea-a312-1c2ec9349ecc", "comment": "Malware payload", "value": "9d8aac8166ded744b46f142fb8fd8075a31e05958a9624abfb8d95586e7b8bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587043, "uuid": "d6123a5b-e4e5-4655-ad46-4bccfc239e2e", "comment": "Malware payload", "value": "f16e42c420ea30a0585120059814b17a8fccb920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587043, "uuid": "687ac020-4624-45f3-a9c8-7789802631ba", "comment": "Malware payload", "value": "c7c034fd14693dd6ce5c6717e9d24da0999a28103ffcf6493dde643fd8a572a60cc92cb786386437f042b4fc103cf3f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587043, "uuid": "57946c18-3362-49a0-996e-6faf27ecd227", "value": "84D4E0BC26585D56D377C3FEC195F23192B17E090182D60A96EAACD73E46BE2F8140CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587043, "uuid": "9d08b268-af4a-4145-8615-5f53a3e44fc0", "value": "12288:+DhW48txbxY6yBwJKM/3elzzqxR9MTLp9eHVoUvntq/O:zNtxbxY6ymKMGlz8R9MTLDeHP8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587043, "uuid": "f293ee3d-2e0f-4765-948f-348983dfda9c", "value": 602015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587043, "uuid": "625acc81-bcd4-4de2-8e60-19197793aa32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587043, "uuid": "a1204ebc-a683-4752-84b7-a5929646c67a", "value": "0c2ff1498245e766efefdcfe4fda93ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a946b58-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625552576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552576, "uuid": "b71b91ba-4788-4545-a72d-7f5d658aa39c", "comment": "Malware payload (SystemBC)", "value": "a66e1fe634f16366d92177630ff2767d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552576, "uuid": "142bd740-43ab-499c-ad1a-184df4308c09", "comment": "Malware payload (SystemBC)", "value": "9da99aa6d8ecde5212228db30e5ce4576ab78a7e8abb0dc04a9b7b99ca3237a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552576, "uuid": "a78bd278-5eb6-4267-880c-8b7916ac0cd6", "comment": "Malware payload (SystemBC)", "value": "77e6a598044ca41a16f72d136a85caab3e4e9c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552576, "uuid": "19961515-21db-47cc-92ba-891c3a5ba7bb", "comment": "Malware payload (SystemBC)", "value": "c558d85d9fe98d2aafa5d88503e194865f17f9d0ea4d0df5413413644a4cda15ef6104f02596bcb9eb87c7cf4cc2c88f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552576, "uuid": "bf6928e5-15c0-4082-8041-bb936da06968", "value": "D2B46D32F2B14437D133277C8D5BB69C9C2A7E102E2CA84A6EE41E4C5F39A817567397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552576, "uuid": "2ffdf926-aef7-4b9c-bcab-3e98cdbaae5f", "value": "909039a7a37e69bf5b6549b85d4f558b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552576, "uuid": "12606064-4497-4465-879e-bf77dab8e276", "value": "12288:lfGBwJKPjWbG7fFxI9SteBSBG6DOIjfQi:lOaoqyJxI9TYBx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552576, "uuid": "614cb2ae-0dc2-4aff-a58b-99c4a58cfbeb", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552576, "uuid": "e1e1c37c-2210-4f39-9eb6-0ccc406d7257", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552576, "uuid": "5da93ecc-06c8-46d2-84bc-26a032ba61d0", "value": "a66e1fe634f16366d92177630ff2767d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bc8521-de31-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1625559068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559068, "uuid": "2eed9f52-9ba1-4a6a-bb6f-7b4e1fa15f3c", "comment": "Malware payload (Adwind)", "value": "fa244ad93a965f951dcacfeac07f47c3", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559068, "uuid": "f6192933-d7a8-4d11-9d65-e92cd5eb6515", "comment": "Malware payload (Adwind)", "value": "a0a3718a306366dd251d2df724f68d6fe17746d81d8059a57414f142338fff69", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559068, "uuid": "03b029a9-b3fe-45c3-a984-42ab64a9c1bb", "comment": "Malware payload (Adwind)", "value": "b77d38d4206db6e9b8a6e10f4a8aaa2311baa925", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559068, "uuid": "2d98c425-11f5-4b40-9456-f3658a9279e4", "comment": "Malware payload (Adwind)", "value": "ee319f21834a24d881edb85f301d176c8a52088d6c39c9d2edb5e136d5f29a0a1537ccfdd452140189e2777fba35cec4", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559068, "uuid": "41512ec8-6c3b-4d1f-8e10-b028b990de29", "value": "5015CF6B70C4173EFE644108509E2F37B2B5960A6B15DC5AC8B28F4EDF27F96950E20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559068, "uuid": "eb0abd03-1b8e-4e9e-97fb-cae225f63204", "value": "12288:MVMuYKmtMJiRdAHf4R/7Ue0xkY70vZq01m9hDulkMHizjSe48oLCMZHDx7Pt7SFz:Mnhz84e0x2vZq04DutH0eDaFifW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625559068, "uuid": "a0f72307-46fe-4642-8777-269863afab8f", "value": 960502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625559068, "uuid": "c4efcaf2-d1cc-4525-a846-48e16864be4b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559068, "uuid": "5ebe6177-815c-4e6a-8ac1-d0dd26f854b4", "value": "Tax Return R28,765.50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a14939-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599437, "uuid": "6c5b6688-75a2-4916-9a9b-f1f91c36ae22", "comment": "Malware payload (Mirai)", "value": "c5698811dd2083ea26ec86255e0c2fa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599437, "uuid": "d43ed6c5-512c-4647-9fed-47a93f77442a", "comment": "Malware payload (Mirai)", "value": "a0fc9b29b6c6bc22d67a1c11570f89d217aeb87fdc98ee499d7274d02313d7df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599437, "uuid": "11d3be5e-9f51-4262-8b92-6285a3f3fc10", "comment": "Malware payload (Mirai)", "value": "4f85ddfe6cc77fc0763dbeba1cdb8a5a69741e2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599437, "uuid": "6024ec7f-42eb-44b8-9fb0-d254fc9d55aa", "comment": "Malware payload (Mirai)", "value": "18d4c4f4d81634d6a09cf8ebf00cb58e1d12976113da86b4c278cba72163c59ac49419eedbcc5cdb97b73ae72b5dfd41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599437, "uuid": "18c6f270-e837-4a1c-b44f-5a8bedab77ce", "value": "F9E2E15FE349AB59CEFD8C7A411D03312923B088279E97CD571696C4AF6DF07A8E841C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599437, "uuid": "a2d23f53-e94b-4abf-80c9-0e8756d7a70d", "value": "768:LgbpICnj9/rNQPKg2sGlOoV+BZE9FJdW/:Mbp7nJIKV+A/JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599437, "uuid": "cd73f3d8-97a0-4ec7-8b02-0799c83f62d2", "value": 31608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599437, "uuid": "1e9aa9a8-62b3-4627-9b5c-0de47dcd604e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599437, "uuid": "8f4ee4a0-5bf7-44ca-8c0f-3e9eca16a8b3", "value": "c5698811dd2083ea26ec86255e0c2fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a638ad4d-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594257, "uuid": "8695a60a-f9d4-4de3-afa8-a75370030acc", "comment": "Malware payload (Mirai)", "value": "7427de720f8bd27fb36dc6275f1201c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594257, "uuid": "ba2196d6-77cc-4314-a1ae-9723515f35e4", "comment": "Malware payload (Mirai)", "value": "a1d3903a41c2b6caac9b55543cd17c2caaa4d3640137d50973f8ccc73fd16f5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594257, "uuid": "c5b90e51-c155-401d-b26c-93a7bea4b2a7", "comment": "Malware payload (Mirai)", "value": "8fc0afd2dedc1d47b122d445495ea82d03f3daaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594257, "uuid": "8f509e61-9b9b-44ac-afb6-ef14cd7832e3", "comment": "Malware payload (Mirai)", "value": "9eed2dc4b8afe10cf4a6b2f60b0dcb20d4d52c1bb0303f1b6c22a8cac3944a3a710bdcf0953592971fed21444ccdeea8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594257, "uuid": "94997a9e-1a64-433d-982a-ebea9e9280db", "value": "364329C9E583D9F5DC120570216BEF329A73F5FA2168EA97E3E55533AD81A02E0067CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594257, "uuid": "264328b2-c06f-46a2-acf9-7b365146849c", "value": "1536:+kVmit0C+RdkXpE2x4bPHyb8Ncv8bzQZr:Iit0C8dkXpEE4jE82v+8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594257, "uuid": "a8b64446-4d23-4a40-ab1b-96977409fb13", "value": 58320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594257, "uuid": "0b614d4c-3fbb-4498-b599-40484891fa71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594257, "uuid": "e804129a-c772-47eb-ac49-82330ef08286", "value": "7427de720f8bd27fb36dc6275f1201c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69af68ca-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593726, "uuid": "6abec6ec-de52-4324-97f7-7c293a60ec14", "comment": "Malware payload (Mirai)", "value": "53d6726e16ffa4847b6abd1163f5cf51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593726, "uuid": "8608d0f7-8298-419e-970c-b4c8635017e5", "comment": "Malware payload (Mirai)", "value": "a4fb81a31f5f9b345b0bf4d060694a047b120e040dc16e54a05ef549f5e7cf95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593726, "uuid": "8aa97463-1fad-48e5-8766-6323565739d5", "comment": "Malware payload (Mirai)", "value": "fd41e05f6171e848000e2ccc5a07110835100772", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593726, "uuid": "d8671a6a-ca2e-4f4d-8b51-471787b5cab8", "comment": "Malware payload (Mirai)", "value": "e51a7813b206ffb49e91034de01b835dda78b9d4ad1ba5c418ce15745c5e55bd0dcb93369febba8e2c23be93f9c6b568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593726, "uuid": "105ad861-b96f-495f-bf9a-3946a3ca0aba", "value": "D613F796F8824D26C9D8137AF57E06CD376063E6E2EAB613CD104B643BC690B0D67F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593726, "uuid": "98acd6ed-e25c-4be1-809c-c600c2a3ac06", "value": "768:75HtHW3/aoyLiQZQbtBMs3fnnT1i39jPjxGO3H+lH5MUhj7j7QQd+QPN6vGcz+jK:7XSioyez/MsPT1iJMSeDhDV9Pcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593726, "uuid": "1bd425f3-4571-4169-81d9-d06fb3ad2b84", "value": 44880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593726, "uuid": "74d61601-ac30-43e4-b37e-a869ba18f6e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593726, "uuid": "b26525d2-fe78-4559-a6ab-9fc8f89938f4", "value": "53d6726e16ffa4847b6abd1163f5cf51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfe3657-de23-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625553146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553146, "uuid": "cbc30054-feb3-447e-8e9c-ffffc6ccf73e", "comment": "Malware payload (RedLineStealer)", "value": "5af2d4f23b526022e3446bf28928983a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553146, "uuid": "6cf19290-80b0-4b69-b822-6c96b010f0c2", "comment": "Malware payload (RedLineStealer)", "value": "a5a1d72b8d7045cf92e3fc39b72cf251a015464f1f7920aa028b341d3f646ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553146, "uuid": "ed38af69-9e28-4eea-aecb-a4050338c778", "comment": "Malware payload (RedLineStealer)", "value": "efcb1386b7d4ef0d92df1456434dd38cbd30ff2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553146, "uuid": "6430ad73-a701-4a02-8304-76910bd703ca", "comment": "Malware payload (RedLineStealer)", "value": "b0aaac2ad3e693953d2ba885b39b34a4c3f19aa9d3acc2d4178685f4f4293d04dd2fb814076a24c83bdecdcfd58bf9df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553146, "uuid": "e28afa35-6d18-4070-b3e4-8a6ebccff4b9", "value": "66C4481136A44929D6B38BBF073271A7053DAD076822BDDE34A53BCD0E7B686F416E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553146, "uuid": "89a32928-c409-4df4-9cc7-3c93ab267fb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553146, "uuid": "99456a63-afbe-4a89-ab95-50d56a4c0c01", "value": "6144:HGLH9Em2+1mbtPnnA8Lu/7Ru7J3ERE8lMiF7ky95fOmJt1ApHivI1lzW:H82m38Ai87Q+MiVflJ3Ap1/zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553146, "uuid": "7edb7cc4-4dd4-4fe5-8706-cc2579858a97", "value": 560856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553146, "uuid": "36d9fa91-4554-41c3-8aea-82f1548e0e1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553146, "uuid": "7c8858cf-0b86-47aa-a7a7-00000380824c", "value": "5af2d4f23b526022e3446bf28928983a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cf4cd6-de2a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625556112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556112, "uuid": "9609a518-ee77-4535-b41d-02f4fb839099", "comment": "Malware payload (Formbook)", "value": "9a1cf2fb68efe478ec2359093010ae11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556112, "uuid": "c427fa01-3a00-45dc-8b68-e5382a74e261", "comment": "Malware payload (Formbook)", "value": "a5d6e8bd540ce7204cb478732027f9eaafcce973ebb0c78d32ea8c3e4499f10e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556112, "uuid": "2ac014a7-86ea-4af3-bae7-8d6c56301b8f", "comment": "Malware payload (Formbook)", "value": "e9d7161229b524977ed7a14f56102fd3893adb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556112, "uuid": "c9b56b56-7c9a-4f34-9b9b-8da5af340898", "comment": "Malware payload (Formbook)", "value": "631217a1ad9cbfaf51ff2d00a007bb93ff7a4e23a0ad3a012e96df1b5e59ed4e2bba7f135959580514922fb473687271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556112, "uuid": "b4e0426a-be89-4691-9191-8e7037beda5a", "value": "9EF49D9C7650B6EFC85BC977CAA81C24EB6074B7830BD203A05712AD9D4E69BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556112, "uuid": "5c82ecb7-4e54-477a-abe8-3e6bd7717797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556112, "uuid": "9ea9e376-dbee-4c5f-b071-43f557fe31a2", "value": "12288:oCZwiOEHyAKr8JjQaUHPSb+XeRahQdc1qIOKwSfFMtiPR2yVw9tVRoQyTo7AdyV:oCZwiO1IJEUb+XqdVzeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556112, "uuid": "dac138c4-3826-44ef-b622-0234cde642c2", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556112, "uuid": "cb0d3f5f-a0b7-4d25-9b88-3e7998b79250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556112, "uuid": "57a03ee9-456d-4f67-a3fc-44be84cb1837", "value": "PO# 20210706-Order UTTR -Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb6ba74-de29-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1625555350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555350, "uuid": "a675cb8d-900f-48fb-9a72-8e26abea8be9", "comment": "Malware payload (Heodo)", "value": "e19685fb5d65e400f2dc9f6af799e637", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555350, "uuid": "2feb0747-e6de-4be1-b644-11ae944305ad", "comment": "Malware payload (Heodo)", "value": "a60549d08d066eeb7cce46f19cd62b426b82f5f56512f9a6cd3c9781f3a67a6b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555350, "uuid": "1309d1b5-71f4-48ec-bf44-252b947e49ee", "comment": "Malware payload (Heodo)", "value": "86a7ae8a7b71f0df8c4731693ce57f0e73309334", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555350, "uuid": "68d10dad-37d4-4648-9653-49b66c7c373b", "comment": "Malware payload (Heodo)", "value": "0845b82941453260ab5a1712df63f26cd57d08dd19c1cee836abbb5d557cb39a580ed8ee06158df2ebc8aa919798c917", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555350, "uuid": "0efa5bdb-c842-4447-add3-da5c32e45b75", "value": "B99622C1A3C11114D8A43EB9904DC13D6B5EDE496363BA1E28D23AD4B2745A44FE3FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555350, "uuid": "ed2fd222-f321-4b3a-888e-360ce7f9a8c1", "value": "196608:hDAQAUixXAdXU4ZkgCnU+Yu26kuA/CHksNE+fBJ+BM3D:hRAxxS/BCU+o6kJCHksK+VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625555350, "uuid": "f8a343a0-d7c4-4ec6-87aa-2a6087c3c84c", "value": 9168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625555350, "uuid": "52c8dfad-d7de-463a-b4c7-3d805762fcc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555350, "uuid": "21bc1dbb-40c2-4bcd-af3a-f99ba7a7752a", "value": "e19685fb5d65e400f2dc9f6af799e637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab338afd-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587823, "uuid": "43a2ce6d-5a62-4d53-a6fe-697b3db685d2", "comment": "Malware payload (SnakeKeylogger)", "value": "b4a69663fbe2260a634fd1a801bef08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587823, "uuid": "d64b3df6-493a-4acb-a3ce-9a387186dc29", "comment": "Malware payload (SnakeKeylogger)", "value": "a6d3022b85a06e7711cf0a95786517d098852f39687134c70cc0a718c57b5016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587823, "uuid": "89166a2c-dccc-4b8f-87a6-fb3adcab8540", "comment": "Malware payload (SnakeKeylogger)", "value": "55ae44bb3ad469770184af418c50de6a3bb27d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587823, "uuid": "f9e1a4ce-6925-43e0-a7a9-980542946e18", "comment": "Malware payload (SnakeKeylogger)", "value": "9153f1b66f4827d34ba931a7d224c78c753986f9c2c7ae605f3fab56d64accd945833cd30fa81b4e4ced7d09b608dd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587823, "uuid": "a7155933-6579-42c5-aaf7-512f85472727", "value": "03558D3576728F91D97FC7384731D23C4FB9AE26E213E6786CE4789B24B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587823, "uuid": "e572f5be-5d65-4234-ac67-5e3cacf80a1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587823, "uuid": "8ddf76e9-d80a-4268-ac23-76e6106ae3a2", "value": "12288:aMGJaIMVjLz7TLq8iOce03gVZsZZZsZTwD1atdmOhC2hXxgwSqRxe708JsPhN5jN:M8iOG1atJTkwSqRe08aP6np2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587823, "uuid": "5bf457db-1326-46b8-ab7a-9157c2a5bee2", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587823, "uuid": "ccebaad3-acf5-4935-9828-294141c8881d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587823, "uuid": "40c81c13-bbc6-446a-b178-3d9fbde9e89a", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4edddb3-ddf2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625532005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532005, "uuid": "418eb745-37e8-4711-9a3b-84be9ee4a031", "comment": "Malware payload", "value": "a1c1a197ad149283031c7663012e2f28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532005, "uuid": "1a03fcc5-b63f-4422-9d3c-314fda99818c", "comment": "Malware payload", "value": "a6e2d6db4f376331a5a38448eaaff714a6283e40b7560cb197c767cdc9da7095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532005, "uuid": "94c15714-a4ae-4400-8630-337c6371c9a9", "comment": "Malware payload", "value": "427fbf37154ef949c25b5ab1e081e8a44dda2847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532005, "uuid": "fd3ace30-a5f7-4660-8a79-4fcc8adb081a", "comment": "Malware payload", "value": "3ba15d814a6a6f113e9efe09618179873614aa90c63c66fa76df887dab55624a843a6a2f8ff70d8f57e6b31204989891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532005, "uuid": "68bdb96a-3899-4300-a143-ec4e0bf8491c", "value": "B235E011F7914878D076C434CA638613DAB2B89A0FA4EADF2394926D1F777E45B3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532005, "uuid": "ee44a9e1-7563-4fba-b2be-bf34d6dbb3af", "value": "9ad22365520b11a0847833f100aa3244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532005, "uuid": "214e7fdf-4fa0-4c0f-8ea6-b4bfc4b527c7", "value": "24576:3zJla39cGH0dG7sOlQCgg1abH9RKP3QUxq8m1:dlq917h2NwaL9RKP3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625532005, "uuid": "9261506d-8a79-45f8-a134-bebb8aef83e5", "value": 1089488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625532005, "uuid": "aa402f11-28fe-40e8-b7cb-f17f64c719e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532005, "uuid": "cfa6457c-d920-4f78-a77c-edb4cf8249ef", "value": "a1c1a197ad149283031c7663012e2f28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51f3409-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625587034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "000b273d-5f05-4938-8ad8-a606dc58547a", "comment": "Malware payload (Loki)", "value": "c9138db226a02310ce9d9e63a776424f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "08de4680-2163-4c57-945a-6de3d08aaef3", "comment": "Malware payload (Loki)", "value": "a7caf561ebd9126ca68fb1eb8f9acbcf34cc89c15e346c55f06d56af81a6081c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "b852e5a6-0a45-4aa2-bea6-b5baca874f7d", "comment": "Malware payload (Loki)", "value": "f12ee94da23836a02674c8ff6784ea2501110c13", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587034, "uuid": "e7c68dd2-2d0e-4874-a2c0-a1f61257d627", "comment": "Malware payload (Loki)", "value": "140a4ae60d2e8b2e4bd0b019ae88d9f95c0e6850a83be683316f7aa2670780907d03d19ef2fe76d625bf59824b7ee8d4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "5b164ab8-67d1-451c-afd6-99e0cbbb1552", "value": "CA959D3576729F91D87FC7384331E13C4FB9AE66E207E2B56CD8389B64B0B410A56623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "23c97889-11dd-4be4-81d4-9812cd085780", "value": "12288:gkFJaIMVjLz7TLGiOcez3gVZsZZZsZYJsvHIq26+7r9V65xKXZVvo9lXOH6Y88ve:HiO1aWF7reXKLvJ7yQafnfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587034, "uuid": "e6d7b89c-b349-466a-8d47-4294671ad7db", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587034, "uuid": "1ae401cb-e5e1-4e29-8a2b-52d188f31458", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587034, "uuid": "255cc09f-324b-42c2-8d73-222e095c7d2d", "value": "New Order.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4c9272-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625584124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584124, "uuid": "5053429b-7a2b-448f-a9e5-7955d37e31f9", "comment": "Malware payload (SnakeKeylogger)", "value": "731e488b27595cb4deac408354d63941", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584124, "uuid": "5afcaa8b-327b-4878-a792-4d15d61cf3f6", "comment": "Malware payload (SnakeKeylogger)", "value": "a8bda994a61020f677fd7ab191d916855545086c032d3ad8bc03ff19018a539c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584124, "uuid": "9ca67e7e-2f78-4fe7-9a44-db44d811317e", "comment": "Malware payload (SnakeKeylogger)", "value": "0217cc2b12cf869ee04fea3b772e413187b41a32", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584124, "uuid": "4330e618-684c-4b81-9320-35e79974690b", "comment": "Malware payload (SnakeKeylogger)", "value": "aff51f8e3d8e3522e364cbf866c5da9d6144d1fa58cddb48500edfcbffdb479096eaa198fa8b62efef94cd8139a544da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584124, "uuid": "48054ea1-04fd-4fa3-bf4b-87596002288c", "value": "880382ADD04746A88F46A7B8671B6F82458CB62EF788A232767C977417D1C7B4027C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584124, "uuid": "1961e48b-2b77-44dc-b344-719a1e9b5d1a", "value": "384:/VhjA781bf8x4nz0xnXsKPlRpF7Nb7UABnzhBCIAZd3FTy4rEQYF:dhjS81bYcU5hbFhUXx2fQYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584124, "uuid": "6ebd5421-cc60-418b-9961-f79b2daaa0a1", "value": 39533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584124, "uuid": "faca0231-f203-49e3-8343-042cefbcda3c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584124, "uuid": "992d7abe-8a36-44da-874c-96f32e60a03d", "value": "13076885-RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7a1564-de72-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625586938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586938, "uuid": "27c3ff55-00d4-4b21-b89f-4b19f21bb52c", "comment": "Malware payload", "value": "ae76ea6fc16d5193cbdb7f6b0284b7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586938, "uuid": "8a993fa6-4d42-4023-8456-0578f62f1008", "comment": "Malware payload", "value": "a95b504fc7f0908582c51425cc314556e98c5ecbdd1bcc899eba2f4f58b6835c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586938, "uuid": "93801caa-20b1-4757-bd95-c30a91a00987", "comment": "Malware payload", "value": "7bb0fdf03bfd901865361d1c880f4d7ef36ba80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586938, "uuid": "87732980-baa5-4f5a-a4eb-ff192a2c963e", "comment": "Malware payload", "value": "fd2b43acea6cf45bd1c73f51f0d754eab9289eb964807e42e9c8e9517588268ece7641b8415a76e1f95daf10ef80fa85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586938, "uuid": "7995824a-b28e-4935-ad57-1fa3910d4a0a", "value": "B614BF213A80C472C48655304865C7A16ABDF8716A738A47F7A8377E6F333C169FA35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586938, "uuid": "f272fdf2-57f2-4c7b-b65e-ee38ce09a180", "value": "ba9b0f2c256a509c08b05c60ed64bfb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586938, "uuid": "a704f90a-9f1d-4b40-9e9f-808d98c65570", "value": "1536:BYgeeVArTlgmXI78cUdMLnbk5LcbWmu9kyv3oXpHAZRzs/p4uHOsxfs5usirYEnf:BYtIgFMLbNVwvGIRzs7xiusilnEGTuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586938, "uuid": "487abec5-0b19-4c18-b88b-526170c45317", "value": 205308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586938, "uuid": "9dfe1075-2e93-4754-9d0c-ea175203b507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586938, "uuid": "d9b4ed45-dcd8-4026-b868-75648c2196d0", "value": "ae76ea6fc16d5193cbdb7f6b0284b7fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22ad10a-de93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625601149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601149, "uuid": "c412d600-17d3-414a-aeed-88bcf92eb742", "comment": "Malware payload", "value": "9a95aa0c43875fc92d98796992121ae6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601149, "uuid": "5663e699-2335-4db7-bb27-18c74e0c0957", "comment": "Malware payload", "value": "a9d81db31f2e267c8e04e1045246e9aaa13ea4f0267c5eb4e80ac2dbc6831838", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601149, "uuid": "9820652e-76a3-4099-a8de-0697a16b84be", "comment": "Malware payload", "value": "2b8b3d6e105e2e8a40f35834a179457518911f86", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601149, "uuid": "f06bc437-16c8-4a9d-a113-5822fde7055b", "comment": "Malware payload", "value": "acbffac704d85c541fe5f74b6434c54356cf1a6c9865948bdb34491de7089df43926d345f1463452f2b93a4455696cfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601149, "uuid": "1beb2c9d-4373-4c75-9116-69eb3904d14e", "value": "C393B792AF73DE35DE25C2388CDA51996332EC054A1D838B3604F2397FB9A72EC51187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601149, "uuid": "75e22ad8-0e75-4356-8c2b-123d5ba2a4e0", "value": "1536:VsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm02PSJHN4C1bvBm0AlxjkLFSyXO:VhlYkEIuPm3fNRZmbaoFhZhR0cixIHm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625601149, "uuid": "4f5397f0-4249-4b48-b026-222c02342152", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625601149, "uuid": "1af6853e-4dd9-4785-8f1f-f3d2898aa33e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601149, "uuid": "efe0f2c6-4d09-46c6-92dc-ae9f1a778d36", "value": "SecuriteInfo.com.Heur.3667.31675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d45a43-de20-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1625551844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551844, "uuid": "ae99c9d0-8466-4d5c-a517-c42c9b2989c1", "comment": "Malware payload (Adwind)", "value": "1279121c8b06b6c1896b7fe8165eaf10", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551844, "uuid": "91d063df-1946-4748-b657-cdbe4527ef05", "comment": "Malware payload (Adwind)", "value": "aa121f37779e88ede60e217f8c2b1aa1cce2ec5a9a518af4a33206f3633aa156", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551844, "uuid": "93c16d7a-99ea-4685-bc24-8f08373b9b44", "comment": "Malware payload (Adwind)", "value": "e8bc109ef91a4f4653a7c5fd1747081879717adb", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551844, "uuid": "f262a624-2a74-461a-a6bc-fb15cf7c740e", "comment": "Malware payload (Adwind)", "value": "7abb016ba9d0b0fffce286212631a261cbe8591941d5f953c8201d1177d7ebe19ea3c82a3d51d2cbcf6117d21ca08158", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551844, "uuid": "71f571fe-c49c-46ff-90ed-3e985ca8f881", "value": "47D42327296CD22BCD62F7B96E86A85312C0CDE870F3915D6EA6D0536FDD2449C32CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551844, "uuid": "d8be2c8c-77f8-429e-af73-381c65443fa8", "value": "12288:liZaAIwC++jcuh1qfMcXuMCq+HnbxjL96jy4rhl1Ys/YzKHCxVzpOr9HRG:liZTIk2HWfJXuMB+Hbxd6jzexOH2Vzk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551844, "uuid": "f2a630fe-ada4-4281-b76d-f6d1d1541bbf", "value": 649860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551844, "uuid": "6841ffcd-1817-4cde-bc6c-32d56231b104", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551844, "uuid": "da991e05-785b-45fa-9a92-abf5502d67e8", "value": "PROOF OF PAYMENT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe26fc4-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625551028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551028, "uuid": "e0704ea0-f70c-406b-a446-3bfdc5f279b9", "comment": "Malware payload (AgentTesla)", "value": "a3a6960a78aba71fef29813f58888abc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551028, "uuid": "4cf30517-41c4-4fff-b8c9-2080a13361a1", "comment": "Malware payload (AgentTesla)", "value": "aa2229fc859b09da4ce6977a48ef63190c42d3ad2b3399ee925826a073694eea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551028, "uuid": "35f946c5-dd75-4847-ae7c-a79615e50a20", "comment": "Malware payload (AgentTesla)", "value": "2147509b785968b61c98c2fb3ac79575b0fd4b39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551028, "uuid": "1d8d62b9-16d9-4e83-85d4-d8d67502295d", "comment": "Malware payload (AgentTesla)", "value": "1ba4ad66fefdff9898a690996078912b9de2347544cc39001f8588387715b2534dd10b44aa709ef7341f63b424c6c605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551028, "uuid": "db2281ad-02e9-4452-a838-6891a47c26df", "value": "5855AFF876047DD6666F47ABDE96ACDC03A626639ACBA4CC80747BC30563375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551028, "uuid": "2884b231-b0d8-4958-bc79-26f29324b3e9", "value": "24576:Hg9zKGSrZtf5KCPTYzdG1xoyTSRT9xYt4PWrcck2pumho5rIFf2HzAuO1MVHjl3K:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551028, "uuid": "89dd32ec-cdfd-4f6a-9847-909a511cf81c", "value": 1352086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551028, "uuid": "7ca08a6d-6d18-4a60-a6ef-c01cf478a77c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551028, "uuid": "b00df0af-eb8b-4b7e-a6f3-04aede6f2c98", "value": "Banco Santander Copia de pago.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4b8053-de60-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625579289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579289, "uuid": "0d4c79b9-10ed-4abe-9a20-66a031229204", "comment": "Malware payload (Formbook)", "value": "5f2da3f9d83babaa9fc94615ce884be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579289, "uuid": "c58dc612-ce4c-4412-9595-e78c003efc53", "comment": "Malware payload (Formbook)", "value": "aa600ea695abd3d2d6d445c6d2b07d3944cfbbf77f0850411ac426d9d6c037c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579289, "uuid": "4f33ab77-48d9-438d-a8c9-35cf4591053b", "comment": "Malware payload (Formbook)", "value": "f73844f2fd89c797ad02d1868f63d145e471cef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579289, "uuid": "1d29d5fb-0fab-4dd9-8c7c-a71c1e076828", "comment": "Malware payload (Formbook)", "value": "48568cfb008e2cb554e53981597fb569255fe98886b043a3b45c4be5ed5b2dacacab1325bee3d72e25164cb50de9e898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579289, "uuid": "e07a74da-2275-499d-a3d6-fc28b8552b00", "value": "24F48C9C3610B6DFC85BC976CDA82C64EA6074B7931BD343A05712AC9D4EA9BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579289, "uuid": "8ffc1196-3845-4116-b889-6a31a9417b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579289, "uuid": "0a9a5b9a-70e3-42fb-ac7d-d766f4ca7e0f", "value": "12288:Ay4p3e7ftXMxtUyHmFk4gh954la0yc56oGe82DqsH5ORreQs4nxeiNRRhgad7D97:A9p6ftcLmF+h34la0yO1EuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625579289, "uuid": "0ee2a26c-440e-4d87-9efd-77ed8ff06d3b", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625579289, "uuid": "91dde7fb-de21-4cdc-b259-be0ddfef6ac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579289, "uuid": "460ff5e5-20d6-4833-a1e5-5259b884768b", "value": "SecuriteInfo.com.MSIL.Kryptik.ABUV.23831.19672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33dce12-ddfc-11eb-875b-42010a9c0053", "comment": "Malware payload (Babar)", "timestamp": 1625536351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536351, "uuid": "67b99132-6c76-463d-b98b-f5085b207d75", "comment": "Malware payload (Babar)", "value": "4525141d9e6e7b5a7f4e8c3db3f0c24c", "object_relation": "md5", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWGLOBE", "colour": "#8FB90E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536351, "uuid": "b39a04c9-b477-4ca6-af1d-9a69f789c4e8", "comment": "Malware payload (Babar)", "value": "aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d", "object_relation": "sha256", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWGLOBE", "colour": "#8FB90E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536351, "uuid": "92f15366-04fa-4119-9a0f-9d05e489531a", "comment": "Malware payload (Babar)", "value": "efbe18eb8a66e4b6289a5c53f22254f76e3a29bd", "object_relation": "sha1", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWGLOBE", "colour": "#8FB90E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536351, "uuid": "5106296d-f55b-4dfb-8b0e-74b5304d5b3c", "comment": "Malware payload (Babar)", "value": "eed6f4f336ff6aedd452718430f0bbd6a8153f9a6491b848f40a133ad6cdd29bbb7a0ad31a859dd8ab4f8f473e3e0dea", "object_relation": "sha3-384", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SNOWGLOBE", "colour": "#8FB90E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536351, "uuid": "db1b3833-cbb2-4b17-8055-5a6b3a654c67", "value": "C5D4BF22F580D072E16E12754146A77967A45F301B31488B7BE83FA8AF74DD2EF39683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536351, "uuid": "a51f3989-741e-402d-8689-f51effbda88a", "value": "caf7624af4696ebede0878f506c8cc01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536351, "uuid": "3f8760ef-4b21-464c-a557-b2a9e7049a5e", "value": "12288:SiTsYIHkC6xTp5SjYqwLTh8T4Ijx9xLIzLU5zCaH:BkkC6xLSjYqwLT6T4I9/L5zCaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625536351, "uuid": "c6fa1402-ebb5-486f-8ccc-e981549571c3", "value": 599438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625536351, "uuid": "2dc5ffef-17e1-4795-9063-01b4a6f0cfb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536351, "uuid": "745e0477-f1b9-49f5-bda7-41def7704d85", "value": "aa73634ca325022d_perf_585.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219cf12b-de06-11eb-875b-42010a9c0053", "comment": "Malware payload (Conti)", "timestamp": 1625540348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540348, "uuid": "73b7c2a3-9d19-4048-87ef-dc5d67e55606", "comment": "Malware payload (Conti)", "value": "50e767c614b48b05c6d6574edfcacb2a", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540348, "uuid": "bad147a2-c151-479f-af43-ca33da48cbbd", "comment": "Malware payload (Conti)", "value": "aacd1be17ca3aaca13d0c9f0366bcb28bdccd621cbde2f38b4a33321cba8a7df", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540348, "uuid": "48fd3fa1-054c-44b6-823a-b3282bdbd913", "comment": "Malware payload (Conti)", "value": "3550b898ce86982019ef380deb2f24522707d7dc", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625540348, "uuid": "9e627c8f-a562-4b6d-a581-d7bfd452367f", "comment": "Malware payload (Conti)", "value": "e17246222e80e7fff2d8e813f673912802aa272bcd937fd1bdafbfa3266719cbd07579fd19e5cd47ab0e086d4f7df34c", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540348, "uuid": "08e235f9-5b2e-45a7-9514-080ea35e82e7", "value": "7B9312500936B22490A541CEE2FFFCBCC57D06F286506AFB425F67898BDB553C507C8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540348, "uuid": "b0d437b6-d645-4a1d-9664-11fb4e826c90", "value": "1536:FuMjmNvaHJIElNd/jCJ+f7Mjy1c02D88n8giEYeaoR18hLB+OZPa0drjms2GC:F3pH3NdLq+jH1c0oHHPP8XXRTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625540348, "uuid": "516f70c1-404f-465d-9c12-244b99eb21e4", "value": 89295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625540348, "uuid": "f75e3862-6269-4cbd-bee9-2c2670943fdc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625540348, "uuid": "5d4a0a8b-6be3-4ab3-9a07-87e77005a141", "value": "Trojan-Ransom.Win32.Conti.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dc0921-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625587195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587195, "uuid": "9edf4f43-b100-447e-8e5c-fdfbae11e81e", "comment": "Malware payload (RedLineStealer)", "value": "d2ef21fc441259e3b20f219f069d7f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587195, "uuid": "a09cbb9f-c53b-4db3-a564-d85b2b3edaa5", "comment": "Malware payload (RedLineStealer)", "value": "aaea4c1675b81b7a478f9e451428c8d787748746df9255de1d832e4a4e01d4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587195, "uuid": "c3754ac5-b419-4d49-ad6e-e10900797e46", "comment": "Malware payload (RedLineStealer)", "value": "78628ff6660f4a31ccbe93dc4ee7737c88759fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587195, "uuid": "91b422d4-45ef-445e-a874-269bdbeef9ad", "comment": "Malware payload (RedLineStealer)", "value": "39143279415fbaec94e80e639c54abc11f4d03f620bb901dc8f596e37bd06ab6846e2f6da6addd136f3b1f149a9e318f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587195, "uuid": "bea56e7b-8597-43ba-828c-659d3548bc8c", "value": "7C54E1117680DC73C486D4344868D6B1AA3EBCB20D75A547B7983F7F5E312C2AA7631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587195, "uuid": "0d281308-675d-4ecc-b3ed-7c1f71e9c539", "value": "003506e6827227a38566737581b07dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587195, "uuid": "8e1d22f6-f112-42b3-97c4-18a6b41c0736", "value": "3072:8tDTTEjJdWwjOCzL2w9mpwDNrMySskWH4/qIIR6CfDf9abMW:8pekqOCzaKmpwmrsLY/qMq9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587195, "uuid": "88317a36-c014-4b77-bce2-3aae01651878", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587195, "uuid": "7024ba2a-0cdd-490a-a787-2bc6296437f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587195, "uuid": "991e9525-d0c8-4357-a9fc-6024a7306104", "value": "d2ef21fc441259e3b20f219f069d7f5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69681016-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625587283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587283, "uuid": "4b959895-7d8a-41e6-847f-ec197bb7b8d0", "comment": "Malware payload (DarkVNC)", "value": "c58cefcd0bfd422d0cc4025b524a4085", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587283, "uuid": "131c5be2-ea34-418d-8c12-3ef2909d6bcf", "comment": "Malware payload (DarkVNC)", "value": "ab7e6dc61621c75a72207bad8a4f3bb1f0a9f1feb515cc1cd3be01009133fc48", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587283, "uuid": "7ab5a353-4f25-407e-9db0-3fd73f59f086", "comment": "Malware payload (DarkVNC)", "value": "8f2d39bb7035ed3ec61b20ddb18ba9a5bff30f12", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587283, "uuid": "b6f40ae8-e969-482d-8c3e-521972174065", "comment": "Malware payload (DarkVNC)", "value": "0dc5c0a45e6b647bf585d2c2631fdce7f247faddb82ba858951598292cad9ab1dd2a6d818a6f3ca0107007eddccaa17a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587283, "uuid": "98717cce-85e5-44f7-8083-7d49333b6556", "value": "12252391B200C832C5958938A4B6D6619F3AFD162B271147F7A53F5B5E332C663FA20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587283, "uuid": "c9e742f9-5f1e-4745-b531-0495734c8af8", "value": "73494dd4a39acabf525622b024167d91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587283, "uuid": "a1fc2540-bbd8-4161-9d9d-3174ffae2105", "value": "24576:x3w8Uu0cH5pUAzvxlHa7fXKCimJcf0tGLhZthMN6QOxmx7:hpUuRH7lzXHufvimQ3LphKOxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587283, "uuid": "740baece-8c9a-455d-86c3-49d57744e510", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587283, "uuid": "6bf70554-930d-401a-8615-481cf735c9bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587283, "uuid": "80d611c6-810e-471b-9ee0-95917251621d", "value": "c58cefcd0bfd422d0cc4025b524a4085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b07c67d-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625550805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550805, "uuid": "cac1ef56-9e65-4052-8129-4a07e2d2be76", "comment": "Malware payload (Loki)", "value": "d989ee67e3c40a0d32aa0537ad831287", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550805, "uuid": "739bb21f-9149-466f-98ac-91e565456ef6", "comment": "Malware payload (Loki)", "value": "ac303880be592cbb6cc55cf71d2ab5600293f31676ceb7963bca2d9d65257ff5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550805, "uuid": "e39546c5-c7ed-4865-b5f7-bda731f5544f", "comment": "Malware payload (Loki)", "value": "b82b41ba2700d42487c7d77e927688b42c74c8a2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550805, "uuid": "b41df670-4c56-4765-9014-86c08a977d35", "comment": "Malware payload (Loki)", "value": "fb16b177e3330bb83685a1911f37ec6bad60e288afab964dc5ea37c7cec586c39467cea9806f3a1612215a25b00ccb74", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550805, "uuid": "5c64ba5e-2521-42a5-86c9-30368e6454cd", "value": "E35512C79B17AE11D4051379E24AA1221D6ABC5AD7D86463B3ECB33B1CFC6F946C0C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550805, "uuid": "4da8bfcc-2154-40a4-bbd4-8e2b3ed4755f", "value": "24576:D95RHUGIbmDIRVHqH1gC+evhrd6aq77a7qvTUHbd75ZIC0ti5L:D9nEbmDo981gC+evhJq77jAHbdAi5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550805, "uuid": "07990183-d5e6-4473-9c6b-339231767a47", "value": 1288200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550805, "uuid": "579f796f-c501-468e-8487-7f87a3cf098c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550805, "uuid": "2e63fea1-c8e4-4e80-bf7b-3bd591503d0b", "value": "PROFORMANew PO N. FM 02072021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b316461-de2b-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625556309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556309, "uuid": "f8d1f593-d4d9-496f-8bcd-c78d4ece02a5", "comment": "Malware payload (AsyncRAT)", "value": "2a949ab21ee139487af2e86509b59eb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556309, "uuid": "41e22d80-a53d-4048-a001-969dc7416be2", "comment": "Malware payload (AsyncRAT)", "value": "accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556309, "uuid": "368cca24-9290-4f78-9746-54bcede364d7", "comment": "Malware payload (AsyncRAT)", "value": "1321ee99fa8b68244a5a9776a4cdc30467ee470c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556309, "uuid": "0c987212-160b-49f6-869e-668d7665e049", "comment": "Malware payload (AsyncRAT)", "value": "7e46e51ec89ec4f1361eb85a95818e7537acffba48845f6bbe98df14d36638d4ad104ade501f6da61ac9de82a5ca47d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556309, "uuid": "4b2e34ea-4a1b-4332-a836-414f76e89389", "value": "F164D02A77919B52D45845B5C1E7553407F3AAC363B3E2877F8802DA0E127F88D8ABCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556309, "uuid": "749879d7-0f11-4034-8c47-45dfea3fbd41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556309, "uuid": "20313ae4-78c9-41ed-843d-c5551b1b108f", "value": "6144:zYrX+K/LK+3xoeXQutwX6iEbZXPn3C9fd4Bs5iiDHUUD9R/:z6bmeSxEbcF4BsRHUUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556309, "uuid": "5515d326-11e3-4877-b9eb-79270e168613", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556309, "uuid": "2f5ffacf-1e21-40ab-b90c-9a21d8eb8c7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556309, "uuid": "6b064adf-677e-40b5-bd33-36bc2723cc9f", "value": "2a949ab21ee139487af2e86509b59eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1aaaf6-de90-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625599876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599876, "uuid": "20fb7d38-245f-44a6-9165-611e138a409a", "comment": "Malware payload (RedLineStealer)", "value": "b74e2e6cadff6bae81458f654fe7c757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599876, "uuid": "cb19ab5f-dca1-425c-8167-c5126977cefa", "comment": "Malware payload (RedLineStealer)", "value": "ae2681f48a49d4f3f6effa370f6c83f2bdaa4f6976de4514a501139bc8579a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599876, "uuid": "a7b75909-f158-4a44-bda7-1daad3e7f46b", "comment": "Malware payload (RedLineStealer)", "value": "39b25106486ddb6e140cb75a179d71fda940462c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599876, "uuid": "42d4e95c-1fa9-4887-bf6a-c1aeba092ee0", "comment": "Malware payload (RedLineStealer)", "value": "44554e8da6bb44143dbf2e3914f72ee3f996cbfe5f5a6f7a3ca4b11e038a5e5e2a1f81c4cd40bda0e46785cd06914cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599876, "uuid": "1c1c5096-a59d-4504-83e8-260f53aeb082", "value": "8364CF503A90D432D79300305476D7E15A3ABC666E67898BF29D3F6F2E3329269F6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599876, "uuid": "42e7e0c5-9615-4e75-8904-b8cd3db0337b", "value": "da5446b036e9ca50ec91ebae60e40a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599876, "uuid": "1c3e111b-d8ce-4aeb-9f95-18a8f4babd74", "value": "6144:vzwFLyyMcIvnmiq8xPRxfIenOVmbSiDZsLgJZjDxiswa7Y:rwFLic6nmi9x56VFiiMJZjDxpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599876, "uuid": "28a92375-1415-4dae-93c0-6df9ec07b45b", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599876, "uuid": "691f777c-6f1b-4c3a-9d14-5f3d6ca272a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599876, "uuid": "2ee10ac8-0281-458a-bd2d-b7721d200def", "value": "b74e2e6cadff6bae81458f654fe7c757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c617fee-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625588469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588469, "uuid": "d095001f-f581-44e5-bc84-f26acecd9fdd", "comment": "Malware payload (SnakeKeylogger)", "value": "0b814a8194b65a324d229536c449a805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588469, "uuid": "942b5539-b381-4915-a710-5e278a6e8eec", "comment": "Malware payload (SnakeKeylogger)", "value": "ae593f20ea06c4527661426877be98fdb0bdf7cc0a7b07cb679167277ce7c996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588469, "uuid": "7ed88325-02d3-44eb-90e6-8cea21deb667", "comment": "Malware payload (SnakeKeylogger)", "value": "ba9d423e9cb89b36ad9d41a189469a03a11490a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588469, "uuid": "51b5d643-47e6-4fdf-8c4f-9e80d23a7553", "comment": "Malware payload (SnakeKeylogger)", "value": "dbad586a83aec87a7173bd35736b05f2be77a3f543248177c5e38757a91a46b8982382a567fb7573e8168c8392acbfe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588469, "uuid": "6c4b533e-fa74-42c1-855a-8c4a72099157", "value": "F505CF3D59BE1137C1BDC3B99BC88D2BF850962B7011BE7898D747A5470AA8379C213E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588469, "uuid": "4fdf2e8c-dc59-4121-bcc0-f41419afa9f0", "value": "3072:DlSqfUfxvs9pQre4mugvlxpuu3d7cTXKpoukvy7FITfxsezQgUXzIwbmOOcJ3Xd6:AqAx6p14t4OuqDum0I9s9gi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588469, "uuid": "30173069-e6e4-430a-b0cf-b963fea227e1", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588469, "uuid": "aaaca272-a76a-4a8f-acd1-ef1b5c6df1a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588469, "uuid": "b06f6a13-7766-42fb-ad7b-4a7eef067632", "value": "0b814a8194b65a324d229536c449a805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd1bcc3-de50-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625572122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625572122, "uuid": "938b1a3e-fd57-4bdc-b31d-227be2c2f8b5", "comment": "Malware payload (RedLineStealer)", "value": "88e85b7a234ccb1fd2d1dd6394a90ac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625572122, "uuid": "17ea4e8f-3182-444b-bb30-19b9559ce9ed", "comment": "Malware payload (RedLineStealer)", "value": "aef50fda005e037a443df81e3dbaa530c7f4d661bacb90f40f955647c1ab33fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625572122, "uuid": "e7a1ba67-04d1-4e84-acf7-b396458e91cf", "comment": "Malware payload (RedLineStealer)", "value": "6b489b90a4975436c2ecdfc0d9f203412290d8b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625572122, "uuid": "3170fb52-0192-488f-abf7-fb78cd36ce34", "comment": "Malware payload (RedLineStealer)", "value": "56ecde61b5a4fed31982e447112aacedb63e8eae14262772c3b6e5625a20e2e106acd56b2ce84c2b9c9d4c79be902c45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625572122, "uuid": "9587940c-955f-4b62-8314-a02ad14b62f5", "value": "F4E52AE26E0AF7EFF05619336CD28247E32E436500944AB7EA38387572C2F776285657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625572122, "uuid": "dcea17f8-b4c2-4dbc-a73d-9b3d93c99cfb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625572122, "uuid": "8c7ac5cc-aadb-44e3-ab21-c96d1e9cb4af", "value": "49152:iO9kbQbTM2tjJy6kPEmMru1TCstdTzKkgygdYZBDBUMdBSm:iO92sfjU6krM2EHeSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625572122, "uuid": "20c4f036-d996-4ba1-9b2c-17861ae891e1", "value": 3105432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625572122, "uuid": "f73de9f0-d682-40f2-b803-fa8819cd61bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625572122, "uuid": "0da7a47d-f448-41a8-8e0c-62bd32ffab6b", "value": "88e85b7a234ccb1fd2d1dd6394a90ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae5f630-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599150, "uuid": "c0b18fc9-2878-444f-a098-c8fd480acc71", "comment": "Malware payload (Mirai)", "value": "194b02473a221dbc7714e7935913d564", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599150, "uuid": "abb61e48-95e2-4c9f-ac42-427dde77b5f0", "comment": "Malware payload (Mirai)", "value": "af01b87b077d1f9ac5b0c9e492f2f786383c2e752501d3fada7ba18f2e081cfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599150, "uuid": "dc96a684-f05b-497b-828f-3dc443376620", "comment": "Malware payload (Mirai)", "value": "d91e7f2e352a1f9a981f7b7426af8f1dffc1ecc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599150, "uuid": "cba0b183-1a09-4335-8cd0-52574638b1e0", "comment": "Malware payload (Mirai)", "value": "fe68d5b1dbf95bd6c698c3339f84ae4e29eed5d38f70c9eaeb5f33862159cf4fe7663a42cff6da2db6fd93e4350c1276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599150, "uuid": "c1096614-5c74-4c25-8404-8e160420aca7", "value": "EFC2E164F197EDE4DF7F78303E45CBD63B415B883203DEE521A89F462A0325AF544A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599150, "uuid": "dd20769c-3e42-4db4-8345-c5286b9302fc", "value": "768:nWoOGKNfkPGGDjsRI4MtrvEvYBJY4uVcqgw09U:nWrGKNfc70RITrKYBK4u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599150, "uuid": "8b62961c-049e-4fa0-a2e5-6cf6c9274b0a", "value": 28072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599150, "uuid": "9668a9fd-49d0-4c74-bfc9-f883404f77ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599150, "uuid": "cfa623e0-136c-4e1b-adec-1dba2ec57d23", "value": "194b02473a221dbc7714e7935913d564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14184509-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625599166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599166, "uuid": "b8a0b820-55db-4a9a-99a1-4ae171d6c9cb", "comment": "Malware payload (Mirai)", "value": "9e1aa4f1dadfb20c2bc259c0ecb3cce7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599166, "uuid": "c218e3be-e144-4ea5-a550-29b323af4e27", "comment": "Malware payload (Mirai)", "value": "afd3087a81d7e3fe5040149654f27e539bbef43a208927d490ea4b5b52e8d5f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599166, "uuid": "ddfe8351-5e8b-48dd-84a9-8427ef434a19", "comment": "Malware payload (Mirai)", "value": "57db7e7bce847d22c0ee394b11f0d8570acb0844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599166, "uuid": "6f338422-1be4-4c61-82c2-4f5821714f64", "comment": "Malware payload (Mirai)", "value": "37097f14df20d54162171a147f66ad5b080f58b4013fdfb2f996ae428ee61685324d5f52f172aed7fbafcd552bdef690", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599166, "uuid": "b8409c7e-f3da-475e-ae33-1b4e08bfab60", "value": "5FD2D0AD110110FDC26B80BA4B596F4B3A500F675587EA22E38893C7FB714E52D93EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599166, "uuid": "90806d48-7390-4fde-8f66-7ada9f85f001", "value": "768:CVCKdGS7YGSv25mR12ZBz3EGknJgGlzDpbuR1J0:CVCHtvdSvz+VJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599166, "uuid": "cdc15f78-de75-47da-a5b8-daca24dfb002", "value": 30524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599166, "uuid": "a3a29109-2593-41c5-90ab-c3eb393d7ef9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599166, "uuid": "d4e794ee-8f6e-4fd8-9b50-cf4687636f78", "value": "9e1aa4f1dadfb20c2bc259c0ecb3cce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a095324-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625586506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586506, "uuid": "ea04350d-47d3-4308-98ff-c449d662612d", "comment": "Malware payload (CobaltStrike)", "value": "9a2e1bb9ad6f1ccfeaa4c2c55637ae3b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586506, "uuid": "a8f0ff26-aa51-45dd-936d-82bf4eefcfff", "comment": "Malware payload (CobaltStrike)", "value": "b012145b80d5176d73ed67924be9b1290d7920f05bf436f37deca4799b6d88b6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586506, "uuid": "5031c824-d330-47c1-8229-0d39922eb67a", "comment": "Malware payload (CobaltStrike)", "value": "d42d55cab8637f847efdc1a01bcd5bb2d4668b7d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586506, "uuid": "2867b655-7e9a-4b90-b66f-07be249fdbb4", "comment": "Malware payload (CobaltStrike)", "value": "0450a9211b46039106bedf0f19e4d400ee1e4f8e9723b03d8021c4510d1ccb35190800302642afead5f644f1fd1c03a3", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586506, "uuid": "6c614342-5c52-4a35-8b90-2ced82359f04", "value": "8C64B152BCC71F4FD053E639503A860A01ADA3403B17B64B97D6FA18F95B7B187A322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586506, "uuid": "0683bb53-dd6b-4077-9a61-e4504180ff84", "value": "333a822de49d764043e0a411543a23bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586506, "uuid": "22785252-1843-4a03-ae14-1f49c373dcd5", "value": "6144:beMJwKolm23neuhb0VIe6j0bdRbCOfSHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHK:beMS023eib6d6jSdkhUSeAeAe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586506, "uuid": "b3aa438d-78b1-4d6c-b4a0-a47c5dc5636e", "value": 328872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586506, "uuid": "428da90f-2dba-47dc-be8c-f9e9c71cf944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586506, "uuid": "a3a99489-e6a5-4418-b1d8-d5fe6327f431", "value": "klinch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245607cc-de21-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625551948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551948, "uuid": "49ece97b-1e36-45b3-92af-0d5c71a17675", "comment": "Malware payload (AgentTesla)", "value": "e771b036522a92c23b58ad1892f986f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551948, "uuid": "bd3df77c-8b64-457d-b5ec-e6892d092668", "comment": "Malware payload (AgentTesla)", "value": "b04415e5e272de7e3ed49858011f9cd780edd4f25bd428d2634f4a18637a4859", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551948, "uuid": "a72c67c0-a497-40a6-aea3-bbb977192448", "comment": "Malware payload (AgentTesla)", "value": "f8f46e18956fcb696c42ca06a81b65c270531c36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551948, "uuid": "9fcb3ee3-06af-42cb-901b-7ca80fee22ea", "comment": "Malware payload (AgentTesla)", "value": "9e76ea1033c61145082cf1097a6c033ef9553e69ba05e0063aa828745f1ae401edb0455aad40c62a05b4bc48933891c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551948, "uuid": "bdd49402-7dae-43a9-9531-44c25baaac2a", "value": "B7F433979016E8EDB6229519487BF4C037F22475E737A2A2C524982D3C78DAD32CB74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551948, "uuid": "9181f19f-8655-4bf5-8e39-468b84b0ffcb", "value": "12288:kNH0754eWZ5E9/t9RYy0C5kRY+YHBW8M+NcInp4tKSeHPwczv8BAeEAthFgVkhmp:khc5Iyb9V0e+YBM+9p4tPeHIczAAUSVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551948, "uuid": "ccb04ac0-d26b-4430-a0a8-e4474b8d9e4c", "value": 761124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551948, "uuid": "edc81b60-19c7-43f0-8a93-b7b8e0e22515", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551948, "uuid": "60f80c42-1ee8-411b-a59d-8ea26db7279a", "value": "soa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93b20f1-de18-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625548306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548306, "uuid": "924fcdc9-fa4d-48e3-a36b-01a97f72fb0e", "comment": "Malware payload (SnakeKeylogger)", "value": "107fabd45e1943d57f723b56fba91b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548306, "uuid": "c65cea3b-7ccd-4efa-b7aa-7a60bfb66453", "comment": "Malware payload (SnakeKeylogger)", "value": "b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548306, "uuid": "80bb0828-24d5-423d-baeb-0cc8b704c9d8", "comment": "Malware payload (SnakeKeylogger)", "value": "6aaa9b4a679d58064325a7692d4e40e1a867ab1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548306, "uuid": "82a7d8a9-ad39-435a-975a-8b76c2ba757b", "comment": "Malware payload (SnakeKeylogger)", "value": "92ced05c1b4fc06904ceaf4a2cc8323d2677973da8597c7d6bee6e465f4b81d5b327dee568b9f01e072dfdceeeb0e540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548306, "uuid": "b88bb118-f036-491e-b6ad-5b81a0132db6", "value": "94559DB16861465ADC6FCE34C3326E3C0FA77E79FD4FA6396944718B32A76830922513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548306, "uuid": "c22199c0-de15-40a0-a436-5a66379543cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548306, "uuid": "c69d2203-4323-439a-966a-d08613dd5ddd", "value": "12288:1O/Vj6NsBXOaDaDa60/vSCookFi8URVvNEscaSa9:1y6NUOaDaDapvSCoobz3caSa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548306, "uuid": "3abd63a2-e6a8-4a82-a630-5e4ebece9279", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548306, "uuid": "f61ffa37-8f8b-48a8-bb91-eb554df4732f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548306, "uuid": "ade90a91-d6d0-4334-84b0-bd4b9daec443", "value": "Saudi aramco tender documents-BOQ and ITB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24249481-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625552378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552378, "uuid": "7e94bd9a-39d1-45b4-bb63-588262833030", "comment": "Malware payload (Formbook)", "value": "fb9db53135cf8db178f54a1e19f5edd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552378, "uuid": "965b017e-296d-43dd-bc91-f87ef45b3f8d", "comment": "Malware payload (Formbook)", "value": "b120686883591f5a09157eb0fbfb502d4ee834ca717f9b77ab6bd9d0f85eb353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552378, "uuid": "78ee721e-7379-4af8-96db-d41f7625fae6", "comment": "Malware payload (Formbook)", "value": "b43c70a1dad8594383d5cbf47427b7368c43beef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552378, "uuid": "5d278e86-a6f6-43b9-aea5-cb4065b48c80", "comment": "Malware payload (Formbook)", "value": "e98e620cb364c5339dba96ef5695355082686a557cc912e9238b6ad6e65ab79db6419b9a497bc99dd81706080bc3849e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552378, "uuid": "76d2b04a-595e-4b4f-9ad8-226158868ef8", "value": "F2D46EE6B5618433C1325874BE5F86EC6466BF206A65EC421FFAB9485F3B1C0362F193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552378, "uuid": "25f53f60-1284-4e54-821d-1375f370d0be", "value": "f6a8e3ca52382469bf33257cc21a901c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552378, "uuid": "821e6e5e-d32d-466f-9308-c07a6e7979d6", "value": "12288:Cxsy3YEuqdey+vIYAUqHKqd3oVi7CczxteTlXcJ:CSyoEfey+vNAUqHr3oVi+creTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552378, "uuid": "063ff2ad-f3e1-4a7d-a7ca-8469f75f35a3", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552378, "uuid": "c8d958d0-f822-4aaf-9ac0-5deeef59988b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552378, "uuid": "3c1f386c-2622-4bf2-94c1-14e4c8fd6d15", "value": "Delivery Reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beeb7ac-de5b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625577033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577033, "uuid": "263c4ef8-f73a-4aad-a621-957bc3382659", "comment": "Malware payload (AgentTesla)", "value": "583eeab74c1587dbe05ea33d2b2b9920", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577033, "uuid": "99f4c40c-c8d1-4cfb-8efe-f6dbf930e4d1", "comment": "Malware payload (AgentTesla)", "value": "b12de6c75786e8445d5f49f65f89ed2f26c53110062f6131260a6eed69e71e62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577033, "uuid": "32bb11f7-2e5d-4003-b01c-d866a195774c", "comment": "Malware payload (AgentTesla)", "value": "3ab92a4433b19b64af2a89f8a6d8c50fa8b77598", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577033, "uuid": "16507c51-ab89-40f9-a053-4c2beb7fe8c0", "comment": "Malware payload (AgentTesla)", "value": "58364f743d01d283d9fe31f07dcc13161c0a3233bcaa3f5252b35aa0432d43d416ff31e9878caef7117ca582a11e1bd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577033, "uuid": "66872025-ac75-4bb6-8d44-c926242db4f2", "value": "DEC4AE52F341166EEE163BBA48179D3401E29ED76533E31E29DB37A50FB33860627A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577033, "uuid": "dcff93f0-5f8c-4c82-961d-c2ebedbba4aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577033, "uuid": "783d5173-787f-4ab0-a618-fab485d16015", "value": "12288:Q9IGCH+n1eGhSVb0nzFgyOnWPOa2z/ZDhOOqj41K:QKxH2cG6qzeWWa8ZEOo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625577033, "uuid": "11a1e640-afa9-431b-a3d0-ae69409182ba", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625577033, "uuid": "56c09811-56a0-4ee9-898a-67701cb0f001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577033, "uuid": "83af4479-a59d-46ca-9af2-687460d7fdb6", "value": "putty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afea30c1-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625586542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586542, "uuid": "5bc6f090-c725-4e2d-b8c4-866154b73f88", "comment": "Malware payload (Dridex)", "value": "e5cda272601a8aa0e57a89f8fd529c32", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586542, "uuid": "929ee5b0-281c-4c50-b551-5199f655f196", "comment": "Malware payload (Dridex)", "value": "b276fe5d9dd0b7a5313d99533aabe325b42f0dc2d3ea01ed0f8ae1b5b691209a", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586542, "uuid": "0720ea86-e993-4eb8-bcdb-319068191a55", "comment": "Malware payload (Dridex)", "value": "2bfbb60d009b245c2094353e7561bcf538dc9dc0", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586542, "uuid": "7821ba6b-a8d3-4e0a-a098-59dffa8a44b3", "comment": "Malware payload (Dridex)", "value": "14e4a50523450477981c553ee2f80c124038f69fed931a318725d53fbdfdda7f18a711528c22247460193e230235fd9f", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586542, "uuid": "04cc6fd7-60fa-4d19-b2d3-79532c4bafec", "value": "0D63BE10E79608B7F1604078F2251B932949AC3BB000ED5995DB740F678BF762EBEF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586542, "uuid": "4287249a-34c4-4fd2-b06e-50ce24a529ef", "value": "1536:Skh6RM2sRQv+3em7pZPtg3eLmsqU44444444444gVs:SkhNE+3e6bY4VLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586542, "uuid": "99f9a986-058e-45bd-952b-1b1fb8b92c6c", "value": 68831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586542, "uuid": "f305d874-3339-433f-b2f0-a474b2fc1141", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586542, "uuid": "2415bb67-ab84-4c9e-b22c-0085a6fc3431", "value": "Reciept 005462.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df42c375-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625550974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550974, "uuid": "41600b87-599c-499e-807c-69718de02618", "comment": "Malware payload (AgentTesla)", "value": "041ba70859a90dabf3c3cc142b70abe1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550974, "uuid": "9afd8464-0360-4291-bac5-bf4fc0eb829b", "comment": "Malware payload (AgentTesla)", "value": "b27948abdbb791a45166afc7cd0291516aa5a197bae12c487cf12e82a4d47e23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550974, "uuid": "c658cce8-2e3a-4b76-a3ae-dd9b3571f2e5", "comment": "Malware payload (AgentTesla)", "value": "de48e52804b7d31e2fc6ee491ba5a153f5a5e1fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550974, "uuid": "3628d7ca-bfc9-4e03-b273-a27209ad27dd", "comment": "Malware payload (AgentTesla)", "value": "efb515abc3e0f44aa0a1f52d90a25dc7f8432c4e0774bc562dfe35b216b51d01b3ef4fb1e91ce4c33705722de6501ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550974, "uuid": "9a34ef6a-e04c-4389-be4b-688e235fb4df", "value": "9345120C57F2FF96D2078C7D1B2144B676A41E1C3898760B36247A822D7A1A7E37678F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550974, "uuid": "349a6271-a81e-4504-a067-9f3a9a047d23", "value": "24576:X/UbCD5BSYL+4QZrhUIexruiO0IvMDpsd06Uz05n8YLQ60:cGEhZ+yiDIas60ik0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550974, "uuid": "623be02b-f3ae-4f7c-8d3c-689b3d9198ae", "value": 1218568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550974, "uuid": "4485dffc-650f-45b5-b782-d4cebfbbabd5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550974, "uuid": "3ebc1cb5-ed7f-41c2-8dfe-73b332c6e0e0", "value": "Doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33859846-de2f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625557987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557987, "uuid": "bd6a46a3-42e1-4648-9c3d-629189f74b50", "comment": "Malware payload (SnakeKeylogger)", "value": "22e97bbfeb68921f0258f7ca484c426b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557987, "uuid": "c17f9442-b780-4781-b95a-ff82bb0374b1", "comment": "Malware payload (SnakeKeylogger)", "value": "b2f77c882bdce0ff80269d0d2036243227eb3ac3bf3fd6d848c32b80df820337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557987, "uuid": "57f027f8-7bb6-4cc8-ab54-2f91c8e2df32", "comment": "Malware payload (SnakeKeylogger)", "value": "a81d9d5e0419cab8126b7bab8fcb2a47b88acc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557987, "uuid": "2fae5ce1-b1ec-4a20-b302-e467d1ac2fb9", "comment": "Malware payload (SnakeKeylogger)", "value": "2009ca8d6582eacd6ca078d3b04d2230f204c92db52f06af31e5a49ec3ea8ecc24757f4e9c178145f82885a2379ca89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557987, "uuid": "8aa76e94-d245-42f1-b46b-e65e6bf89fa2", "value": "37F4297D60F64BD1EDBFC73C2FB1751C2FA9B666920AEE786D8874480080B454A7252F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557987, "uuid": "27984175-f391-4eaa-b39b-50ff901c5f26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557987, "uuid": "1c1d709c-0405-45f6-b31e-bd1d67700e48", "value": "6144:1Rru3q2yTP6NEdrB5LH9i6hFSs9lf8uBkOur74r0DZwHZqm4MihtAZAUfGnZBzAt:1DP6NsB5MiRPfDfi77DZqZ54OZxGnZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625557987, "uuid": "71d1bb9b-6cf6-4408-81a7-d07b40828f2e", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625557987, "uuid": "0699edf1-98f6-437f-8d73-ca9076106c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557987, "uuid": "ffcab41d-55ca-4216-a6d6-8ca476bfe12a", "value": "INVITATION TO TENDER NO MAT 021 PJTS 021 FOR THE PROVISION OF SUPPLY Instrument Bulk Material exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1819f0-deb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625614752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614752, "uuid": "09ceda8d-4099-417f-a224-fd4363167648", "comment": "Malware payload", "value": "b906cde8a6d1466286de93d7980ad26f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614752, "uuid": "2ab7edbf-b13e-4a72-ba24-34f53416cd16", "comment": "Malware payload", "value": "b460c2d7f89eddf813a533e5f4259565ccf761c231541b2e5fa5afc5d0a4f1ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614752, "uuid": "f4a69593-28fd-4b7e-a98d-845b0733a916", "comment": "Malware payload", "value": "ac011e1a1097de32713825126f991ee239dd3a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625614752, "uuid": "3ea84c70-ad12-4425-b17b-286bbb3eec2c", "comment": "Malware payload", "value": "26d01bc73777b63468bc3520baf238ed1b15c0ead5f2c921a1186de062e1650c52fc9967871af92e3964cd5cf1f8055f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614752, "uuid": "b40fdb7e-fa78-43c2-9446-50a9dece8351", "value": "B4D633549F87FAE3F8524930868673FDA0D77D40AE850E42E6517BF419B0CFA94C2A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614752, "uuid": "57b1f611-e4ee-4f44-a9dc-e27b482bb1de", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614752, "uuid": "a909cdc2-b1d4-460c-88ca-95e8e072b8de", "value": "196608:DDFuUSb260q3z4gh8cjs0MhV6lbTuRVlaXYTgn+/8wEwZQUiDMmUS7sR:FuULCz4g56V61TuRaIq+EVQmUSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625614752, "uuid": "74095d49-640f-4ec5-a160-3abc61e19a9e", "value": 13097743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625614752, "uuid": "3ef928b9-ae06-42f1-8c46-2e368255f151", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625614752, "uuid": "7d019d1d-dadc-49c2-bfb2-df2d9b020127", "value": "b906cde8a6d1466286de93d7980ad26f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd7fa2-de9b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625604581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604581, "uuid": "90340e18-ec24-49a3-84a7-d30afad6d729", "comment": "Malware payload", "value": "c95153957b1c2bdcb44c363236eb07ec", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604581, "uuid": "a5159334-7b63-4365-8892-0f693962d99d", "comment": "Malware payload", "value": "b4b02db600f9d7efc81af1b980b908cbfdd73c7b138e1b39990a8e5a847f1f6f", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604581, "uuid": "6a2c06c5-ed21-4a5c-86d0-5279d0af0ac9", "comment": "Malware payload", "value": "309d401a0eb026f37d2e71e128f3b8e78daa9ec8", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625604581, "uuid": "0c5f0565-4486-47e1-98da-22379bf709c3", "comment": "Malware payload", "value": "48e7d1358bb581ca0d8d20be62b0979b0873430ee2efff0b7867c6df009d0756dd9cf27ee53336ce06a31c175ef50bfc", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604581, "uuid": "59a0802f-35bc-47fb-ab35-f6a0e4e17903", "value": "C3353C97AA5721F1E4BBD236C692752BBA7135214734D7CB82505A031B63BF0AD3E38C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604581, "uuid": "7333a747-63bc-403a-bf16-3cb1536bb07d", "value": "a301e5532d94d4aaff8bf8bb9eefa603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604581, "uuid": "c2822481-f402-4317-acb7-304847109a23", "value": "24576:N8SPP9lZe2BHtDSqZBEFTEdO0rXeVmPlSGQ1KKDiZsbKL2x:NNJHtuqwFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625604581, "uuid": "298c6ffa-9e29-44f6-8528-669074ffbcc2", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625604581, "uuid": "b91ba684-22ed-4b8b-bf17-5c2d20fe403c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625604581, "uuid": "9ef51dbf-4692-4121-b532-822822cf8df3", "value": "E00E.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d13f92e-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625586511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586511, "uuid": "77620fde-e18b-4ad9-968e-3afcfefbf5d0", "comment": "Malware payload (Hancitor)", "value": "9a3f74a7a051a03a434247593d8ed747", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586511, "uuid": "c811684c-0e74-4573-a651-1bc34f7c49a7", "comment": "Malware payload (Hancitor)", "value": "b55284924181f69bf59527ac2b7a5397c35652c799c037a3e94d492d412f8c9c", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586511, "uuid": "22b8daba-b852-454a-b2e2-a6b3c5491608", "comment": "Malware payload (Hancitor)", "value": "58f84cb979f0f70cd91d98a254ee1c4fd0c8dcd1", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586511, "uuid": "1bbb6319-0a09-40c1-927f-612022d42bc4", "comment": "Malware payload (Hancitor)", "value": "0098fcded6e054fff51ca99b43e029a3abd39c56e07b44dab6ac632ee7ef31812d3e2c837c796679d7f3eb5024cdf3a2", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586511, "uuid": "9c50df76-1496-4da7-baf3-f275b3d73e06", "value": "1D15D000B980EA71D5A352764F76E685033CBD214B64CECB339C374E5F3A5E26A357A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586511, "uuid": "78c3e792-6c2a-4077-8c92-7cebcfd0a15d", "value": "24576:YEIZ4wA74D4SQKxZcy8gthDWw+pimUI+:Y+wJD4QZh/q50mUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586511, "uuid": "b0160da7-28e7-4a79-be28-c4ce7cd09e23", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586511, "uuid": "80b2a66c-bf0a-4b2d-ae4d-7a48e7cca698", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586511, "uuid": "9bf4a593-d960-4b8a-b7c7-b39e45aaff93", "value": "0706_1715044809783.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404e0bfa-de6f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625585496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585496, "uuid": "c98d250b-7389-4768-8395-c95fd6f26520", "comment": "Malware payload (AgentTesla)", "value": "d5a17b0f2cb637aa39d493b331ea00b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585496, "uuid": "42087931-0a98-4884-9565-b63ba7e3be7b", "comment": "Malware payload (AgentTesla)", "value": "b59c23b6613490950e23d61799144b6298fc6ce96545bae5448c6a08c0521483", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585496, "uuid": "b695ac86-dd04-4b1a-a3f1-848c92f93a4f", "comment": "Malware payload (AgentTesla)", "value": "7a0d5d5a228f3dc7f54f8fe185e0c6f9ccb7e6e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585496, "uuid": "6fd7a621-0b6d-4cd8-bcad-c03d3b929af4", "comment": "Malware payload (AgentTesla)", "value": "bf682bd13b8f1405a99bedb23e399929ee5dc321d6844d10a521b8bb3a69c52722b2d27ad1d5f4d3c7d12b68b33f23d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585496, "uuid": "67e184a4-d09e-4d2e-a76c-d334905afdf6", "value": "DA159E7661768F92EDBFCB784735251C4FE9B376D34BF6B82C94A49904C0F404A62A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585496, "uuid": "d08d84df-79d4-4e72-97cb-c557ac9469eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585496, "uuid": "b0f5ce60-054d-4b03-b6a8-41af9f0863d9", "value": "12288:adK8D/v6NsBGD/F08Sxyeu1EhfCinWjCGGxO4dPydnugZYAse2tYB0vtpCJkZN:ad3bv6NpYy2fCZWbzd1g8DvCJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585496, "uuid": "a08deeb8-3af0-4f4f-823f-09093a27a8af", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585496, "uuid": "06b86b2e-410f-4e32-974a-c9fed4d5f253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585496, "uuid": "262725c4-35b2-4ce0-86c7-3adadc0ab299", "value": "Proof_of_Payment_IN02839220.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcd18ee-de25-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1625553686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553686, "uuid": "014dae41-9b0d-4343-a249-6a60be98746d", "comment": "Malware payload (Cryptbot)", "value": "21fca99111528d348e8033762f30915c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553686, "uuid": "e73abcd8-68ca-412b-a272-5a176286920e", "comment": "Malware payload (Cryptbot)", "value": "b77abc419db8258e26e4c40b6e8736a537c77e6343b34aec953d790b0332b155", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553686, "uuid": "b3d6e643-1520-4602-8a92-b5179e60a86c", "comment": "Malware payload (Cryptbot)", "value": "dc3fa24560c80ce767e81259606fa7cea5aca1a6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553686, "uuid": "6efd6f27-175f-439a-b799-8f30b94e724d", "comment": "Malware payload (Cryptbot)", "value": "356d3409a0d5666b1c4ec7d019512cf38687a5b1bfa87e4654c0d822d2d762687d36a99e063761649657ee023d96a664", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553686, "uuid": "22b28d95-bc67-429a-9c25-70d313719a05", "value": "02930200B415BF73DDE293F1C4E4CF656612AE6EB3DA00501D7897D2A3625E81BAC725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553686, "uuid": "4378228b-c475-4b9d-984d-3779f97f9b35", "value": "1536:JM4GmJgzMgUH37QW5pblCxoQE7kVH9g5nQr5z5/7b14nWxr4K+CQEMEq74BM1usQ:JM4Gmg9C7QW5VoxZAmH9g69zX4n8r4ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553686, "uuid": "b7a6caa3-1271-489a-b7c1-889ad357bc99", "value": 96738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553686, "uuid": "3530d6c8-4065-49c5-9631-c4418688328c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553686, "uuid": "be0951ed-dfd3-4bf4-b003-ed9c3852571a", "value": "21fca99111528d348e8033762f30915c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcd268a-de6b-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625583962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583962, "uuid": "73c9dd5e-b58b-4a73-9fa1-94f2bbb0ba3d", "comment": "Malware payload (IcedID)", "value": "e0d3214ff37a8a28babb83c90db540e8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583962, "uuid": "f8d57e96-8a49-4847-92bd-0b1807be7044", "comment": "Malware payload (IcedID)", "value": "b7c18213b34bb408434dbfd34b2719b17193ce695819d8b798454d38010ccc89", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583962, "uuid": "c08dfbcb-28ae-448f-ab4f-a5ff45405c7c", "comment": "Malware payload (IcedID)", "value": "ceefb39c44d9b761d548722d87985c524a9584ff", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625583962, "uuid": "449b04d9-b63f-4de5-88da-4908bdb9287a", "comment": "Malware payload (IcedID)", "value": "3a52d6f55390f75e9465201f5120d85f1ec1d82765c20d981e22fab655bf6167a2f4b79a7e997791f646d7ab58914807", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583962, "uuid": "55a86a19-f9fd-4cae-bf01-74ad72cf6cc2", "value": "4D040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583962, "uuid": "aa18cd6e-b50d-433e-86df-8a5f0c6516fb", "value": "3072:sDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:WRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625583962, "uuid": "b0e0b11c-78ab-4405-802f-dd906445adc2", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625583962, "uuid": "9b948f08-c9dc-4363-babf-f7ebe00de04d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625583962, "uuid": "0ab6bb74-d26c-4b71-9fd4-c25d3934857e", "value": "Schedule-982347-Y6844315.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4925dc-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (RunningRAT)", "timestamp": 1625587238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587238, "uuid": "b7e29bdb-398f-4353-9a83-0dfae0c0fa3f", "comment": "Malware payload (RunningRAT)", "value": "17f4e8ef4e0b821ac222dbf1dab08889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587238, "uuid": "b1533c82-74ff-43d0-9ef2-5a42daff2cbf", "comment": "Malware payload (RunningRAT)", "value": "b82c510a4e89d91316acab7f61ea599a4ee4ef7ccde2ed71cd46fa9875c0639c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587238, "uuid": "9db8beab-9b3e-4390-9136-c70744362c81", "comment": "Malware payload (RunningRAT)", "value": "e6c5aa708c9787e84ae2894de4abc8824bfa97eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587238, "uuid": "3532ada6-5a4b-4e29-bc6d-e59d4b117c88", "comment": "Malware payload (RunningRAT)", "value": "cf541569060ef0cacd89792aba4b1c83f067a4c0827922542699ad04c514797899d28ecbf6863dd7b7b424a99a872447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587238, "uuid": "73e7a12c-8ba8-4b90-a232-0a5ebda5bc17", "value": "15B3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587238, "uuid": "e80fb50d-d7b0-44f4-a53d-938e7651698f", "value": "7e3107c64f6a7a76d8463e3f374f74af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587238, "uuid": "d8fe338d-545c-4541-9b2b-d101192a82c0", "value": "1536:vqEA70HzLJksPEOajozLElnqiO2ldJ/tHi:vXTLJkQ7zAV3ltC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587238, "uuid": "e3fe3dee-e098-4292-88d0-e28d1d6b3b74", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587238, "uuid": "d49fd7bf-63fb-437e-a98d-7a9e25980c48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587238, "uuid": "59c32d95-cd21-489d-aea1-79a46d762b56", "value": "17f4e8ef4e0b821ac222dbf1dab08889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589f0a39-ddfd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625536574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536574, "uuid": "12627cd4-890a-4336-afc2-9a5777bf30f8", "comment": "Malware payload", "value": "f6f1795304a9622c750a9110763e3751", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536574, "uuid": "3d08b279-de9a-4f7f-8e49-287c020b41e0", "comment": "Malware payload", "value": "b9419212183e9e1f580d0de9dc600ee6bb53be32bb4363b8ca06631f040d228a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536574, "uuid": "3fb8f02e-c361-4c49-ad4a-0de2d9d78dba", "comment": "Malware payload", "value": "cdac281008e396c91984776373a63e28c88f0df8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625536574, "uuid": "037c5cd4-f677-4ffb-8be9-e1d126f537d4", "comment": "Malware payload", "value": "b46948e0bae4b980cc9a2f087e8053539a08ae66aa514af32e836e8287e20924e5bc6243b17201c2b879f51d7dabfd41", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536574, "uuid": "6d4a8b89-2335-46b0-a55c-1c7e0d776761", "value": "BEB5C121937639D8EA77A3BFA5E94FD08111F4F4E008DA2B237C2BA55ED125931B3943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536574, "uuid": "0af560d4-c8bf-4436-99a5-8977956a3693", "value": "49152:v9lHY5AEbTy9U9tSVdjh97eaoOHywdlX5SFkH:zY5AEbTy9MqjP7e2llJSFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625536574, "uuid": "6b63f1e4-ec1a-4223-a13c-252f9b275aa5", "value": 2494464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625536574, "uuid": "dd3147c1-44f1-4e96-9f6f-977ed7086d68", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625536574, "uuid": "88e1512d-0c6e-441f-8cf4-71612f6b278d", "value": "GDTGz3GXCiNgYwtXT6qX3tY8eu8Mqj.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1d71e4-de57-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625575154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575154, "uuid": "1eea922a-d963-4db4-bf91-fd5aa0008c61", "comment": "Malware payload (AgentTesla)", "value": "2e7a384da87ba38636a2d7b06debddaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575154, "uuid": "ddc27873-c5db-4350-88a2-0113819047ed", "comment": "Malware payload (AgentTesla)", "value": "b94319b3e68cd50dad3f1f6b4b00081a59427eb0cf8b3c1be909db7d57066de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575154, "uuid": "606f1e01-d4c6-4f94-abd2-e7e42c070d7a", "comment": "Malware payload (AgentTesla)", "value": "8dacdc23b78bbfea79b10c7e5bfadb87f04ec51e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575154, "uuid": "9360af5d-bbfd-47af-bee7-91e1d70a8ac8", "comment": "Malware payload (AgentTesla)", "value": "2cfad7dd1d6b87c9d959a92fc932bfe8d396c254ce7f17a6a593622d2bff469e40da1400e1f234616ed6445919a255cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575154, "uuid": "9dc15d65-ef7f-4436-8b41-f4dea16935c9", "value": "79058D9C3650B6DFC86BC936CAA81C24EB6174B6831BD303A05712ADDD4E99BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575154, "uuid": "1d152d68-0396-466a-b95b-37408b579a8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575154, "uuid": "7a1c47d5-7958-4bf6-a62e-6f11f2b8c3a8", "value": "12288:9WG1nBvmLxalz6kXtpwRm+aVw6gBai5bHgRtXZNyQr75lVvKGRyF8psbiMUM:EGLu9EWkdpwOGBRbAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625575154, "uuid": "c8bab2aa-d613-4bdf-865e-c3f01cfd3a8c", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625575154, "uuid": "c8b416c3-bc31-40c5-92c5-973f7b718b0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575154, "uuid": "64568cc5-bc1e-4f35-8586-d0216300d867", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a85865d-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587124, "uuid": "b3213287-1c7b-458d-bcb5-2a479ae361b3", "comment": "Malware payload (SnakeKeylogger)", "value": "7967d58ccacabbb7dbe741615b8ad0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587124, "uuid": "fa002440-30fa-486a-82e9-9da8ab02da38", "comment": "Malware payload (SnakeKeylogger)", "value": "b9acd58a25a9493713c0b5a3be62db4338de550aad1b23054d4be3de0c1b0c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587124, "uuid": "76ef0055-c995-4fd4-8201-d3e05d714658", "comment": "Malware payload (SnakeKeylogger)", "value": "e7f1340be29b511c000d4f15437c3bf969320558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587124, "uuid": "5324d6da-32aa-4f49-a5ab-1ab638963140", "comment": "Malware payload (SnakeKeylogger)", "value": "a0e141d51a3c927e068e4c7e1f4c999b886d94e39a915674e2b472cd0cc4689d62690212e08d18269517cf68a18d3e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587124, "uuid": "f691d0cb-fc27-4044-a37a-64f1b216483b", "value": "44C3195C6BF89C00E6FF8A3705B25120C776B8410AABCE5D0AD1F868193DA909D57FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587124, "uuid": "c8e79dcb-28ae-4ccd-b344-08378cde83fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587124, "uuid": "81210973-4df5-4f70-a9ba-400aeeff90f2", "value": "3072:0qKsT1oyor2Z1iDJv9ISN1QBbStwBkSH:Oc1i9v9XNeBbkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587124, "uuid": "59d0de1e-03d1-4663-aff3-326ee0d69655", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587124, "uuid": "9d9df810-31da-437d-b520-a72cd5973a59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587124, "uuid": "a75492cc-4382-417a-ad6a-2ca0ddef15d9", "value": "7967d58ccacabbb7dbe741615b8ad0f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cebf53-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625552644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552644, "uuid": "c43215d0-04fb-45ea-b89c-c9d948165c8b", "comment": "Malware payload (SystemBC)", "value": "9f2cc4d1d0c599bab186692c518d3193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552644, "uuid": "a5a01660-9031-443c-a0fb-a29b8b374d6e", "comment": "Malware payload (SystemBC)", "value": "b9c6bfa4ad09302620dfe9c7edf398cb3a6249c7cdd8d9be61395d857083a3c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552644, "uuid": "6198f7a8-7347-4aa3-8b3d-d7a7bc57580f", "comment": "Malware payload (SystemBC)", "value": "968c9f9a7829c77d8d9553accb9dbd9ead717386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552644, "uuid": "9a3b7195-ef24-4241-8537-0840b4ede5eb", "comment": "Malware payload (SystemBC)", "value": "7787a7cfc1b736089109bc321cc9f9b3400dea5545924618ece493283baea86d0846972cef8137ceb20baf774a1c6bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552644, "uuid": "adf0a391-00d3-4018-94bb-34a31a847e98", "value": "E5058D32F2814837C573363D9C1BA758A83ABF112B3CA9866FF51D485F3A6813935297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552644, "uuid": "e81f6c97-7a80-4099-9452-18da004a9ecb", "value": "41e286bd81e15d36bb9bceeebfe46ffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552644, "uuid": "0b4d4274-d082-4ae6-bd0b-cb8d478b7b49", "value": "12288:mGpmnrfAsq3NCRRi57t197JQdQ97co9JWPXa+LD9HyrUG8CINA:myarofgRin1PQGdCPXa+LD4UG8HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552644, "uuid": "9ccfa725-0543-471e-80c0-aa431298f821", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552644, "uuid": "f18cb75d-df4b-49ea-8ffc-625677c18c72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552644, "uuid": "a8e77921-fe21-4439-a5af-753ba1ceeb38", "value": "9f2cc4d1d0c599bab186692c518d3193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49474fb8-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625549433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549433, "uuid": "f0bbc22c-cb27-4bb8-8fbc-df1421118f23", "comment": "Malware payload (Loki)", "value": "f7a4093f507a1ceff7083d879c0ab891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549433, "uuid": "df2aaeae-ee10-40e0-ae61-90386788eaf0", "comment": "Malware payload (Loki)", "value": "ba7b7656757c62f9ef34daef6ea2bd6b71c1cb260b6c62b8468c4403974a74ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549433, "uuid": "f7f1ad71-e40c-482b-bb81-1864aa7891b8", "comment": "Malware payload (Loki)", "value": "12046660a64dc349ae8d949bf54ef37b640dd362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549433, "uuid": "564b2715-d7d1-422e-93b5-ab8e3d18d5c2", "comment": "Malware payload (Loki)", "value": "dbc25251daf9333d15a44f02dc278896bd34bd28ba3072e3213872e3c4a88114e8d6635fca4f0aa3ad9c431af109c8e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549433, "uuid": "df560d1c-d72b-4387-aff8-6b68be2bbea3", "value": "8CE47CB961764BA1EDBFC7380331251C4FADB37ED21BF6B86D98B18805D0B450A92937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549433, "uuid": "7dfff2f2-ea4d-4248-98d1-9e8cb1542f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549433, "uuid": "ca3eeaf2-cac9-40c2-bf18-1ef7382ad29f", "value": "12288:mCJ9P6NsB6wh2qt4d5vI52KpaR37XNw6yZAM:mCXP6NxaBt4d5rLdwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549433, "uuid": "603682f4-f361-48f5-a3bb-77f96c279652", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549433, "uuid": "a7cef404-0b84-41eb-a9a8-4fa50b046cbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549433, "uuid": "426b3852-fab1-48eb-a3d8-547277d0ddd2", "value": "IV AND PL PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e2179e-de1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625549748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549748, "uuid": "0247225a-3d4f-4c0d-b269-f16738410f69", "comment": "Malware payload (Formbook)", "value": "6f03bc5364c9f214a25c864c616c4584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549748, "uuid": "a695f354-6d1e-43a2-a449-ba7588f513a4", "comment": "Malware payload (Formbook)", "value": "bb3002323c19a3a72856de6ab2de6ae3de7fd081ed6facbef44ccc6c1ee68080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549748, "uuid": "2f4e1840-b8f4-46dd-90e2-e2bad91aeba9", "comment": "Malware payload (Formbook)", "value": "c52fdbddc78f6b9a7d7b9c15e6d62a3d7afef3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549748, "uuid": "c84abd1e-34a1-421a-99bd-b4bcf4f7b678", "comment": "Malware payload (Formbook)", "value": "543b5bd9ab8c31230b944f16b5cdf821c42d5584b57093ef23f4240899db961299fc9aae5ff0d807087222f103b75c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549748, "uuid": "76e722dd-d558-4a2f-b3e5-bd46cb593ce6", "value": "E2C4D02B739666EAC0094D3645162DCC02F0C5176232F37F3CDA26E4CEA679E6B1B617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549748, "uuid": "182f384b-676e-4450-b7eb-b91a1b52d0e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549748, "uuid": "0eb7e37e-2b53-4cb5-a394-f928ebe88d9e", "value": "12288:adGQ11eGhSVb0nzFgyO7PYvm54bsTwrE8hbOz:4GkcG6qzeLYmSt4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549748, "uuid": "befc7b6d-18c1-4dcd-afeb-63958cdaa200", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549748, "uuid": "6d995326-9dac-4ab2-bb92-137a3f8ee29c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549748, "uuid": "18b87c98-17f9-4668-aed2-deb6c1d70bd6", "value": "MT103_20210701084_USD35,660.93.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fae6a8-de5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625578097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578097, "uuid": "974f4ecd-cfc5-4e39-b766-207d7a2495f8", "comment": "Malware payload (Dridex)", "value": "a8246e0d24f8ea3e862a1ee5e2e92e7c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578097, "uuid": "a5d03409-a235-4b00-9574-74028db3c411", "comment": "Malware payload (Dridex)", "value": "bb7ffef0ebd06f1ef21d12e3c35e0794df93f8ec157b422f2f67f7b6449566c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578097, "uuid": "132a3d3d-40da-4ff0-be21-758d4622e68e", "comment": "Malware payload (Dridex)", "value": "9087d4623328a9b9d833d37b093803259ff42597", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625578097, "uuid": "e75541c6-2f02-4113-9aa8-6965527f1ecb", "comment": "Malware payload (Dridex)", "value": "74ff90c46f710520df052c99b83423a8d2419bd9e1e6c2b2d102c583f9f6c6cd43a060565198db5dd11ff5f22867f689", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625578097, "uuid": "f1b56f3d-4d78-4166-9c68-1a47d7838441", "value": "8A9422D4F9FBF833DECF117BC1801B5E06A5465A43DC593BE731B4ACC988E265218A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625578097, "uuid": "fe5866cc-9f17-4314-8c59-47aad31b0736", "value": "6144:fCRpA9B3ucmEb2cc7xcWwY56KYw/pLLFWkv4yysqYJyIYBCnGEM9b0ATEU63:qRu9lPzblcNLwYAKtlLFWqJ1YBCXrUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625578097, "uuid": "4659bcb1-1ddf-4e70-bbe0-bf93d041dfd5", "value": 412286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625578097, "uuid": "9268b98a-6bdf-4c6d-86d7-b70d2c6330e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625578097, "uuid": "af2472c6-1310-418e-b312-a953c5df04f7", "value": "Reciept 19129475.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacdc1d2-de4b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625570267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570267, "uuid": "10944e01-e30e-4746-a0f8-85a32a692f9e", "comment": "Malware payload (AgentTesla)", "value": "2e8f1b31c07d8e28b6a6835f790771b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570267, "uuid": "1ce816ae-4220-4624-a53d-fb465b988145", "comment": "Malware payload (AgentTesla)", "value": "bbc58c383af4cec887ff89c326d694c9ece8b4f786577d1b1a2c3497fc58e052", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570267, "uuid": "0b31c703-4e8c-42e1-830c-479aa004f587", "comment": "Malware payload (AgentTesla)", "value": "3f1335e0856c8f12b414bcf0b6c50474ddd226cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625570267, "uuid": "48796f4d-fa92-4a60-bf4b-8fa78930c768", "comment": "Malware payload (AgentTesla)", "value": "c052c31407936aaddffd00216796b3af594910e97735913d89b889fb29392771e974dca9ebebaa186ef0b7d22294059b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570267, "uuid": "b50d8005-5e09-42fa-9c4c-03f195e82a89", "value": "64659E3576328F91D87FC7384731E13C4FB9AE66E213E6796CD8389B64B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570267, "uuid": "a064bcbf-5e05-4fac-ba81-149d3d2ecefb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570267, "uuid": "0a3ca2eb-e05a-4fb4-bce5-5c2cd2b9ce38", "value": "12288:fJ+SaIMVjLz7TWm1iOce83gVZsZZZsZ/9PBTgDKHUb6IXwSMu762+F+j/XX+dRA5:F6iOHP9gDM6OuT+F+j/n+R8yjaPBnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625570267, "uuid": "ccea6015-bb3b-42ab-8f83-fece23201481", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625570267, "uuid": "f454d144-d98b-4b6a-ab54-1b51a9e15171", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625570267, "uuid": "5d9372ef-d2de-4b55-b8f5-c9165034c9a0", "value": "hYscuEkYOZEwXyj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddc4b9c-de67-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625582217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582217, "uuid": "ec8a444b-5a61-4ce3-ba30-9b95f6caba4a", "comment": "Malware payload (Loki)", "value": "d45f15fda4763377feeec12c635324f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582217, "uuid": "2fb6c770-1a45-4d8f-8ca4-9cb2aaaf2b4c", "comment": "Malware payload (Loki)", "value": "bc0d25efb794d3dc4d3e59b081c879d611a17e308b0a0e12c287cfff40c48c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582217, "uuid": "29fdb8ed-04b0-4133-be5f-e23bb87151b0", "comment": "Malware payload (Loki)", "value": "980c43f606bd835a4fc837ec531931f314694afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625582217, "uuid": "9bad6d3d-19e6-4f80-a764-ca8cebcbb2c1", "comment": "Malware payload (Loki)", "value": "daf77f4b4d38630d72ff537bf14d5f7aa3abf6d76dfad616c7cdf2e14074bd40740fe887cd7b2907e37d25bbc7bdcafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582217, "uuid": "d5969f39-4db7-4f03-98c6-fa3568c764c0", "value": "BA659D593700B69EC4979E3588689C30DBA0AC675707D383A0E3399EF97D696CF091F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582217, "uuid": "706e284e-b1ad-4dce-841c-10de54d9572f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582217, "uuid": "d2117b8b-fe94-45f3-8b19-53d184176944", "value": "24576:RCOV0lHf11tKi/YcmnZKeL+NcVPLaPIPnLt:RWzdJ4uwWSnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625582217, "uuid": "c7f250a6-1f44-44d5-b619-570dd772e5be", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625582217, "uuid": "33e93675-ea8b-4f31-ae36-d5f39dc41cb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625582217, "uuid": "7ef64878-a6e5-426f-b23b-55a7e05686b3", "value": "PO #3201145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac72493f-de38-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625562055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562055, "uuid": "05eb73b2-9f89-4495-96fd-04dee8957bd4", "comment": "Malware payload (OskiStealer)", "value": "363c4cea3a99747da37106372dd25559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562055, "uuid": "434c4f61-e02d-47d7-a65b-cfb5c3554b40", "comment": "Malware payload (OskiStealer)", "value": "bd85d30840bc092fb71a2dcba02260d06925468adfa5bf239248f1fb159e7a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562055, "uuid": "a50377af-940a-487b-9e36-0a633eea8715", "comment": "Malware payload (OskiStealer)", "value": "5563f10366f61f04182f0564a823d2eb172a8c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562055, "uuid": "4aa04fd5-e52e-4191-a49e-255e73e6eef6", "comment": "Malware payload (OskiStealer)", "value": "ab48798aaecf9f23341eef3597cadc19090238f37ccab6d3736294909393acef20748f2df0011fd4de29206140941a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562055, "uuid": "4a44cfa4-747e-4d0d-a542-b1a7dfd95345", "value": "78359E35A1B28FD5EC7FC7394B31351C4FE9A67AD217FAB86C9460890490B414B72A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562055, "uuid": "92b064c9-76cb-48a6-a0eb-0b5b72028198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562055, "uuid": "58b583f3-5d73-44f0-9351-bbf27b3d6507", "value": "12288:DKPbaIMVjLz7T5FDiOcen3gVZsZZZsZYwHoqYtXiiux1Q9AqQEJ81h/z4tCyVxfn:ziOrwsii4CJ8v/zAVxfKEQaPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562055, "uuid": "ee984530-0faa-440d-8b46-0c222072f175", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562055, "uuid": "302458b7-9aad-4a83-82e8-d959c96a050c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562055, "uuid": "33d206da-fbac-4dff-8fad-61c873fd18f1", "value": "Purchase Order N0 6604493.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504cbc56-de2b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625556317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556317, "uuid": "f356e381-4381-4e48-8a44-f1ad87200b3f", "comment": "Malware payload", "value": "2bbe120484c44e5502b7dc05d04a52de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556317, "uuid": "b2024bd2-5ed4-4d33-92a2-56f53cbddb91", "comment": "Malware payload", "value": "bd956d20da5c0dd889929f345340492cd2528d95b86de73fdf3519d132b642ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556317, "uuid": "efc81386-4d11-4e34-aed2-4add9115d7ed", "comment": "Malware payload", "value": "47c1f68b352286c0c2ef877e7c16716ec5117abd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625556317, "uuid": "f0b24d0b-7484-46d6-a13e-2369e74bdb1d", "comment": "Malware payload", "value": "a79240f0cdf49925317e34b95dafefe1aa06dc3e54b43005fd43f8c4938733a1b4afb68cbd80b7565f8d4cac7a20c617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556317, "uuid": "10ce7fbf-4aa3-4809-8805-39c77d7fd02a", "value": "4165230D4A5345B1E560BBB30A7386AE42F3E0651835E636BB901FDC75B211FCA94B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556317, "uuid": "b43c028e-1886-4756-b4e3-b79b4bd30ce1", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556317, "uuid": "b1f927ad-00e0-4b82-a9da-6309443247b8", "value": "24576:TF4yHFRfgqfLP1ZLirRroKDC+4qyRih9wgho0qCGyvZwiP5dYMCvWKPIJiT:JhHFJPfr1ZLuBoAYRmbqAtnAI0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625556317, "uuid": "8f124271-7a58-4820-8b22-7be214d2894a", "value": 1503580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625556317, "uuid": "490d326d-de50-48fb-a4af-013b2917aa64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625556317, "uuid": "c530c4dd-4c2b-4759-8d70-f203a0627031", "value": "2bbe120484c44e5502b7dc05d04a52de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a409b9f1-de38-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625562041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562041, "uuid": "5e83be2f-1d32-4ee7-b152-411239c107bc", "comment": "Malware payload (OskiStealer)", "value": "8325e7768964ebee192622a378e7f28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562041, "uuid": "1baee876-a191-4ca4-ae6c-506eb4bc2bc3", "comment": "Malware payload (OskiStealer)", "value": "bef42b4bb33bf2edb112d4e084df6e7aaad37b429b00ac783b9fe14eb08ac3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562041, "uuid": "3a7f7a04-f7d7-4a4e-937a-e215011238bf", "comment": "Malware payload (OskiStealer)", "value": "47ad27a29e5d3c8449fe41287bc3957bb8c37aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562041, "uuid": "d9be775c-1432-4418-8139-d9ffe9a78ce9", "comment": "Malware payload (OskiStealer)", "value": "718c81446ea9b795e041f0c7fdfd4a74b1770ecd0a30199495645eb0d92e6f044482db2d2b97392f98d72f59a0c2c9c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562041, "uuid": "58f37b9b-7069-4fb2-997a-47b8bffe8d1e", "value": "B4F47CB960764BA1EEBFC7380331251C4FADB37ED26BF6B85D94B18801D0F550A92927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562041, "uuid": "9731e4c9-f1d1-4af0-98f9-37d8946e7230", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562041, "uuid": "18ed0dd5-ba4c-40ee-b076-b21ca79aa6eb", "value": "12288:7MRC1P6NsBKfVoru+bXEaZzfmAaCNjb7YYelS6yZAM:7MRC1P6NlklIaZbmkTqlSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562041, "uuid": "b4ce7076-df3f-4717-889c-667392bf9945", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562041, "uuid": "89c2d057-cd5c-45ba-8587-dc66012c1211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562041, "uuid": "69c4053b-a154-480d-83a3-431f67a1cb16", "value": "8325e7768964ebee192622a378e7f28f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12d0b01-de81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593470, "uuid": "4e3da5c0-635e-4172-abcd-03cdd54acd56", "comment": "Malware payload (Mirai)", "value": "00b5b1ddb23bfe9f34554365cc9515a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593470, "uuid": "0e20d848-c32c-4787-997f-fd2e947c98e2", "comment": "Malware payload (Mirai)", "value": "bfaee0efbec2706cd6b5bd1aa030d24068cf8250b253451cad1abfb999a3379a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593470, "uuid": "1833c31c-c755-42be-9678-4bcae4114370", "comment": "Malware payload (Mirai)", "value": "655730c9369a0f26a18667e112009cbc821f379d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593470, "uuid": "71c85fe9-b2b9-4229-98dd-525efd0142e7", "comment": "Malware payload (Mirai)", "value": "399b422c01f1c52d570a328dc75bf1bc4d56611ba5479b8f8d692189fff60c0354bc3dea5da45e674ab1efc041ff2f7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593470, "uuid": "20cc44df-aac5-4359-945a-bd19e964e85b", "value": "D9C2E0CDF815ACC2C5F57CF874DC87F20685546633AAAF0E3B8259C956F184FB4990A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593470, "uuid": "2c6ccb68-da0b-4179-b61e-43dcfaa981b1", "value": "768:w9CUFskb2JgIs/E2+On5dafxkmkfEvtY/vb+zykVW0:GCrJgHiOnPUxRyOu3bS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593470, "uuid": "5192e005-5ce2-4542-aab8-ef128e7a83e7", "value": 27236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593470, "uuid": "0e9396c6-65d1-4bb2-a287-72543d92271c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593470, "uuid": "4d54c532-f81a-441a-bf53-ece8f5451ecb", "value": "00b5b1ddb23bfe9f34554365cc9515a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11669f73-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587135, "uuid": "028ffd61-e58e-4fee-b633-35c64c1b5750", "comment": "Malware payload (SnakeKeylogger)", "value": "6d6c0ae7c70949adcb64781f56b9b9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587135, "uuid": "84fc8478-b587-49dd-98cf-e3b0ba31cd9a", "comment": "Malware payload (SnakeKeylogger)", "value": "c0122aead3c5a7b1a3a8d5f5cd7dcafa2ea0966d08cd4480ee041f5dd8eae89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587135, "uuid": "c59e9300-ff50-4952-baf1-aa59aae437a6", "comment": "Malware payload (SnakeKeylogger)", "value": "3d938edf50d032f3b4389cf89ff6cde0f5273d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587135, "uuid": "e9422493-8479-462a-8661-23de79c5076b", "comment": "Malware payload (SnakeKeylogger)", "value": "5a3b9f8360e279e8a295f764adcf6fc3986d7e734d62741329f8c56d75d8e531e356de27c8756a7cdb32eead77d4713a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587135, "uuid": "88483c6f-b578-4b46-abf1-18801d85183f", "value": "B3255A7960F28BD1EDBFC73C2FA5750C6FE5A666D247EE786C9570890080B404A71A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587135, "uuid": "91a13eed-b7af-42dc-b581-156ad719def5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587135, "uuid": "bd663e64-8754-4073-9c02-4b064fa6b369", "value": "12288:md+KKi6NsBSD/F08SxyeUDtZykcmWk+qF5JDxHKrQN4VA:mdNKi6NVYErjwSHmQN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587135, "uuid": "8f926eb7-698a-410d-82b7-cbfdb9788bcb", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587135, "uuid": "51ca3a7c-71f4-4239-950c-32b7676e61ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587135, "uuid": "ee3edc81-0512-4e02-8c32-6cc92e8bf526", "value": "INVITATION TO TENDER NO MAT 021 PJTS 021 FOR THE PROVISION OF SUPPLY Instrument Bulk Material exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd3937b-de73-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625587321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587321, "uuid": "431e5de7-d2e3-41d2-86d9-c87eb8ed5618", "comment": "Malware payload", "value": "be867e17fdd1e06aee11c22c83c2e384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587321, "uuid": "3ff6988f-79fb-4968-8201-9ae09e0e886d", "comment": "Malware payload", "value": "c144b9c8ba25c23f058ddcae2adb58f474c1e7c660c91d0417d1ec57a8029e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587321, "uuid": "a1617594-2607-4fb5-a474-8a871d21eadf", "comment": "Malware payload", "value": "c69be3b2a781a3cd1e6e4712b69131a293f6d7fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587321, "uuid": "8dc86ee9-0762-40b7-9cbc-cb0b046bab50", "comment": "Malware payload", "value": "bce69eeb0c09e0eb32a70c067bc6cb568b33507ef2a5f2fef515980893ee1d63480220e55c628b8241c7649c431c9b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587321, "uuid": "5322eef5-5f22-4452-94a1-17d51050cc3f", "value": "68A40251B1C0C072C49A04339965D7B4A675BF3A6B28D98737D83FDFAE223824AB5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587321, "uuid": "d49cf9c7-0593-47bf-b7d4-1caca4f9bec0", "value": "cdab0fef7b5479a045b4ff0657b0733b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587321, "uuid": "711c4c36-7489-4dea-b496-f310aa1da311", "value": "6144:0D7KCLg8+eC+9hWE54UTU29neqxf0t6nBnmm8HK82A6fmHmGI:87KCsAzQUT3N04nBmL2A6fcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587321, "uuid": "2a5356a9-b615-4b71-834d-2f7e0447b3a8", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587321, "uuid": "0fac3ab5-8a8d-40db-a133-7c8398521001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587321, "uuid": "b561fcc9-d5cf-44e4-bd6f-6aad6ddef39f", "value": "be867e17fdd1e06aee11c22c83c2e384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2a90d7-de40-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625565575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565575, "uuid": "34478b7a-994f-4fec-8bc4-bf986cc6d820", "comment": "Malware payload (SnakeKeylogger)", "value": "6520d107d44290d2a4e86584fae04098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565575, "uuid": "a3f1d3bc-c528-46d9-aa9b-5077b770ee74", "comment": "Malware payload (SnakeKeylogger)", "value": "c1867a9ca079748693936a36b32d38eac98203bd120dd82bc6a2c9141f686200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565575, "uuid": "966ee327-37ab-4cdc-a28d-7deb3a022c99", "comment": "Malware payload (SnakeKeylogger)", "value": "1bd7d2b85e178b32cde2d3bd0d42e47c8779ec70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625565575, "uuid": "68c8b0a3-90fb-440f-bdf7-671682d76082", "comment": "Malware payload (SnakeKeylogger)", "value": "f93a036a25b0736b8b36bc8c91b27fc4a1fe3cf49e01d419d1d49de5e5509a2cdf3538059d38f7db1fbfd53982aad071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565575, "uuid": "7e11da55-1620-49c8-81b6-42e52e8b239c", "value": "C1F46A983ED0B99FC8EBC93ACD941C30EA5074E7832BD217A05752AD990D59BCF191F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565575, "uuid": "1ccff9a0-2645-42e1-8b2c-5e74dbd64dc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565575, "uuid": "9e7d984b-225f-4fde-a3d1-646d2570f1a2", "value": "12288:ZaB0caHjaykQSfFtydDJvpxKTBkIpc7rtUgyopdbB0RCe51mawOgWZ69:U0BlSFtwtsi6c76E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625565575, "uuid": "a31d71a8-4e36-4c60-90a7-cf24f487925b", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625565575, "uuid": "de87c266-6116-4d86-bd2f-8920602f1cd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625565575, "uuid": "c929392e-6efc-4eb3-8e43-e1305c0ee68c", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c2e7f4-de84-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625594525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594525, "uuid": "6f7ab3cc-ddb8-42f7-a2d1-fb4a3d1590a4", "comment": "Malware payload", "value": "dc474bd8579963cd63b40ec5e7bc2342", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594525, "uuid": "6a4aef9b-649a-47fb-8f16-063ea0dd4c37", "comment": "Malware payload", "value": "c310aca2959669fdb69fdec4c1336353d84b7ae9b8767a1086be3591b4af32f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594525, "uuid": "4f8aaa26-690d-4d88-b6fd-bac85a87b26b", "comment": "Malware payload", "value": "bf1e6435222ce7a5cce1a77ec0153a776a27dc41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594525, "uuid": "bccea7be-6e78-4907-9a4b-fe8f315fe1db", "comment": "Malware payload", "value": "9bcd7cd685a4152b7828d6737fc60f36cdf5b2b44902f46e9b9e4d6cdfe44c2a45cdf761f8a01ea1fdfe6bbec4640249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594525, "uuid": "439591ee-a29a-4e08-9423-3d3f39fdecd2", "value": "7F353C243EE9503AF17BAF7995E07596DB7EBA633703994E01A1038A0723B41DDD063B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594525, "uuid": "5eb1a107-e9fe-4f4a-aded-d595c2213f8d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594525, "uuid": "681bea7b-1463-49e1-ae9d-6673506c2d44", "value": "12288:hRZ+IoG/n9IQxW3OBseuT9SbrqnOsRr7SNDBqG1ooEYGrhSvejXaDIX+nKJEaWTI:J2G/nvxW3Ws9kr+Os9mqGoWle5+nl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594525, "uuid": "d5820c14-31dd-4329-91ea-52596136cd6a", "value": 1099387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594525, "uuid": "3f5881b5-8647-45ee-96cb-100f32ffd975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594525, "uuid": "d324344e-6d80-4da0-83b7-06f20ddd5f40", "value": "dc474bd8579963cd63b40ec5e7bc2342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc889d14-de94-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625601650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601650, "uuid": "bfe2f8d5-929f-4f5b-aaa0-64db1b22d59c", "comment": "Malware payload (AsyncRAT)", "value": "0e533493ab7375980b2578b9147fbe58", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601650, "uuid": "2e02a2de-2477-43fb-8ba2-cff707b1258e", "comment": "Malware payload (AsyncRAT)", "value": "c32016214bcd487bfd5b76a6d3551ef39f766bbfff4daab52169165e2c411cfe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601650, "uuid": "11eebae5-5865-4632-ad48-c4e3c4eedf80", "comment": "Malware payload (AsyncRAT)", "value": "8238af401a1d4a73ddece36bd181824bce1d93fc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601650, "uuid": "ddbc2f87-01af-4959-a3ea-1aeb1d66e811", "comment": "Malware payload (AsyncRAT)", "value": "9b67b7d9103d257e0a9b3c4b45ee653339822ae0ef1dc19b7062197e950e1946e03d2a210eefe91b453adb6d7e18b514", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601650, "uuid": "78236d00-ce3a-4aaa-bf5c-e9af52faf62d", "value": "52057D7621768F96EEBFC7784335261C4FE9B277D34BF6782C95609904C0F804A62A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601650, "uuid": "5d0000c7-9536-489f-ae73-a4edbd672610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601650, "uuid": "5c0232d4-014d-47f9-8842-ccefef95ffed", "value": "12288:TdKvHDLB6NsBQD/F08SxyealmiM9Z1WndX0fwOw8N503WFZQI3/WiPFy:TdkHD16NrY8mR11fw2mWFEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625601650, "uuid": "ef3c95c0-c49f-494a-b1c8-b863111d3102", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625601650, "uuid": "2efacce9-ff24-4336-99e3-43eef242b857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601650, "uuid": "96450352-5287-47d2-b053-b9e36bc976a6", "value": "Image0001.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81362da5-de60-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625579163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579163, "uuid": "8cd1eb56-4481-4729-b650-27ab1cd71eaf", "comment": "Malware payload (IcedID)", "value": "dd091aa318833eac4173b61caa5b6e6c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579163, "uuid": "4f185289-ce6e-4eed-b443-b4ad3aac77ef", "comment": "Malware payload (IcedID)", "value": "c40e0897a8c7bbd264df4fa44cc387efbc0de8e3bc834f5656f2291f920e1c5e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579163, "uuid": "354f10e3-c818-4506-ae75-0a26066686cd", "comment": "Malware payload (IcedID)", "value": "9dc71053e2bbd11f6a2de7b1e37e9f530517da2d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579163, "uuid": "14c3e6cd-a3d5-488a-a06c-ddd4694831b8", "comment": "Malware payload (IcedID)", "value": "b68e4cd25a2a78d45326d7ad23409c303f4d44ae7cbb36c276fd4534ac1faa1eb1b245225d4c3ddd305ae7172638ccfb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579163, "uuid": "a413ddac-9163-4358-afa4-47b858050e19", "value": "79040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579163, "uuid": "e518077b-4709-43fc-873e-6a2a0bfb4c76", "value": "3072:eDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:8RcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625579163, "uuid": "484495cd-79f0-48cc-b625-62b07bd6cb67", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625579163, "uuid": "bedb2dc0-e5c1-4530-b4ec-670015110210", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579163, "uuid": "e81c10c0-47f8-42b4-8fe5-c1b0bf6ec99f", "value": "Formtofill4184860.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec86cc06-de19-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625548848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548848, "uuid": "451860b5-aeb5-476c-8e5d-0cef7b2c488c", "comment": "Malware payload (AgentTesla)", "value": "c2d504474ebf64598c7211c3bf35586b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548848, "uuid": "2e157df7-aeb6-4a13-a39c-bbbb149fc0c8", "comment": "Malware payload (AgentTesla)", "value": "c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548848, "uuid": "0f4dafea-fd75-469d-8d48-ddaf072d537d", "comment": "Malware payload (AgentTesla)", "value": "e6628b84a3302208ee1e518a7c056407905cb410", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625548848, "uuid": "cee73fa9-3fc3-4d34-a5f7-1c3d35deb581", "comment": "Malware payload (AgentTesla)", "value": "b622114c22acbefd52b40804d6f5b0243eda3f8867d36b34015bdc44f2abee8588650024a5f6bed7d33997a9c430501a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548848, "uuid": "4992cffc-8c2b-4302-84ca-348531383dde", "value": "F9F4DF6812F8999DF5FF4B7EE5A96111C7F4B6626213FB2D2AC010AC1C73B50CD82267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548848, "uuid": "021d1f5f-56bc-4bf8-bffc-514fc6dc5e12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548848, "uuid": "cd8c26b2-be17-4c06-9c1f-651b5be85b4f", "value": "12288:Rn+WPXljQ0k6dNEWe8cGbnbdYXwZhcia0ANkUWsb:RI0qwnFhGLmUWsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625548848, "uuid": "ae31e8c8-0f2a-4142-a428-e20031506d8a", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625548848, "uuid": "61b388b9-a4b8-40aa-82ff-3cc0cd821687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625548848, "uuid": "97e502bd-a9a4-4e37-84a0-257e038fe727", "value": "Statement Of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc64c3f3-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625553599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553599, "uuid": "22a0ec67-9638-4966-be30-3f04f875dd05", "comment": "Malware payload (Formbook)", "value": "f5df7388d3385f2643c7260c05fa9601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553599, "uuid": "ba5b0af3-481a-49e6-88ad-e9c2e163f6a4", "comment": "Malware payload (Formbook)", "value": "c92701cd811149250de5cf99296d191459a85dd7776088394ea3e31e6beb26b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553599, "uuid": "78ccdad9-0cbd-4260-87b5-60566e053c33", "comment": "Malware payload (Formbook)", "value": "366df9b65d9089edf4dbd801284d26219f01600e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553599, "uuid": "a3fcba0e-8e65-40de-9df6-97f9ba9e6218", "comment": "Malware payload (Formbook)", "value": "7029e71ecbb5a0d6aa0ef1d9ef1cadbe80490fce1f00853c1191dbcf09ed0e4ae6498aa216f2f604716dd4d30231a292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553599, "uuid": "fa9f701a-1541-4920-935b-fe34004a7f29", "value": "331402332AA0D5E3E73701B21A731642EFF9D7112155224BA7A8579E7BA60C35B1F2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553599, "uuid": "5533e043-a1a7-487b-9cec-319739aa1c88", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553599, "uuid": "2f2f04b3-0dc9-4dbc-bad1-d4c1f699f39c", "value": "6144:iqjIKJX0hlM0+yqa+mMOseo7ZFvH5OTDzs:zpJ0hlMCD7o7ZFvH5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553599, "uuid": "14ba9d84-51f5-43cd-8679-764ff1d6e0a7", "value": 196728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553599, "uuid": "cc6ff497-a302-4772-9f69-f6f2f41e33c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553599, "uuid": "32bc60e4-df48-4a8e-a109-9205ebe48283", "value": "f5df7388d3385f2643c7260c05fa9601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bf54d4-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625584136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584136, "uuid": "fbd4ad27-1db0-4dc9-9d34-2bf91f900277", "comment": "Malware payload", "value": "f8028919817c1346a502caaeec86cfa6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584136, "uuid": "ca95c720-0153-49bf-baf2-8e80a484f413", "comment": "Malware payload", "value": "c9564a2bc049aae834d68e858f1468205175ababc97845c8127d770c9bcb7d47", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584136, "uuid": "0ec76cc3-cab6-4212-a05f-713cfc83070c", "comment": "Malware payload", "value": "d0643ab352cc155f87b6751483659f7fe6a13960", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584136, "uuid": "29c92ce3-005e-4dad-94af-2cd2d86416d3", "comment": "Malware payload", "value": "47818cbcec0a2cbc3ec6101a968d4fa3a229524720eb3055cdd2a44ee15c8062f2f31d7745b1ff600fff38313f8266c2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584136, "uuid": "546f67bd-f51c-4319-9f8a-e550eeb55792", "value": "ED15BFF876047DE66A6F576BDA96ADDC03B6272399CBA4CD4064B7C305A3371EE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584136, "uuid": "566a7b2a-e767-4195-a32c-768eb65fcc9f", "value": "24576:PO+FZsXj92RFItp33buCl64zw9FQuGxSzwdMnPS7fS:POC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584136, "uuid": "5bd2d616-ba0d-41bd-b2fb-a8130941a0ce", "value": 888019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584136, "uuid": "2d7cfb05-8b41-496b-837b-d9448486c029", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584136, "uuid": "61b9b531-2c05-4dab-bcb5-2d4ebcd02f61", "value": "Re 26.08.2020-900.08.2020 D\u00f6nemi KMH Beyan\u0131 Z\u0130RAAT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb64c833-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625586669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586669, "uuid": "cd1e5645-dacc-40c1-ba6b-5fa04cff1b4e", "comment": "Malware payload (DCRat)", "value": "1be94432b98cf77119a3016774d5a0f9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586669, "uuid": "1331516b-15d7-4fe1-ac0d-48de9a4f4715", "comment": "Malware payload (DCRat)", "value": "c98af1a3bd9d4ffcf98a1bd1b9fe69ad953a99e0162b97d203567834dd611574", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586669, "uuid": "614fe0e5-0117-4c29-9f08-a467a2a782f3", "comment": "Malware payload (DCRat)", "value": "ed004b3d2db137d32779808b4031c8e668c8f7f0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586669, "uuid": "9ee0ecb9-98a4-4b09-99ae-218d74be949c", "comment": "Malware payload (DCRat)", "value": "dc0aad4be17ed073b0660890aa962297d58bbf74bd73d0565a1653dd83cd788d6b45c32ac943933e2a97d72cec985b02", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586669, "uuid": "571a1019-61f7-4f87-9749-3a0642a10b56", "value": "3855DF86EBB6A285EC411B7B2460167D4AE1FC5CF6DF6F851F2025E4EDC235530C8AE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586669, "uuid": "db7c7dec-ed1c-4596-86af-0902fd867a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586669, "uuid": "a827e696-37df-4d5b-9867-6ff75ff98ce8", "value": "24576:QX0NFzQIggLb6PT2/mom4rDdIWUmj0iX7WmA5Rhjj/vqQA0BMnC:Qk7Q8vCa/E4rDK2j0iLyvjfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586669, "uuid": "e4d74e70-c84b-4828-a680-540ef88e3ad9", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586669, "uuid": "dd431c9f-8b3f-4b94-8880-93f052ec88a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586669, "uuid": "79d373f8-2b37-4b68-9e00-36e7ffe97dc9", "value": "1be94432b98cf77119a3016774d5a0f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62777daf-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625587701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587701, "uuid": "ed896b61-b506-4bc2-a0ba-7027d70f8734", "comment": "Malware payload (SystemBC)", "value": "25f45cc971d7ee1d763f69508676f1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587701, "uuid": "d9fedfd8-724d-44d3-8e27-a952c4f5dd57", "comment": "Malware payload (SystemBC)", "value": "c9f396388822102ed458dacc4b059a46c69ba11cb8b0785b9fb2ce8285abeb42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587701, "uuid": "2faa912f-516d-436d-bf4e-9ba57ed0ce1a", "comment": "Malware payload (SystemBC)", "value": "4049dbeb342a4f9f65c56591301e4993bdcbf889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587701, "uuid": "e3612df8-6c13-4a0e-9a81-ddb6aa9d7998", "comment": "Malware payload (SystemBC)", "value": "10aad8d389135bd76d4fabb4b1364f117ff0961a5b13ff195feb6fbd24f3f841848bd25044308ffd356a936eb9f13092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587701, "uuid": "9ba90b37-a823-42f3-a84d-86f3b0cb2bc1", "value": "BB058D32F2814837C573363D9C1BA758A83ABF112B3CA9866FF51D485F3A6813935297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587701, "uuid": "f25cdeb1-0064-4b98-ba19-8bf85130cbe7", "value": "41e286bd81e15d36bb9bceeebfe46ffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587701, "uuid": "66b700a8-a087-4481-b20e-cdac3277ffda", "value": "12288:mGpmnrfAsq3NCRRi57t197JQdQ97co9JWPXa+LD9HyrUG8CerA:myarofgRin1PQGdCPXa+LD4UG85s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587701, "uuid": "1bed8006-6863-451a-91b5-48557bcdd9a4", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587701, "uuid": "b4144133-2304-42dd-b7f8-bbfc47426f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587701, "uuid": "cf04d71c-fba3-43d0-902f-fc657aed77f7", "value": "25f45cc971d7ee1d763f69508676f1c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53c8292-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1625553480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553480, "uuid": "c17c6573-f48e-481f-a6e7-95d65679d08a", "comment": "Malware payload (LimeRAT)", "value": "57610dbede5cd8832cddd051891a62d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553480, "uuid": "cfe40e8b-6e96-4cf9-b29b-e29dcc045401", "comment": "Malware payload (LimeRAT)", "value": "ca36e58bf644175fdbc20552fe5279b1cec92538176fdb9029cac36f69d75329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553480, "uuid": "a45daf40-9770-4f77-a3c3-4e3fa0b4fa48", "comment": "Malware payload (LimeRAT)", "value": "e75ecafd19bd3613353353f8bf8fc08255f4d11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553480, "uuid": "e58c17a3-ae13-40c3-aa2f-04430bca31fe", "comment": "Malware payload (LimeRAT)", "value": "3111fc2f577a6d64eec779c0b597ca566e3f4f5c25f8ba99ea8c03e9ae72f7899e0567e45837ed87dc1bb945554a48a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553480, "uuid": "a37d7773-6020-41fb-b39a-55205c776465", "value": "A1458DB16861465ADC6FCE34C3326E3C0FA77E79FD4FA6396944718B31A76830A22513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553480, "uuid": "6bfe3b4d-b19b-43b6-9708-6af7819ee918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553480, "uuid": "16fbdaa7-51b9-4473-a267-56426dbb872f", "value": "12288:Sa9Z6NsBZOaDaDa4gEVwV2IIGMDSWC+joHFEO6FBmfra/aE:Sk6NGOaDaDa4LIIXDHjoHaO6Fyra/aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553480, "uuid": "6d722a03-1b4a-4f73-9f8a-73b154e1b768", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553480, "uuid": "913347e0-7024-4171-9959-8326d3bcacbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553480, "uuid": "b21851ff-8838-4028-b207-6a5e6cf41c3e", "value": "57610dbede5cd8832cddd051891a62d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf041647-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625586997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586997, "uuid": "63f28592-91c2-4be1-ac25-7b50291f32cc", "comment": "Malware payload (RedLineStealer)", "value": "04fd8cebc3471db353a5e5db856868dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586997, "uuid": "d6c4a71b-452a-43d6-8c67-c78fca01f1c9", "comment": "Malware payload (RedLineStealer)", "value": "cc161c44340b9944936e1af83913c62bfe6cdc92703e19fc036e556bd89caf79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586997, "uuid": "b2acd7f6-f93d-42f1-af5f-16874acf3504", "comment": "Malware payload (RedLineStealer)", "value": "a3f1e1f62a6f724ae6e69e75de0634a778d5218b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586997, "uuid": "99450f1e-3ca9-42ec-ac73-eadc5f914eaf", "comment": "Malware payload (RedLineStealer)", "value": "cff59cd5b2add537c2f019876e35daae1cb98c8abe64ad503c7223e172c207746abb9541d326332f53a1c69687c1bec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586997, "uuid": "a94063bc-2ba9-46a3-9221-64e15ac0f181", "value": "900493272393C475C5C42230E465CB3B3668CD271771B65AB0CAAEA7BD6B24D4DBC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586997, "uuid": "61e4e66f-33fc-48c6-8a46-3924e80d9109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586997, "uuid": "c583dff3-7ce2-42f9-bb60-595c5ed71cd0", "value": "3072:yb7+z9EZiu4Bm0Q6Jj2b/YtjXpU43V40404046:nz98Ym0zhhj643", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586997, "uuid": "14907d3f-49f8-44b5-b31c-ee74f250ea36", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586997, "uuid": "b5a47d05-b261-4dd5-a93e-661c0006c226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586997, "uuid": "aeff0af3-5c01-4923-a853-9103a13fbdf8", "value": "04fd8cebc3471db353a5e5db856868dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2218ace0-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625584157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584157, "uuid": "ce933eff-eeaf-4e94-9cac-9718eb5cacea", "comment": "Malware payload (GuLoader)", "value": "32c099a7b9a5cfe1920c5e27d4c26f87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584157, "uuid": "8ae706e0-2827-4668-a749-3efa16158f00", "comment": "Malware payload (GuLoader)", "value": "cdf3ed20864deb7d7c28a188e14bd8369855e44f9cc3a8abf187146e9ce847b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584157, "uuid": "ca370cd4-139b-4ce3-a258-d6c2b581ab27", "comment": "Malware payload (GuLoader)", "value": "efd4d3670d59054a5e616d8cdc72ffc7239a39ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584157, "uuid": "64065bc0-7135-4419-b855-405e9d154ca6", "comment": "Malware payload (GuLoader)", "value": "37fba69a0ab4875f2ae4e25f76d06eb306964fe0d54d3a8e07d17b23dfa8849deffd52b22d53c8dd7baa8b6153b576ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584157, "uuid": "b176aa01-769d-4be2-bb17-bae589abe785", "value": "08848FD2ED418551ED564AB1D82E997C10663FFD94A4A50F70B3BE233AB33C32066E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584157, "uuid": "e1e4a4cb-9c29-4033-af39-2ca7627a3acf", "value": "2a8f8fe86b805d013a793966040bd3e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584157, "uuid": "60655175-b268-4b12-aeea-80c90fec1200", "value": "6144:X5JSVcNqNU2DqySM7cCezPu71By3WqCADi52ovelDv:y+N5XySpCoPu71BoND22x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584157, "uuid": "5933475d-115c-4b74-a15c-bb2162ca2dd5", "value": 406648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584157, "uuid": "bc0668c2-e294-4d8c-9192-c2a16ca1a223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584157, "uuid": "99ac529d-7353-439c-b8c8-e0422883dc03", "value": "Invoice-NBM01557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ad1ffc-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625588438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588438, "uuid": "fec40389-150e-45c1-9cdc-46c916b93c93", "comment": "Malware payload (Loki)", "value": "bb6606ce042276a5f9948112ad29bf45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588438, "uuid": "2c00d7c2-8c41-4d64-9547-f4a0f1015cbd", "comment": "Malware payload (Loki)", "value": "cee10fecac0edc80c9028ae0916414140050888561fff693e34eeb7780af222b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588438, "uuid": "a0f79495-533a-4b6f-ad46-063d372be79e", "comment": "Malware payload (Loki)", "value": "9c135259a44cf56ae6f36a0c279e3023598bff06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588438, "uuid": "f5a5650e-aa67-47af-ad7f-10ddb3ee1a7e", "comment": "Malware payload (Loki)", "value": "0cd294325444276c8cfaa3b746558436c4fe815522090554699df0c52b2d2daf14c8960f77daa9af0e6c6109956efb76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588438, "uuid": "0b0706e6-8c6f-4f6f-aa55-2d9f972ef6b7", "value": "E2E47DBA60778BA1DDBFC6380731EA3C0F69AE76D14BB67418C4BC1730C1B550A66927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588438, "uuid": "7fc326f2-0a66-4c85-b5d5-b79bd30cd0a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588438, "uuid": "d3ca91f5-228d-4a53-ab87-729c35cedfdb", "value": "12288:p06NsBnnXmu0szb2gYIahjRMODlmrmVGs4W:p06NS2u0sP0tjRcrmV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588438, "uuid": "79b8b72b-19c6-4ef7-974a-7c16c47486d7", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588438, "uuid": "70453228-e944-4035-80a5-646cdb51426a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588438, "uuid": "2c47fa07-28c0-4c10-905a-0310bae1463e", "value": "bb6606ce042276a5f9948112ad29bf45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f1b4ea-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625588410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588410, "uuid": "1e95b4b5-6b24-4c7c-bbb7-2eaef9d80e08", "comment": "Malware payload (ArkeiStealer)", "value": "945c83b2f80e0d932e4ce8976a56b8e0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588410, "uuid": "0a63da4e-d73d-4ae3-abb3-f62fce04f7d2", "comment": "Malware payload (ArkeiStealer)", "value": "cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588410, "uuid": "f2d7202b-897a-4a66-bb65-153944389476", "comment": "Malware payload (ArkeiStealer)", "value": "3c8c0c522190599d70a56ab4e2286a7e75f71a57", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588410, "uuid": "3e98aba1-b1dd-4762-9b93-505149adf21c", "comment": "Malware payload (ArkeiStealer)", "value": "29cdbf8d2a3cd95b459b8d279b73d986a94aa33011b3583384e04894516da6c4b7f04c8d77fad61a4b7b34b5ce6a162b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588410, "uuid": "32b81985-690e-4f3e-95aa-6a6fddd5e149", "value": "06F4125F6EE941A4E19186B2EC66F4008DB2796E2454D6CCB8CCE70B1F777C1CA42E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588410, "uuid": "face4e03-49c4-4031-bc1d-5bf55820ce74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588410, "uuid": "1aecd481-fa71-4819-8762-46a09aef5bc3", "value": "12288:sXpFlW8AIl1OxY4an2IRCOh15EX5Lazoziu4n6j+YseYQNHaWW0KMn+:SlW8ipan2Ik81kwozioj+Ys9cHaWlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588410, "uuid": "26b662ef-1814-4943-9546-06765a63390d", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588410, "uuid": "d0759775-376f-46e7-b378-5806067764e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588410, "uuid": "3cafdb70-1ee5-41ec-b109-cae3d2ef9088", "value": "945c83b2f80e0d932e4ce8976a56b8e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e50911-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625549534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549534, "uuid": "c8e74674-f4e9-4bcd-88ec-2fdcc222cad0", "comment": "Malware payload", "value": "36676256f4733bbe2ec8e15afd067e1c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549534, "uuid": "ac1162fb-ab12-4a6e-a35f-9e8ac0360bd9", "comment": "Malware payload", "value": "cefed318fa62d6b9581acb1d0475f1236a56e3ba5e8f48140e6a2f51da250286", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549534, "uuid": "ea56c36f-7bc1-4101-b0f1-0f98fe593f60", "comment": "Malware payload", "value": "f3bb13c7d84a43e38da71e349518b8af1d8f3d52", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549534, "uuid": "79f4478c-8aec-4516-bed0-0cba7134f584", "comment": "Malware payload", "value": "e3812bc5ab174c92b92f114556666bb49f0784d95de4da38ccd69dd739951c29dd3220f33af2960e1ecf2867364ca7e8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549534, "uuid": "6629b3ed-3b99-47c0-b12d-d0140c93802f", "value": "A4B4230CD821D99D11EBA0B55F9FBB9EBF5E49881D84A23CCD7CDA0320BF525B50D2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549534, "uuid": "4a696eda-8ea4-40e6-bf1a-91da4a7154ae", "value": "12288:hms5EFVkzhrUKLwuC8GwEHj90Wl2vGbvuiHUonQTWA:hm24AhrUKwXvBdl2+LLQaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549534, "uuid": "f449e0dc-5ecf-43ca-9855-cf2e8483eafc", "value": 499525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549534, "uuid": "f951bc1f-18e5-4e79-9e84-a62dc03917ac", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549534, "uuid": "6c881ec7-e904-4e05-b9ea-6d72752ba3ba", "value": "transfer slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b570959-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625588494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588494, "uuid": "09a77997-850b-4e1f-a0a2-83d97f0f7dbb", "comment": "Malware payload (AveMariaRAT)", "value": "7a4f20f3fc40a0894fd6be5f59d35bd2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588494, "uuid": "2cf20820-2819-4665-8b44-5f4c5331d5fe", "comment": "Malware payload (AveMariaRAT)", "value": "cf9dbf8a60d2b3e0b9d14d07a62fe2dfa65aed771a88bb9e0fed10b1bb5445e8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588494, "uuid": "84b1d4bb-8e76-456d-81b6-bd3f0cbca469", "comment": "Malware payload (AveMariaRAT)", "value": "e662bfd39cf389b0bad5262e6007c09824261ee4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588494, "uuid": "4ea4bcf3-608c-4cbf-8114-a8ce8a289ba0", "comment": "Malware payload (AveMariaRAT)", "value": "f6387fea02f191e470a395f09c1a0efba569d7b2a01117bb745e9aa281574d1f08e5dbb1b43ff86d9501673b9960cf21", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588494, "uuid": "6cc787c6-2d7d-4eea-84d4-0c0130bcec59", "value": "CEB39E13F7E54835F3B201B01ABD7E6ACBEDF9701628C49FA394854A2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588494, "uuid": "f52fbd49-fba1-4b0e-9964-667fd0fad395", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588494, "uuid": "2b13891a-cf8c-4133-aa8c-e5616d06eb0d", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01Q:K1VmhaH8EFvW+0OVE0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588494, "uuid": "efc0db09-b0d5-490c-b0ea-cd58121f39e9", "value": 112262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588494, "uuid": "c25c0284-a63c-40e6-8f32-8cdfbc923db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588494, "uuid": "d23e7656-3233-4b43-b06f-0e1fbe62cceb", "value": "7a4f20f3fc40a0894fd6be5f59d35bd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b192abe-de97-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625602587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602587, "uuid": "25347d2f-c08c-486c-acc3-99b4ea090201", "comment": "Malware payload (RedLineStealer)", "value": "8058f4a41f8ccc94f05ef075533fde86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602587, "uuid": "69245f06-2cce-48f5-9637-216daf7c7f86", "comment": "Malware payload (RedLineStealer)", "value": "cfb4ba9abc5435b611d0d97d879cdbdee4523bf32b679fe6b9b787f4dc763cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602587, "uuid": "7d80600b-0e6c-406e-8aac-e2d794f8884a", "comment": "Malware payload (RedLineStealer)", "value": "5adc4dd09ab946cdc2f6449f1fb48f3a64d0134b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602587, "uuid": "69872238-479e-4b1a-848a-87f0b266b776", "comment": "Malware payload (RedLineStealer)", "value": "b6a053a074281fb19539b912b9d11c89cd09f01882d4bf075318055ddaa907b4b898766b45b0aff99da1f64e0efcbf26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602587, "uuid": "b6beeacf-1156-4a97-9f14-6461f894be4f", "value": "D5C4F1283AF996A5F13B9BFA24B83510D37AF6176A1FE74D5CC112CD0822B81C9D2717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602587, "uuid": "4b1a3f86-c09c-4242-9ab0-82cfeadccc88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602587, "uuid": "df2454a7-292b-4333-b894-faf69db9dcb8", "value": "12288:cXF+awC4/Ab45CLo3WBn6iP0lRhQ4QqbiN/LxXiyu:cXPwC4obkUomBn6Lk4QEir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625602587, "uuid": "f422eab2-8ea6-476f-ba06-976f189fb9d6", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625602587, "uuid": "e6fe19aa-5cba-40e8-9f9f-ad92b68697a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602587, "uuid": "1197c2d6-4bbf-424c-ba7e-1753d073a303", "value": "8058F4A41F8CCC94F05EF075533FDE86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4630f293-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1625552435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552435, "uuid": "aa6f33ca-de3f-4bab-af9f-b0223cb4193c", "comment": "Malware payload (TeamBot)", "value": "7af67758fb6927cdcbafac6523afccd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552435, "uuid": "e885f1fd-baf9-4164-8b69-d24bdfd6ed49", "comment": "Malware payload (TeamBot)", "value": "d0da8d292459d68df7dbbd65379e80e970b79f93307f05aca7b95e967ad86d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552435, "uuid": "166d2a38-5648-4170-acd6-cff8033c8c4c", "comment": "Malware payload (TeamBot)", "value": "2fa119c38c0a4971796b8205241e8f81c8e2f9cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552435, "uuid": "45d07302-6077-4851-8998-a67d994f8f5c", "comment": "Malware payload (TeamBot)", "value": "05792e2f7dbff57f9a4d93324c0ea4d9b998eb8cf9f947df97b9b96ce737c3c897c6336e0d71472bec17e82ecc6c6d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552435, "uuid": "f66788f5-e673-4114-a55a-a6d17098c5d5", "value": "6BF423257690C833C42644718951C332B6B8B53166A48D17FE1D17FE6E7A2D2AF3B32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552435, "uuid": "ec435a80-853d-4c85-815d-74a507cd8301", "value": "31bc5b00e4fb196a092d39676ddbafcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552435, "uuid": "1bb0a9f5-06ca-4a2f-a937-8e393166c3a5", "value": "12288:eFSuoZiimMTqbR3iQWgFjd+yLjCQACv3fYcZwdxaPtFW:eQ9EiLQWyvbvwcZwdYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552435, "uuid": "cc674943-b613-4c65-8b42-3b46819f8c16", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552435, "uuid": "f8dfea39-8e18-486c-af4d-0d697276a736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552435, "uuid": "e276bdbe-bdb4-4678-bd56-83cc2c8e4b56", "value": "7af67758fb6927cdcbafac6523afccd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc875a0-de1a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625549283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549283, "uuid": "e0e6c220-a624-46d8-984d-e41183b9bc0c", "comment": "Malware payload (Loki)", "value": "8b75555d3354b1fef9a75a9c5ce7c1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549283, "uuid": "a34f5878-268b-4099-b0e3-1505273ca83b", "comment": "Malware payload (Loki)", "value": "d11890ab6e5fabf085bea373b04351337fcfcfbf40c2c231003e23f002db5d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549283, "uuid": "ce712e4d-1f46-45b7-a872-4f47714dbdb9", "comment": "Malware payload (Loki)", "value": "b921eeab2d3a91ffa7c3e3676c711fcf937d9206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549283, "uuid": "f20b3a11-edf8-41ef-bc8f-b14c7da8f670", "comment": "Malware payload (Loki)", "value": "6495a68357884a9ac5c05ce5a8424031a98aac354a2d942af85a4766d42ea114a8b27a9fd48a9fc6361627c7c2f3a91c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549283, "uuid": "0593de9a-005a-41ce-9654-077ca4d7e3ee", "value": "76F48D7620728F92DDBFC7394332561C0FE9B66BD21BF6793D94F48914A0F424A62923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549283, "uuid": "4e78a339-11b0-433f-bbf0-509815af95d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549283, "uuid": "00535f03-97dd-4705-b1ae-ee361b57ea42", "value": "12288:g0aJUrvV6NsBaDULlJCdWC3+bGF5JFr3mm7plVM1p:SE6Nl0lzC3+Cr3JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549283, "uuid": "7785e0a5-e693-417e-b78d-2bded239dc72", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549283, "uuid": "198e5c72-f824-417d-ba69-4769e8a5246f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549283, "uuid": "b2a42cd4-f2fe-4c49-8a50-21d67ceb7261", "value": "order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e810ebc6-de6f-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625585778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585778, "uuid": "63ea60a9-0c06-4da5-8db6-acefae3a808b", "comment": "Malware payload (RemcosRAT)", "value": "4573bb3721cdec2d5643fc7f1952bd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585778, "uuid": "1067c12b-8d7b-4c20-8436-7c5f57cb0c5c", "comment": "Malware payload (RemcosRAT)", "value": "d29428cbd2ad3c82dd8af9f9828ec2c3c4b0e14160118888cbf94e1798fbf365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585778, "uuid": "79dfc010-cf93-4c48-8138-c45862d25ef5", "comment": "Malware payload (RemcosRAT)", "value": "ace814c39de0b5519e203e86b7869978539ea2e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585778, "uuid": "05dffb41-3f41-4af4-b82d-a144827b4ea3", "comment": "Malware payload (RemcosRAT)", "value": "83ae41cdd80eb3135eaf9fc4c41d4af95a54e0a4562b204b7ccc784f902df13aa7f04b52cd792e2a626c4fb99688d790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585778, "uuid": "a986ab11-a39a-4e76-abc0-7299e693628e", "value": "DB6412666B6CD892C8B94DF282C3E0C90B78E6E11640D52A10CDB1970D5B3876ED7FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585778, "uuid": "f78d728a-97e9-4710-a675-c0517c4115e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585778, "uuid": "b11c3317-4fe2-433c-a68b-c0f4cf605b76", "value": "6144:3OMqeXebs+a6mGxv+Sb/Ao9ljN5kYsByYUyUE7vcx4M:6eX+s+aPOGOIe5kn4vMjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585778, "uuid": "c07d6cea-9c5c-40ff-bded-e3cc3618b84a", "value": 308168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585778, "uuid": "3ed2e9b1-89ae-4c8e-85d9-6df8d7aeb7f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585778, "uuid": "cb1e8bec-78cd-4114-8b9a-fdd0a99f9604", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca75881-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625552741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552741, "uuid": "c05d656e-3338-4b9e-8718-249a80314700", "comment": "Malware payload (RaccoonStealer)", "value": "3c2acafef30f0868587e5dfd2fe6f123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552741, "uuid": "ab4b671b-99d6-49ae-8ee7-fe61c9000b69", "comment": "Malware payload (RaccoonStealer)", "value": "d6ff71f4320761a9d08e753f0fe917ff018df8000405f1e789ce2f20dd22bc76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552741, "uuid": "565bcc01-f92b-447f-93ce-355413baf64e", "comment": "Malware payload (RaccoonStealer)", "value": "7390fa754b251c24620c43337f45c5488eaf372f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552741, "uuid": "2d6c9d46-95d5-49f6-95b9-4d7c5b924983", "comment": "Malware payload (RaccoonStealer)", "value": "8b6496cd4dbfc5ac3d49e86478dadb017d1b886c8047be7e3fc81576960f11fdce20156234883955551e0a8f1e6cc608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552741, "uuid": "a843e64a-b6b6-4a35-afd8-e5479c224670", "value": "C3B4D09D766472CFC85BC8368EA51D74EAA0787B470B9203E49315ED9E0D99BCF090B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552741, "uuid": "339b9a21-4259-4018-bbed-7da71754f15b", "value": "12288:D8ULL5K99NxLFbJrmSuP1K3bWpKvZCRCtvk0ISrGDF++:YULLC7NFNrPoKvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552741, "uuid": "0218da8d-490d-4382-91cc-9f2086140c47", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552741, "uuid": "e889ec81-59e6-4414-a3b7-818670decbb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552741, "uuid": "0d5b839f-ef13-46bf-b2b0-76301401cb39", "value": "3c2acafef30f0868587e5dfd2fe6f123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103f7076-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594005, "uuid": "5ccf4b47-138a-4d72-890b-d57977204afe", "comment": "Malware payload (Mirai)", "value": "7f9fc7814e2f43d38b82f892f01b9fcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594005, "uuid": "e23ce5c2-f846-44e5-a7b5-ecddb6eb576a", "comment": "Malware payload (Mirai)", "value": "d7e2ab28bab242a09f258656898e8092853baebf56cf8a92dfd379a5860a987e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594005, "uuid": "9e7cde27-89b5-48c0-9f46-133e38295d11", "comment": "Malware payload (Mirai)", "value": "fd49be6e2213cf9300a703c2e1f6dea4215e0237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594005, "uuid": "d72bf41a-d735-4953-84f0-bbb801c76eef", "comment": "Malware payload (Mirai)", "value": "872ff7cd671217ed85f0b7aa0bc4339cd6d9950bdc653768bdc780191581edd0b7d5110eaadca83b0de0484ad770c165", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594005, "uuid": "728ec680-8aa6-45dc-b01e-30fba8180181", "value": "A5439E72D02E9D90C5950674B82C8E741F23A2C887622EF616D98BB26047AFDF51DFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594005, "uuid": "6f5e2300-69b1-4ca3-ace3-63b0d38a3d4b", "value": "768:Ro/ou3VtPiuaO5jb1ToaXz2eLeJpOQOOlt3XrX+6l0dIHuLfvCsZo+t9SmyCGd1:6/bbxhdToaXKK0lBrJ0iOLvbe++myCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594005, "uuid": "32a965d4-2c6b-414a-b7d1-477831dc8114", "value": 58772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594005, "uuid": "cd528772-8bf4-4297-aaae-fa16d0abb8bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594005, "uuid": "35e14234-ad6b-4159-96bd-4f155a4eac80", "value": "7f9fc7814e2f43d38b82f892f01b9fcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe98975-de63-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625580476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580476, "uuid": "f76af68d-3834-4a70-88e4-2f5bae183aa0", "comment": "Malware payload (AgentTesla)", "value": "278e3f82f8f8eec2d9d0c3c6aa882c2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580476, "uuid": "082bbe24-d93e-4f61-9b6c-3588dd4946c8", "comment": "Malware payload (AgentTesla)", "value": "d82f9a2c0fef75c112a93f35b5d13195144c2c70a4fc9daf9b5bc83099ff22fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580476, "uuid": "bb463b7a-6122-4f1d-a4ad-cb122834cea5", "comment": "Malware payload (AgentTesla)", "value": "4109ad0b5383ca2ada96cdbada225ff94a260f18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580476, "uuid": "ac71b836-7084-4852-bb7a-b703bf91d7d4", "comment": "Malware payload (AgentTesla)", "value": "355cbc8535bb4029d3e233e31d40cb606d4271a1d4d980811fd2c2beeeff23ca352c47495277e422dcb25a1bb826e3d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580476, "uuid": "a0060a6f-07e8-443f-9b22-c5f6281f82d6", "value": "F7D4CE5433AB5186F0668AB5B593ECF0D626BF612E12D25715C13F8B3923BC1CEC162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580476, "uuid": "077e3ff7-1102-4e50-bdc6-745da1cca54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580476, "uuid": "aabc0e6e-9b66-42b0-bc9e-37607b42efa6", "value": "12288:+qEgfGjwTIjbzlJrfE7t++WLjVjFD6qNQZ6kglHIG:Tgw0jbXDJjVjF+hZ6ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625580476, "uuid": "e03395fb-cac9-4078-8aaf-20dab757e87f", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625580476, "uuid": "83555ddc-1216-486f-b90d-9578a6e45584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580476, "uuid": "79698a9a-a813-4799-9c16-460bbe355b57", "value": "payment in euro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacb2381-de1a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625549275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549275, "uuid": "bea29847-102e-478f-8b7d-a9265447ad2d", "comment": "Malware payload (Loki)", "value": "fa7277a8a3a9202181490ffd626f57ff", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549275, "uuid": "af04d3a2-3ff2-4535-9f12-eec45a4d4fab", "comment": "Malware payload (Loki)", "value": "d8552704ee0f7077c48d86faa51b543e1e74a3981a94287cec5c6d4173f594dd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549275, "uuid": "7594f2e4-d7ec-4c7f-8a80-51d53427f406", "comment": "Malware payload (Loki)", "value": "65d3363c71e707a2017b48014f9a15d3042cbf10", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549275, "uuid": "175b6fcc-ee99-4736-a32d-c8bc22a02b19", "comment": "Malware payload (Loki)", "value": "3c72da50f9fd72e38041c1347ca2c43cc020b3b9e7198ed273b8194223081d5a9f15410d9d5e29d7de2be4d9f800b625", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549275, "uuid": "47f531df-bb0e-4547-aa55-a938561d6394", "value": "E6A42360B56BB211C9D82D9358B99910EBF73CC71BA76026799DCF82B0D03E271E8573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549275, "uuid": "1b645dfd-8846-4f60-b12a-375a30a8a4b2", "value": "12288:rVbajlxEkLyDoLhdydWC7+LWF3RFd/mm7RVVM7map1q:ZbU9yIhDC7+Kd/JWqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549275, "uuid": "217f43d8-3d93-4ab6-9bca-8d70318b2546", "value": 489296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549275, "uuid": "e0331a2f-6d74-436b-9cd8-2e904954314e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549275, "uuid": "a2900ecf-b2cf-4c54-98b8-1b0725b608a2", "value": "order list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1ff7a0-de97-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625602942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602942, "uuid": "d8cd503f-034f-4ae8-a385-4d0ca91d2bcf", "comment": "Malware payload", "value": "59420de7ed3a5745c831732deb9252b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602942, "uuid": "4a90e9f3-73a8-471a-b42b-be8477281a77", "comment": "Malware payload", "value": "d9ed8af079bdd7fef1daa51696fe0172d5170fd4ee668ed2f252cbe65a2ab488", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602942, "uuid": "8d0c2141-4c5b-4de9-b056-2458da75df91", "comment": "Malware payload", "value": "1395c7133fa2a1d27e00e9ee0c3694d24c7614bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625602942, "uuid": "cb189cc9-5ea4-4be6-aed9-4b1ffe35b408", "comment": "Malware payload", "value": "350454bcd6dbebcd6a653b011f8f942249bf4531cc03099e769c6bac4379e6e2c2e395bae6701f22073774a59f43a3d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602942, "uuid": "90df1929-9da6-4798-a85b-2d80741f4587", "value": "77558D3576729F92DD7FC7384331D13C4FB9AE66E207E67968E4388B64B0B410A16623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602942, "uuid": "484d7249-443c-4208-9679-5bdf666d3be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602942, "uuid": "b60725a5-70d5-4443-b744-68c64505f607", "value": "24576:+pyiOyVTAIduSWT94Z9fANE0VOaPknfV:hANcSi+beOWknf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625602942, "uuid": "78d0e80a-125c-4668-96ed-0cdfd8a7e5be", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625602942, "uuid": "13c0de6f-6c48-442a-aa94-7b6585bd7422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625602942, "uuid": "42065cc5-fc33-403b-aed2-5d6f113c286f", "value": "59420de7ed3a5745c831732deb9252b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3936518-de93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625601151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601151, "uuid": "ecb7d23d-6e5f-427a-9ed0-2639be65a6a1", "comment": "Malware payload", "value": "f0790267ab150ddbad57c8e958feff96", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601151, "uuid": "32606f01-71e5-41e3-8137-986666f1c52b", "comment": "Malware payload", "value": "da8a58c94e4f34b9c53b1439721156792e6cb53921be33d10763d188c6840951", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601151, "uuid": "96ad3fa8-bdd5-4069-a858-04cc7f14537f", "comment": "Malware payload", "value": "7db03a4205d3014e64304dca53cb825544575379", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625601151, "uuid": "4c1599bf-b124-4de3-8167-9c99a7a95324", "comment": "Malware payload", "value": "c31a7974f88ceda34e9bcb1bad3d46da5252d04ec7b517c0ce6488527088c44921ccb61c6a898e49ccb6efc3bd39e64b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601151, "uuid": "fe015720-93eb-4e10-8400-3400fee7492c", "value": "4713E15AC306BDA9DC9B6DFD630890E1544DB468EF15D29C1D20F3E813744876BEB38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601151, "uuid": "1f3dccd6-42e1-4339-838d-ae0cfb5b2c56", "value": "768:VejyZLpqRv6IbvuaL9r1dmMalF8Hi1qXiJB57Zd7p8ok35kquLUhrc:V7niLL9r1Ezl2SJHNd7phk356LUZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625601151, "uuid": "ee580562-ec69-4051-a018-c32fb2588d6f", "value": 41806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625601151, "uuid": "d7b69867-ba3a-424d-b1fd-906235c804f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625601151, "uuid": "5cab9e2b-7a18-4f63-af52-d22652365b31", "value": "SecuriteInfo.com.Heur.22690.5466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d88894-de56-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625575005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575005, "uuid": "24cfb8ba-86ff-47a2-81a2-88c67101ef9e", "comment": "Malware payload (IcedID)", "value": "0cc6b09bf83e879796b5de556a12ab13", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575005, "uuid": "0de6fd72-9742-400e-a667-c1508fc1e36f", "comment": "Malware payload (IcedID)", "value": "dac397b4591408b3a46e7d5e112814a8a48c6a16fa5a9088013997caa6601d7c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575005, "uuid": "0efb72c7-7ee1-483b-ac34-244d4d32c673", "comment": "Malware payload (IcedID)", "value": "619a030dbde55f98f2223860829a60079fd8b0b1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625575005, "uuid": "8cd4525d-cb3c-462b-8d85-297133091c4e", "comment": "Malware payload (IcedID)", "value": "c50346f86a1c9d0072d66e6bc358a9d1cd527cf41d090d9543beee323a36b4ca2bb2f7bd23619f924824da180d97e26c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575005, "uuid": "ba75b668-f639-4a9f-93a6-8a3e318e66d9", "value": "8C040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575005, "uuid": "0a3dd6e1-e9f4-4439-b343-bd0345e7d9bf", "value": "3072:eDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:8RcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625575005, "uuid": "1b5008b3-3665-4608-8dc6-cf83aefab233", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625575005, "uuid": "bbdb3f05-cec6-4a22-bf2e-cb26d91ff75a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625575005, "uuid": "cf8a02bf-7b11-468a-b436-3c2dd845593b", "value": "PI-210610.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26249a6-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625553448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553448, "uuid": "2e55d24e-ec0d-423a-9d1f-f3f1406c3f85", "comment": "Malware payload (RemcosRAT)", "value": "614d50b5c7d2ff9aa5610e84b81ec507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553448, "uuid": "fd960178-7da7-4326-b628-cddf71ddf61c", "comment": "Malware payload (RemcosRAT)", "value": "db8babf29b974495a10253b759bba6ac49b2c234819a44e2f96713792772fe46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553448, "uuid": "a65f14ee-e184-406a-87a8-fa37b58714ad", "comment": "Malware payload (RemcosRAT)", "value": "5db1c49ba936269eaa096e9ef29f43348f164a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553448, "uuid": "f18b0a51-6636-4fb2-8621-b375b2f7f3f9", "comment": "Malware payload (RemcosRAT)", "value": "525dbff7887ac1e7e8eb4c0d219e9f77afea250bce6c473befb64144016ad6c2d4466b8a43a18a927638640f8819db9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553448, "uuid": "20bdad58-926b-4f1f-b2c3-5a524ecafa48", "value": "08A4F1283BE95C56E53F9F7E8492B6018B79F2637613E70418D612AD0DB3780CC8666F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553448, "uuid": "7ab6af2c-5233-49e0-ae9c-425a12223229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553448, "uuid": "679e02aa-61fd-4bba-ac76-3b41f0210d27", "value": "12288:GW2OLX5AwPGpMFcIXL2xjZbkChTq0W7GHTb:0wPma6Zth+0W7GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553448, "uuid": "7ed8830a-7ebf-4bc7-8fa8-cd7efcd74352", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553448, "uuid": "dfe3d991-2323-4794-a3e4-ff75b17cd015", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553448, "uuid": "8f28279a-b744-43ec-aaa0-ac994f6d9e05", "value": "614d50b5c7d2ff9aa5610e84b81ec507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f4b88e-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625549669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549669, "uuid": "ee8f9e77-8314-4be5-bcd8-4b194dc75308", "comment": "Malware payload (SnakeKeylogger)", "value": "096fee844afc4eaf3074f150fc4e99c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549669, "uuid": "8d8dc853-903d-49fe-bac3-6b61e51557dd", "comment": "Malware payload (SnakeKeylogger)", "value": "dbc9cca23dc54168c95c7179dd37bbeca4569b3004dbd272b92cddeee7aa9580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549669, "uuid": "7eb6ccd3-c15c-43c2-9298-c946de8ddf09", "comment": "Malware payload (SnakeKeylogger)", "value": "8c42cc801049a8118c2a0d161c49ef33cf39e381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549669, "uuid": "d4566197-5b0d-4345-9b26-84aeb49cfe96", "comment": "Malware payload (SnakeKeylogger)", "value": "aceae17b489a1600040840f3207c723c287669f6c9d7c7a31055b96db23d78facd4c0e7dce0134d20cd67568f6d6c7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549669, "uuid": "775ac96b-1e6c-4a82-9ce5-ea76f4f33590", "value": "BBE46BB960765FA1EDBFC7380331251C4FA9B37ED25BF6B86D98B18801D0B450AD2927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549669, "uuid": "6d510cdf-5e58-42b5-abec-07dbfd1be2cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549669, "uuid": "49018e23-99ec-47e3-a28f-017a419415bd", "value": "12288:wCWP6NsBpZy3eD6Urs4lxLR/ZqOS6hCV6yZAM:wCWP6Nm2Cns4lxTqJHVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549669, "uuid": "c17c1816-4a94-447c-b682-48a7ae2fa09d", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549669, "uuid": "8c36c63d-3a15-41ac-8051-72c5f17983c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549669, "uuid": "d88e8372-fa73-4a03-b675-ec3fa78ff70f", "value": "specifications and drawings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d407dbe2-de35-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625560833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560833, "uuid": "ba76daba-7f58-4c0c-8292-7c0cc40b0847", "comment": "Malware payload (NanoCore)", "value": "938ab3b2b98cbcdddd6247401d02e59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560833, "uuid": "5198a22a-9d79-4e8f-a8a7-e5a28187e063", "comment": "Malware payload (NanoCore)", "value": "dca7dd77f1fc755943c0c40d5da39a200c79d6a2ea44d14f07f478b0b361ac54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560833, "uuid": "f8cc1826-1457-419d-b709-c1ca0378221f", "comment": "Malware payload (NanoCore)", "value": "1508e5b37417d2df63857541856f686bd404b052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625560833, "uuid": "d5c849af-b55e-45d5-a604-23ea5c3a1231", "comment": "Malware payload (NanoCore)", "value": "4b459612ea845e9eaef819c64137b1a9958f60161ff7afb1a6cb3d1bb73d8a5c61bd20c4d32c99dfb8787ed6e776c6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560833, "uuid": "ec4a9a73-d007-4fd7-ad73-e75a8f88e619", "value": "B6659DB16861465ADC6BCE34C3326E3C0FA77E79FD5FA6396940B14B32E76830922513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560833, "uuid": "505bd12b-078d-4c09-b008-424b83ad79ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560833, "uuid": "587ce90a-a028-43d3-b9df-5ecbe940fc5a", "value": "24576:rplGf6NwOaDaDa7LE5fP0MCURvbI2xQaoai:s44ISybCURk2xQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625560833, "uuid": "d44e7203-da2b-41be-8cb4-a88cf98f433b", "value": 1421824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625560833, "uuid": "ef6f728e-7a14-40cc-8c87-a6e4f452b303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625560833, "uuid": "88e789b7-e665-4cd4-b7ce-9d58da7aad4b", "value": "New Order July.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dd1322-de42-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625566146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566146, "uuid": "6aeb3e24-04e5-46ff-8910-1a340be129d8", "comment": "Malware payload (AgentTesla)", "value": "abca6d4743b6485aa8e1e2e0fd77e3a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566146, "uuid": "d68cc02e-7c61-4ac7-993d-091ee545f3c4", "comment": "Malware payload (AgentTesla)", "value": "de08947f488d86980ef31e514b608da067e819c4b70ee275d9c3d435e2edd50e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566146, "uuid": "df108008-4ef3-4a93-97ec-5029c81595bd", "comment": "Malware payload (AgentTesla)", "value": "a7694db2634955760a9f309af0f98631b1e66f36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625566146, "uuid": "37b4c8ff-80e4-473a-aaca-ac57f0fe2059", "comment": "Malware payload (AgentTesla)", "value": "5c6f56f77a2b922112d47256555102b482ab341533ac414618b8f1e0270a2bd9424a7c1f6907292362051932b504283d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566146, "uuid": "d9b654f7-c0ef-4293-b044-042c96bceaa1", "value": "61C423124BC804EE13209A54E96472A7773CDDCE5A1616A70C9FF958F5ECBCB63B242C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566146, "uuid": "9d05fbe2-31ba-40a3-a5d1-b9c42f3cf3f0", "value": "12288:F4fq6OOhXzIlPsCF8b6trF2tR4CXFYYv9E2g/cV73enTYJ0agE8yiV:F4C6Okcx2bugtRnOSOT/cATY+agE8rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625566146, "uuid": "415a98c6-21ba-412f-9c3f-88547103ae3d", "value": 578001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625566146, "uuid": "9eef27bc-c256-4c82-9adc-13ea63605f5f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625566146, "uuid": "afd390b8-aefb-4a0f-aa7e-617404ea22a6", "value": "3278_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17cb9e0-de62-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625580076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580076, "uuid": "0116079e-a5cb-4953-9561-0634ba1dcd7e", "comment": "Malware payload (IcedID)", "value": "49dda1569fdceeb75d6bf6b3cd293e75", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580076, "uuid": "63568f20-025f-4a0a-b192-b533489caf40", "comment": "Malware payload (IcedID)", "value": "ded09606ba0d53a60f51abcb8254decc7cb49e8a4e26ad8e97f6ee49a7dd12ef", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580076, "uuid": "39657cdd-49a4-413a-abe6-ffe306d52929", "comment": "Malware payload (IcedID)", "value": "8f77afedef8985e2c48a70d6ae082afc3a48c55f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625580076, "uuid": "3ddc0c0b-8624-4eb5-bdba-32dc10832165", "comment": "Malware payload (IcedID)", "value": "aca9a8f568f4269eca0c2b6bb6fbe76911f7dfd8ec7e56233e26e88cf491b57aa080e2106e96058793a7d1f1644fcec8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580076, "uuid": "f62f36b3-69f7-4ba7-a260-35ff820bbd12", "value": "6F040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580076, "uuid": "83bc8e29-79a8-4e83-af84-44042ba3b12f", "value": "3072:GDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:kRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625580076, "uuid": "732962d3-53e4-456a-8186-552af723c18f", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625580076, "uuid": "46dcee74-1342-4137-b048-cfc25dd666b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625580076, "uuid": "149d0f6a-4464-4998-8506-e69e97d61004", "value": "Vac.list07-20214862208.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7005200a-de2d-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625557229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557229, "uuid": "cde6a429-0a56-4dc6-81ce-0e8e5a4fb2ac", "comment": "Malware payload (DCRat)", "value": "4ee612e07e6c7c963d0a58f0051dc16d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557229, "uuid": "68f92923-e01d-483f-8482-00e397e496ba", "comment": "Malware payload (DCRat)", "value": "df0ab165ff7a9b6209a68f4369cadc5fea16be42e1fa4fd51eb3b501eb0b3455", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557229, "uuid": "2c83d8e3-afcc-42a1-b20c-d10073234f09", "comment": "Malware payload (DCRat)", "value": "568785c3fa2991f6bffb709feadd8341110aa9d8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625557229, "uuid": "ba6284ca-d2f0-4a42-90c8-6f2743b27e7e", "comment": "Malware payload (DCRat)", "value": "343ceffb1e51b69dc3aae577ffe4eba624110fc3d6498205fcffb9cbf2286aa8593ba649db5f18eb7d049b2124b07008", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557229, "uuid": "745a8270-3921-4161-a3f5-1ff14e0d3516", "value": "A6F439323658DD11D0691637E6EF44140FBCEE10B662DB977D5F33A868923A36E0D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557229, "uuid": "0e0259b9-ec4c-4772-ba57-b94d8f26046e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557229, "uuid": "672f4fde-ddb0-4558-91e6-ff4cfc9094fe", "value": "12288:byTr6Q4C0J2PErFSOZvh2W1l14Aj6mpqn:byTmQ700PErFx52KX4Aj6U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625557229, "uuid": "f49ed38c-8bed-4a4d-b872-d1500106a88d", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625557229, "uuid": "3ce2699a-7f09-458d-ac14-5dce5c172466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625557229, "uuid": "28c26143-4063-4f1a-91e6-b710ea18650f", "value": "4EE612E07E6C7C963D0A58F0051DC16D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd20ff9-de22-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625552446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552446, "uuid": "15994ab1-6eb2-40fe-8fe6-d9e60162ceb8", "comment": "Malware payload (DarkVNC)", "value": "7cf97a4adac74d6572746d1f27095924", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552446, "uuid": "c5d81834-9ff4-479a-ad87-28e1d1284d7d", "comment": "Malware payload (DarkVNC)", "value": "df3975291d9bf0dfafa03fbcda916bc31c200c39f28701d32dccf3523a8606c9", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552446, "uuid": "eaa57c82-72bf-4dc7-90e8-52b01824a3a8", "comment": "Malware payload (DarkVNC)", "value": "c3d8d30acd6dd466c446492d178046745a34bc17", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552446, "uuid": "2c92039a-8f25-41f9-8513-fd820ee77705", "comment": "Malware payload (DarkVNC)", "value": "88aa666661285d84ae2532741fb1793cad8111e4247414fca004b57b5bcd2671a2c517cf6a678bd14a75b843fd2a01d2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552446, "uuid": "084f5238-a533-401f-83b5-4e13e89db728", "value": "4B251291B980CBB1E68255304C36C3609A29F9637A374653F2B43B6B6D333C1A7D9277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552446, "uuid": "226f6514-2ddf-4618-a988-a884ecf2558c", "value": "8049f708fcb07ebf9462806c4a9d27f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552446, "uuid": "472d2ff2-1b1a-41fb-8742-dc096fc78d5e", "value": "24576:DUh6dg6gUGGR7UX+Eza5WRw7E+ZSi7Jz67WoloeUvM6s543RpD3xROs:DUODgkK+EAWR4hZLwseN6s54hpDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552446, "uuid": "14ef0b14-3895-4f36-b47e-db66aa1286a7", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552446, "uuid": "72dcc21b-9d41-473b-ae87-edd4391df0aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552446, "uuid": "2a9fb28b-33e6-47d7-aca9-955a3f29c163", "value": "7cf97a4adac74d6572746d1f27095924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3b6492-de8f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625599424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599424, "uuid": "3b3008bb-57d8-4a50-abfb-f73303c1d4e1", "comment": "Malware payload", "value": "f55674f7ad33caa4bf4377703635a560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599424, "uuid": "ac5bca5d-95c5-4222-b3d0-5b1a44398e93", "comment": "Malware payload", "value": "dfb623130e2f62ddd28a5b9914f898e539d31507d4a2bdbe6b60fc6d23f6dec2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599424, "uuid": "71d38ec9-3ae7-4444-9ea0-509e10d38b42", "comment": "Malware payload", "value": "7e3239ad22d845a76317a3be40971a957c1f6562", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625599424, "uuid": "2ca64ac8-699a-4735-9330-f923e27c95d2", "comment": "Malware payload", "value": "5b59a1251f77fdb27791cac7c7b0d36e91479e964d36bddcd673606ed81b75dce7a550ed8a78ade4367d25a328b0dde9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599424, "uuid": "c214f7ca-e488-4d96-bfe5-c4e71eeeaf11", "value": "8635E011F7914878D076C434CA638613DAB2B8DA0FA4EADF239492691F777E45B3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599424, "uuid": "a18352e6-4fb7-40f0-bec6-3d3806564756", "value": "9ad22365520b11a0847833f100aa3244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599424, "uuid": "a55b4d9d-ec65-4c33-9534-a0043073f6be", "value": "24576:3IJla39cGH0dc4sOlQCzA1abH9RKP3QUxq8mB:Alq9ih2sQaL9RKP3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625599424, "uuid": "5b8fc31d-536d-461d-bb5d-dc4a46ae479f", "value": 1089486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625599424, "uuid": "ea5eb191-cbee-4978-a3cb-6d5fccaed53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625599424, "uuid": "12148ff5-f290-4d9d-8e2f-bda59d9d9f7e", "value": "f55674f7ad33caa4bf4377703635a560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867b1068-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625587332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587332, "uuid": "85dd08d9-8068-40ab-a109-58fc5c1f08b8", "comment": "Malware payload (RedLineStealer)", "value": "e875e95cf096956c0aab4a8fe67c1f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587332, "uuid": "43814848-637d-408e-84fa-ff53324c4d7a", "comment": "Malware payload (RedLineStealer)", "value": "dfea33f3036fb635360fda5ce5a4b3ddd343fcfc2b7ca1c4065bf7a3d147466d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587332, "uuid": "73a64e8c-01f6-4f8b-ba9c-0708f904e9ea", "comment": "Malware payload (RedLineStealer)", "value": "c5573428292111c262c2a1c1c59bdefb7412f814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587332, "uuid": "9758222b-170d-45bd-b5fa-cba2fa9c7fe0", "comment": "Malware payload (RedLineStealer)", "value": "f5f9656d8412ab903bd1c8dbb724c3e755195428a190fe613415be3e34ffdfbf5ffa38d2645ae56b569df8f1e87d1134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587332, "uuid": "849dcb5d-68df-4cba-961d-07457519fdae", "value": "1254E0153980CC32C046B434A878E2B1667ABD2259759887B7943FBF6D323D367BA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587332, "uuid": "bee218a1-d497-485e-8b04-726bc2686fc6", "value": "003506e6827227a38566737581b07dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587332, "uuid": "61063432-a3cc-45d8-95a2-d7770e16fcb7", "value": "6144:rXd4f1cAEV6LL6LSJdvMz27tnPKzPLzn:rZoOLSbtPKzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587332, "uuid": "2eacb2a7-ceb6-4dd9-95aa-8b5b89f5d566", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587332, "uuid": "9b7a8216-1c57-402d-8d4e-9905c4fa41c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587332, "uuid": "7a616ec3-0394-44e3-aa6e-c50727d267c7", "value": "e875e95cf096956c0aab4a8fe67c1f89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699c18ab-de6c-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625584277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584277, "uuid": "acc93d39-748e-4044-8b5a-f6ae3ecb59ef", "comment": "Malware payload (IcedID)", "value": "17ca43c41202c41c6abae6e0e7b6ba91", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584277, "uuid": "35302f01-6b34-4836-9378-63df65697c22", "comment": "Malware payload (IcedID)", "value": "e104c204c8757b65dcebdbd5f8c480b90fe131339f1bae0a87b61f479a49c2c3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584277, "uuid": "4e08b66c-c87f-4c8b-a83a-be98743d9a60", "comment": "Malware payload (IcedID)", "value": "1657072df63d06f4ded461be21dfb037e51b8055", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584277, "uuid": "c0ced267-e0a3-414d-a9f1-6b62eece3b9f", "comment": "Malware payload (IcedID)", "value": "da9724b3ebf729562ae215bb5021d30a9dd834014c10bf0785cda60331f78c0a37a3f695503f51ea4c4895e899b093fb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584277, "uuid": "46a24a5b-d69d-4a41-a615-b75717af4dd6", "value": "47040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584277, "uuid": "f5918fed-6598-4092-a858-75c1f3efd9cf", "value": "3072:mDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:ERcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584277, "uuid": "1419169c-907e-455b-be91-6caefbbe24d9", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584277, "uuid": "bda7d613-81fb-4472-a3a1-f1705c0fa127", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584277, "uuid": "8e4430e6-36cd-4345-8503-b5272955274a", "value": "LL52387-01-F4448869.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2bad68-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625586536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586536, "uuid": "812b27d0-b53a-43d7-93d6-45a8d6a8b0e0", "comment": "Malware payload (Hancitor)", "value": "81fdf029792932a80da8a11d6cd65aaa", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586536, "uuid": "9ac4115b-76d8-4ba4-8af3-b542ca123c02", "comment": "Malware payload (Hancitor)", "value": "e1e0bfa5cabf7dc46f251327c46c1e371e67262ebb103ab242189e64bf6aa1d4", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586536, "uuid": "cc1cd9e8-c9e9-4f87-b095-541aa902936f", "comment": "Malware payload (Hancitor)", "value": "36e88472794783f63a79bdb9450ee324d9a75b06", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586536, "uuid": "12595511-fbc3-465e-bcb0-2793db81e28c", "comment": "Malware payload (Hancitor)", "value": "d5167695643c58f6f4d836943509b69d075db85897982972d0e0ecf88d715489fcba9cb0761ea113e224844d75e1ac13", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "MAN1", "colour": "#052058", "exportable": true, "hide_tag": false }, { "name": "Moskalvzapoe", "colour": "#654906", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586536, "uuid": "d3aaa549-e454-4e9e-8897-a2167ac2baf5", "value": "B5547C007940E570E6E322778F69E645437CB9200B619ACB33DC1A9F5F7B5E2663A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586536, "uuid": "6608c3a9-7309-4a80-ad99-f91f4c900f8f", "value": "66ea5ae56a1ad0183ee81e788900c71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586536, "uuid": "c771afb4-efc5-4f33-b8cf-c543dcdaced0", "value": "6144:FzU8/N+o/63hN1NcmZglxvDf7U9RG7yH+:mM+pimWlhWQi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586536, "uuid": "18cbc99b-ab44-45b4-872c-e67b2b3d8094", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586536, "uuid": "b3214339-7571-4ce3-972b-12981937df3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586536, "uuid": "96bf5595-5f96-4412-8be7-f8c7ae29b81c", "value": "niberius.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67cc8fb-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625586661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586661, "uuid": "40906d46-ad4a-467e-9edb-ec5c57644b9d", "comment": "Malware payload (IcedID)", "value": "1bb131c0d593286b2a3f3fe8bd5f083f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586661, "uuid": "0706376c-be7d-4157-9307-0eb69707d5c2", "comment": "Malware payload (IcedID)", "value": "e234c6e94413af5431ac01351ab09138fa43fb77ffe92e50ae34ee65949216d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586661, "uuid": "46dbc698-7421-4e61-a26c-f7930a9ace58", "comment": "Malware payload (IcedID)", "value": "bb722d8b26dd54ba708263b3540b0684f49ca03f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586661, "uuid": "d4b1d657-4bbe-4e27-94e0-c067b528359d", "comment": "Malware payload (IcedID)", "value": "87b2c135c4a8fa31e073f3ba3273a385f8b1aa6dc4106321303539ae6667204fcfffc2e2af672d452e977febb877cac2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586661, "uuid": "eb80926b-6009-4684-807a-7b5570c4e09e", "value": "46040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586661, "uuid": "55afef54-a772-45f7-9fe4-1aa3352416a1", "value": "3072:sDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:WRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586661, "uuid": "ba347ff5-2afb-4c39-b25e-1dff53535cf2", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586661, "uuid": "3c80e7f9-1102-402a-9417-73f29e83638e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586661, "uuid": "7e7a6e93-9421-4f92-a039-6c68190a162a", "value": "PI-166760.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc50580-de82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625593756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593756, "uuid": "be9c25be-f8c2-436c-bb06-20030b95bd54", "comment": "Malware payload (Mirai)", "value": "70c47744f9d5e1a111322d2b5307bc26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593756, "uuid": "dc3c0c5f-9320-4f6a-8335-35ba9b36fd72", "comment": "Malware payload (Mirai)", "value": "e2b70bfb5159ea32437f7d34945ad074e3a42d7d2c487df6dfda10586edd3d54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593756, "uuid": "251079e4-28f0-458c-8741-ed3e59cdd810", "comment": "Malware payload (Mirai)", "value": "9f57e213dffc30984660673106dca428c08c1329", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625593756, "uuid": "17281a37-25cb-449d-b186-3661d8bf309c", "comment": "Malware payload (Mirai)", "value": "99a4f8634267795cc63d9a21bcab98f236bfd36116d39048e10d77954ff4f1f3773cfc8b8d558b5777fc2f59eff09d11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593756, "uuid": "42e53727-194f-4c97-a120-713d4b65de8b", "value": "52338CB5C579EDA8D1544A78BE248F749723E100C6A32EFADA44C6699083EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593756, "uuid": "358f7079-25c2-415e-a7f0-effc1c7b5061", "value": "768:rauxBwtHSMsas4UQebjEjBTIztyWfs3IFG5eFUA/qwCqaoys1Cb:ra8BwtyuVTIz9fs3s0eFR/qwln1Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625593756, "uuid": "57a42f47-e0fb-4ae2-aa6c-cdd25813deed", "value": 51580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625593756, "uuid": "d2ba0932-e1ab-44d0-bd0f-7c2fb6f08700", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625593756, "uuid": "e98619dc-9ca9-4e8b-a1cc-a0c0122bba37", "value": "70c47744f9d5e1a111322d2b5307bc26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5bb5bb-de1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625550967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550967, "uuid": "56eaba28-1e7b-44b4-a1f7-2a9c403fc1f1", "comment": "Malware payload", "value": "0598e0f378a0e8d3017f35ffe0628123", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550967, "uuid": "bdc98f57-2256-438c-9be6-31df16d1d94b", "comment": "Malware payload", "value": "e2e06a05229d2f279463a463f1a6eb9956055490d0a4bc3a9326d76538fed28f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550967, "uuid": "92e22a0a-3ae9-4e63-ac27-e0670271dbd9", "comment": "Malware payload", "value": "1bcea1d753f8ec395d6d31693d1d6bc272cdedcb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625550967, "uuid": "69b2dac9-6222-4953-998c-2414e09bfdda", "comment": "Malware payload", "value": "fd3166ff9f043709663d6c9c9b7b47c44e34f2a9fe5060a0c15d857eb1cd9cdea7179d35bb010a1ad5182f265bf18863", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550967, "uuid": "dcf1c92f-eae8-4ab7-be98-769c5c481aa6", "value": "54451230CE959A39D8194033E9FEE9792866CC4C459881C8B78C375D1CF16B76F63A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550967, "uuid": "fa11dfcd-d0eb-473f-b016-d2f65e1d3522", "value": "24576:GVF68O7xKPv9vgrNcQ3AgEFHXiqUDU/tccccccRcUen57yb/:op3945cDYqUGccccccRcpg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625550967, "uuid": "e9eed785-41b2-4c52-8fdd-a6e7a22377b8", "value": 1171368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625550967, "uuid": "23d099ff-1cf3-4dc7-956c-a54e869acd6f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625550967, "uuid": "d145ce00-d48c-4938-a491-d93a28db1040", "value": "PO20210705.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799aa46b-de5b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625577002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577002, "uuid": "e5e221d7-bbd6-4e39-add1-cb0adb7c1f14", "comment": "Malware payload (AgentTesla)", "value": "47ec98089f0f384fd50cfebd35cdfd29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577002, "uuid": "6f762dcb-503b-458f-8390-550aca373445", "comment": "Malware payload (AgentTesla)", "value": "e31877ea4f4cd6511438c4015e6eedbbc1d9c4114047927c860a2352b2002fa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577002, "uuid": "477049f9-d9a5-4880-8d25-259fe8a20087", "comment": "Malware payload (AgentTesla)", "value": "f27f23ba10b086659fec5dae0ab13cc36c83c4c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577002, "uuid": "e861c316-12a2-4345-b9a2-af1fcdc7191f", "comment": "Malware payload (AgentTesla)", "value": "368e6de33aeccf6cb0ddacc6bbdc4f9747415636c8e65c0354ef35266e54a5f3b194ef8b73ff95c16aa1cf8beae2ebb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577002, "uuid": "952c50b3-caf6-4870-8074-eba58b59f052", "value": "43659E3576768F91D87FC7384331E23C8FB5AE66E207E6796CD8389B64B0B400A56523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577002, "uuid": "632d9ffb-a48d-4bdf-b9d6-c00af0fdfe88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577002, "uuid": "3ccf69c4-5e19-47e5-9599-294e1c96e1b0", "value": "24576:niOBabGJaTUxFTTnNPs2SwDwbxYBcmv5npb:njonUvNPs2SOw9Qcmv5np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625577002, "uuid": "c2cb82a8-56eb-45c1-903b-51d149782ba0", "value": 1443328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625577002, "uuid": "6c4c93dd-b85c-411c-934b-816b4f50076d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577002, "uuid": "ae51da17-e226-4b4a-813b-d3a8b655836b", "value": "Proforma Invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e907b4f3-de88-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625596517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596517, "uuid": "90c17cbb-87c9-4210-9d72-32e27c6f3e1a", "comment": "Malware payload (SnakeKeylogger)", "value": "30e4197115461aa885357e4878f70fab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596517, "uuid": "5f6b2d55-e3a2-4dbe-a92b-f0f810694577", "comment": "Malware payload (SnakeKeylogger)", "value": "e338a82f086b5ab3388c33134f23b619b286acfdc3c33591b6936131b58f3654", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596517, "uuid": "c15e5793-bf76-4210-b679-506afc073f10", "comment": "Malware payload (SnakeKeylogger)", "value": "83b2a99860eed93260361949ca4ad6f55ff042b1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625596517, "uuid": "18ecfff0-13e3-469b-bd00-c723cc818a13", "comment": "Malware payload (SnakeKeylogger)", "value": "7f2faa9183437fcddbdf2532b4f707dd2c2f17f9b4d8de4ae3ea22799c2ff6219685cb19cda3e5a682700c21577aa6e4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596517, "uuid": "1f79be76-e05e-4636-8d12-cca1a80b17b4", "value": "5A84459411CB82B2E6885E4D35C0B1895A35FE9630CACC2A63AECA71DF557F62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596517, "uuid": "d6061196-e431-443a-b5f0-a29d757bb580", "value": "3072:9rBrB2BrBjhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qH8hNmfhi4txeHry1oziLmNmT:bVcVjWhldzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625596517, "uuid": "89f5e3e7-47fd-4f7e-bf56-a335a7e8bdb7", "value": 377263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625596517, "uuid": "2d8bf4fb-50c9-49b5-ae2d-68e60aa12733", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625596517, "uuid": "4202f0a7-7d09-4249-907c-34f419529e25", "value": "02788.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cd8577-de7a-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625590386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590386, "uuid": "de8d2e48-3ec0-4e23-9375-652697c211e4", "comment": "Malware payload (Hancitor)", "value": "ff8dc103b0786e67e4411028bf242c3c", "object_relation": "md5", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590386, "uuid": "f9d2b2a5-e4a0-42d7-958b-4ddc94fc9b22", "comment": "Malware payload (Hancitor)", "value": "e341ac6d35df89d0c60edb100ff789af32d10f5fbf9706d7f53e8cdb0e712455", "object_relation": "sha256", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590386, "uuid": "ce639b73-e464-4014-9c25-214950a0884b", "comment": "Malware payload (Hancitor)", "value": "45d74702a5ada5dccb7da0571d5b54b892a73ea3", "object_relation": "sha1", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625590386, "uuid": "baa1b84e-10fb-4acb-abed-df9c0e1fd710", "comment": "Malware payload (Hancitor)", "value": "ecbedd3296c6bb771ae0c5373d9ee8fd96c1a80103385ebaaf24d68ea39b4b3b1c5be45924d522dedabb483894be36b4", "object_relation": "sha3-384", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590386, "uuid": "f467aa2a-6002-4edf-a331-ad458ca4de41", "value": "5F745A007940E971E5E312764F69E686533CBD110B618ACB33DC3B9E5F3B1E26A36762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590386, "uuid": "1aa933af-146d-4098-862a-7e49fc327d53", "value": "66ea5ae56a1ad0183ee81e788900c71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590386, "uuid": "c597aa41-1175-4f7e-b606-592c41ae63b3", "value": "6144:FzU8/N+o/63hl1NcmZglxvDf7U9RG7yH+hJ:mM+pKmWlhWQi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625590386, "uuid": "55b798bb-f637-4cc2-823d-514729de8bc9", "value": 337807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625590386, "uuid": "77535e76-9e15-4a40-b25a-b1b3174f913e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625590386, "uuid": "0046dfa5-1097-4bc5-9df1-003f09e4fe03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300b25b8-de37-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1625561417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625561417, "uuid": "2d89e0b1-970b-4c0e-9164-aed84886f863", "comment": "Malware payload (AZORult)", "value": "969bce490447eedf6d1cf92c386c1b5b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625561417, "uuid": "38eb0507-26bf-4325-9fb1-aabb6581b9f1", "comment": "Malware payload (AZORult)", "value": "e3bc33f8f278375e95701a88b109d66c4996a3ff79b38989944fbe77be092409", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625561417, "uuid": "214d0968-4280-44eb-b80e-b7d81a4317ea", "comment": "Malware payload (AZORult)", "value": "45e9f733ff00a14a175e94698a59f6a9fb36e97c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625561417, "uuid": "1c4a17ae-a96d-435e-b7f1-1d9121d8aed6", "comment": "Malware payload (AZORult)", "value": "e2b985bc564ce858c08ae3c44cc74baa1a0ca9ccd3859664f366c53645fa68f9a483a0af08143b2ac7eb1fcd7f1b238e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625561417, "uuid": "ba8ac8c2-dde4-4b2f-80b5-ae5fc50ac1eb", "value": "25B32A6EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625561417, "uuid": "a97f6828-29e6-49bc-acbe-1c0ded149665", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625561417, "uuid": "8540fc68-a351-4358-b2b4-97335978bb35", "value": "3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiVq:faO1tme++wiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625561417, "uuid": "f98db420-9b48-4192-9bd3-1efdf11d9ed3", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625561417, "uuid": "6b5b20df-1884-4c76-a6f5-830d37cc1028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625561417, "uuid": "8c194660-3c8d-4399-8c43-ea542b39b40b", "value": "969BCE490447EEDF6D1CF92C386C1B5B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0aeaba-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587155, "uuid": "ca0b410a-3af6-44b1-a323-012d5d3c7f87", "comment": "Malware payload (SnakeKeylogger)", "value": "af9bf2a1caa27452a74eb41b0965a0bb", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587155, "uuid": "300791a8-8b35-4c45-b3fa-321368110fe0", "comment": "Malware payload (SnakeKeylogger)", "value": "e4c8e9763193a01d78b51aa2534b8303c8956100cb261a6963f04a87fc6ca8fb", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587155, "uuid": "66c2f4d9-6869-45b1-97e0-9676d1330e88", "comment": "Malware payload (SnakeKeylogger)", "value": "bcebeff93c24a6d8124c1ee0ff66d2a9d625a648", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587155, "uuid": "b3352708-9aa4-460d-bd95-899623d8ae87", "comment": "Malware payload (SnakeKeylogger)", "value": "4c0cdfc83d7c8e3eb4eafbcc19e6537fd9cebf85244f96fe238d3f38d102bcaf24c30815e2a4bab3e27e7e42e0d30ec6", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587155, "uuid": "b275df11-6f22-4670-bc80-5623516b8210", "value": "B6D4232BC2700DA58583FED437EF0A8CBBB625D425D96DE96C9539D3F1080A19CC636E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587155, "uuid": "00d94c4e-9c9e-431e-b1cf-aa2a062da1c6", "value": "12288:dbWDumXQpwybOKsIy/+x27OydlYjRzH2nlWbeZqV8:gW5snog6H2nEKZqV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587155, "uuid": "181d214d-dc8e-43a2-815c-55f738e249c1", "value": 650001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587155, "uuid": "0e72328e-f154-4686-8f80-ff75e379dac1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587155, "uuid": "c4ffc7ee-bbb1-4586-bd48-4da8774d8351", "value": "order receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4b3ae0-de20-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1625551556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551556, "uuid": "81273bc4-deb2-4b85-850d-f9153745e2e8", "comment": "Malware payload (AZORult)", "value": "a3dbeaa36032b66814b35b4a2c55e7b9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551556, "uuid": "627f7a2c-ea03-4f09-9b76-48631db09e6d", "comment": "Malware payload (AZORult)", "value": "e527a09fd4103ed98f35618828fbd40d87b81dce2c1693e5574f126ee3c4cfa6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551556, "uuid": "e70b0801-480e-49c6-81ed-bca0cd469881", "comment": "Malware payload (AZORult)", "value": "4905f024c9a8ee1f8e23cfdbe5741c33d84abc6a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625551556, "uuid": "0c2f4471-78ac-4e57-85e1-8eee6b4ff7d0", "comment": "Malware payload (AZORult)", "value": "d27f71dbe4a07484969fa6baa62e75045a9ef3f1f68db60d1fa61ac66ba309ac1e41c20332248f3bce0a8ba69ca6adc4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551556, "uuid": "c7be2969-2ce8-4aa0-befd-65eeb91de1c3", "value": "27B3197AF6C19272E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551556, "uuid": "b27e8c9b-5447-4488-baa0-5b12b55d11f9", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551556, "uuid": "461b0cb1-74a6-4738-9e23-ba5ce452a0c6", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/sxg/:Zzx7ZApszolIo7lf/ipT/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625551556, "uuid": "8401f4ad-e084-45eb-83db-683057179ac0", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625551556, "uuid": "cd602cc4-b201-4d04-bc36-f6c1e87b3c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625551556, "uuid": "669f4eee-b8cf-4702-b761-71d752d601ac", "value": "A3DBEAA36032B66814B35B4A2C55E7B9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ce8803-de49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625569299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625569299, "uuid": "f66df100-91cf-4437-9ec9-fd2063ef7cca", "comment": "Malware payload", "value": "27932c8b99c02eed3fd15c99a0ba73c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625569299, "uuid": "cb35690f-e6df-4ed6-ac7d-54e7e6717d8a", "comment": "Malware payload", "value": "e595e9bac7fc8566bb3bd314c44f7743e6256e04ac8ac858dab5ba98603780a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625569299, "uuid": "00b60f55-4719-4837-b947-30dab4b39464", "comment": "Malware payload", "value": "86c135d3841199c4173360a4eb74503ca9628e19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625569299, "uuid": "d40c5da6-3f43-4d91-b937-3926602cdc8a", "comment": "Malware payload", "value": "13ed56b84a690b472252c2d4b4799ddb21f3d67d0cfed03ce77b66a84298aefb2bfa75a345765abfeefc6735fb8bb721", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625569299, "uuid": "ed9a0145-b9c1-424b-ac94-e04adf42e7fc", "value": "8E641287EB36BC1FCF001AF225DB4B9D986C775B82C7E0A5B9C0814F17E21857AD2294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625569299, "uuid": "00331bd5-79d9-4a51-b66c-132fdc9709f5", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625569299, "uuid": "86669b80-f1f8-411a-a1aa-b79d51ad932a", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625569299, "uuid": "db71c668-7aa7-44a7-9fbc-8a121c08e500", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625569299, "uuid": "d26541c3-4ace-44fd-bdfc-4c0499939e75", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9031fcfd-de75-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625588207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588207, "uuid": "2265f33f-2ea5-40d5-9002-6c363bc6ce94", "comment": "Malware payload (Formbook)", "value": "f3153f7aeae742a3c3280adf4678ddbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588207, "uuid": "3bc1697b-34a1-4c86-ac14-e27aab742ce7", "comment": "Malware payload (Formbook)", "value": "e6240df97fbd4caf6de8daf69465e70b2eeba604738b9b2ae6a978494a614dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588207, "uuid": "848f7b56-13da-4063-800c-4c641e7e7ca4", "comment": "Malware payload (Formbook)", "value": "81b4ea1241190720806dc972fce9f80457ccc6a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588207, "uuid": "7f6e27b5-ea79-4e67-811c-210f722a9621", "comment": "Malware payload (Formbook)", "value": "ee2cadf7d74c1467d71b40620a694b632459bd24526a3af60a71d2885a11e436c39265882438f9114c48dc8946b15259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588207, "uuid": "cb0d44ef-89de-4306-a55f-ed075bd7d14f", "value": "01F48EBA60368BA1DDBFC6380730EA3C4F69AF76D14BB67418C47C5730C1B550A66927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588207, "uuid": "98234432-961b-47aa-b931-cc44cd0b19c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588207, "uuid": "730d1913-d4de-46b0-81d5-b94bfb698705", "value": "12288:0T6NsBonXmuhDzHYST8OQWtcNRpp9rzUX9eA6Ul4E9DERH1QjHR7:0T6Nn2uxT8OvONRppuX9zOCgZujHR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588207, "uuid": "11851359-fa64-473e-8112-a5c0b0d823d9", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588207, "uuid": "0881b5f8-972a-41d7-b1a9-338615c995fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588207, "uuid": "07c11ee5-0793-4c15-9498-41c749e43525", "value": "f3153f7aeae742a3c3280adf4678ddbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab32f59f-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594265, "uuid": "aa92d22d-7add-49da-a647-0c5ed920edcb", "comment": "Malware payload (Mirai)", "value": "22da58d2c0c68f4250ed016557994a27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594265, "uuid": "901ee4bc-1eda-45f4-8e8c-2cdc67c7ba59", "comment": "Malware payload (Mirai)", "value": "e7d675b79de4935adf931a3e7554f659e81f45be37d2aad36f04b82bb983a0cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594265, "uuid": "02217c00-7095-4c5b-93c9-aad42da2a46a", "comment": "Malware payload (Mirai)", "value": "32cf77d5e81bfd2c3597455a04d0ce28c3776587", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594265, "uuid": "aacbc744-7e94-4301-a116-c6ad7ce45e81", "comment": "Malware payload (Mirai)", "value": "88ab35335b9e7f89dcbd9bd640841ec7438608f3aedc9fa9fcd553e688dd20d4b0f2819a87592564cd50d06b1229e947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594265, "uuid": "5b49a8f4-2aad-4ad7-838d-544c4ee9c6d6", "value": "9BD2E1625A21FEF2D5F10B38FB774EC765761E7AE190308A2A7944E8E485B055EF8403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594265, "uuid": "7b5f5a9a-e3e9-45fb-bd0c-983ea404e26e", "value": "768:7usHfRavjycYC5HkU82CgLOQcVyaWn4RNSLH9q3UEL4P:jRwydCRh8mKQcVblTmWLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594265, "uuid": "8ee27f04-af2f-45e0-b455-c0f446ecc18e", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594265, "uuid": "26195ce7-c785-499b-9403-7b62fc0f1ce8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594265, "uuid": "4d351326-434f-4372-9d3b-09c536172344", "value": "22da58d2c0c68f4250ed016557994a27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de7163d-de32-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1625559239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559239, "uuid": "a54f8fe9-f616-4627-b96a-7cbbd37747b7", "comment": "Malware payload (Neshta)", "value": "da08fd5cc12c1d7d906c6151a93057aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559239, "uuid": "bc02b36f-63c0-4068-8663-563d5fe0d86a", "comment": "Malware payload (Neshta)", "value": "e82473f02711056cbcda98d22a858d95c6cf574c17ee77ea62db86e405ff6e77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559239, "uuid": "a1832b33-06ca-4137-80d6-710f26f03589", "comment": "Malware payload (Neshta)", "value": "fd269e07c0baced682bee5fa67f185f40d63ff54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625559239, "uuid": "ca090a11-1741-419a-95aa-aaa58163dbac", "comment": "Malware payload (Neshta)", "value": "b27d1f402db2c98465cc4a0acbd370513c3a2510347c1d8d196f5149fcd323c3a48e161344bbf691bfdb3d6f750ab837", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559239, "uuid": "652230b4-84b2-49d9-b549-03af4a7a0318", "value": "AB254A35A2FE5A61CDEBC7F48F7052BC4F257EA5FB1AA23E448575080DB0B610E15A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559239, "uuid": "675f3372-1b4f-4f5d-b03f-c4796e29290d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559239, "uuid": "3b051b82-ca89-4175-bb62-6ee1a5d25074", "value": "12288:zMnx5v2K+Bia6NsBoWdyTDbMJOAfT1R/hwZQojkIyWiE:Xua6NedyPbri2Qo4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625559239, "uuid": "99017ec6-b27a-483a-be1c-e1a210ecf580", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625559239, "uuid": "4f2650ac-0ff7-4afc-9f07-6d1dd7bdbb3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625559239, "uuid": "c3e3510d-6c2c-41ec-aac2-da2534ef2fb1", "value": "da08fd5cc12c1d7d906c6151a93057aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c874f97-de9d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625605300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625605300, "uuid": "c8bb9cbf-e130-4dab-90d4-69a5b6234038", "comment": "Malware payload (RedLineStealer)", "value": "977ccf2c8340b1753bbc7b5ff5b6aa42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625605300, "uuid": "b3e33359-61e8-4fe2-9871-8f04d0101f73", "comment": "Malware payload (RedLineStealer)", "value": "e847df752cdf152d99368308ea05bd7d98b2e7ceecfd77c82b9d93d11cf2c429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625605300, "uuid": "fba82bad-2b86-4784-b17e-58fc9491a8b3", "comment": "Malware payload (RedLineStealer)", "value": "709e0d5517a82e856e17a75773dc1d38e7787bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625605300, "uuid": "4a96ccfc-9ba6-4834-8e25-92554a542758", "comment": "Malware payload (RedLineStealer)", "value": "6f8cbd6ae8088b062ceb668cb7a4f7e9e42d27ee5b3ee8ec3f5da5cadaede633c868171f333194b7e44505be3a00375d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625605300, "uuid": "20311b9b-d707-48de-a941-ecf3eacbadde", "value": "62D43A28657FD019A1E3EEA16DDC68FAD98A55E7210C743711B1733B8B12B80DE8F439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625605300, "uuid": "a445b316-2e15-4262-889e-47608ffe1481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625605300, "uuid": "060783b6-9582-4f64-b47b-528893f2f574", "value": "12288:NY5Y3fbC6t/q7q+GsLuy6TyVwO9e4QGBFFFFFncLjj6zRXkJjjjjjjjj8AKgK:NYeGcCYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625605300, "uuid": "abaaface-a711-44e2-ac3b-93cbe3348e1c", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625605300, "uuid": "20e682ba-bae6-4ed8-bfef-4534050f9d32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625605300, "uuid": "94df4b4e-25c7-4387-9057-0fba21f3e331", "value": "977CCF2C8340B1753BBC7B5FF5B6AA42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6719fb5a-de6d-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625584702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584702, "uuid": "4ea944ae-700a-4a6e-86f6-4e20235618ec", "comment": "Malware payload (CobaltStrike)", "value": "f15cb85951ccdddc8f97651935b558c1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584702, "uuid": "2f015ff5-2543-42bd-9835-e413a4c6d5b6", "comment": "Malware payload (CobaltStrike)", "value": "e95a5072b5ea6d8392293d20e71ff452e9863200d786e8c80d65c5f01d14e768", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584702, "uuid": "f823cab9-d2a1-46ec-9db5-5c3f140c899e", "comment": "Malware payload (CobaltStrike)", "value": "7212d262ce8063b8c9fac74d9383550762b23369", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625584702, "uuid": "a87e6dca-7cf8-41a2-bb7f-f0217282544f", "comment": "Malware payload (CobaltStrike)", "value": "7a0ae74decef97d469e3da49a149a9d9778e839562cacd60f91b161707e1abb58a6d1f0fc3e2c79e3cf1ef84b7306643", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584702, "uuid": "4195c917-076b-4c0d-b9dd-5a2bc818ee2c", "value": "FC63CF24E79919BBF26480B4F22A59833908AC777011ED1454EB345FAB87FB61DBCF12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584702, "uuid": "fdfadd32-c296-4332-b146-a38082dcfaa7", "value": "1536:SkhEtPBDdExnKaal40y+sUKHtg3eLmsqU44444444444mnwUXY:SkhEtPFYKaal8UqY4V1XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625584702, "uuid": "875ce0d3-94e1-46b5-8320-9c8ac55be9a1", "value": 68223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625584702, "uuid": "7b6f8c01-2230-426e-9f42-36d76e9f1bc6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625584702, "uuid": "acc4b25f-b0a5-434f-8e23-20bae793cf13", "value": "Reciept 8174939.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10202be-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1625587081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587081, "uuid": "7d0772c9-cea4-484b-9fb7-015bc4c00c98", "comment": "Malware payload (TeamBot)", "value": "0667417f5602a4ae8c288a2884d2ef9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587081, "uuid": "6f8c5409-89e3-4168-b4ec-e77bc44cc1e9", "comment": "Malware payload (TeamBot)", "value": "e9dda7fbf6815a714cac3c369a5c7f137db0c53b09a804db968612d17bed855b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587081, "uuid": "7940a133-9a54-4402-932a-76651074c4d8", "comment": "Malware payload (TeamBot)", "value": "5e04aeb10fff4ed0e651c4637653fe4a4afa488a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587081, "uuid": "edccf3f4-d167-4ab7-98a0-fd087cf2ce61", "comment": "Malware payload (TeamBot)", "value": "21a1e6cf2776c3b45390d1aeabaec6ee0d7f649f643fb68262163a80a5b480caaa61b813f0fa08e4595e970c7dd883e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587081, "uuid": "f3f3dc29-9e06-47e3-bd46-e076fc663f2b", "value": "87F412107290C832D4AEC9389525C6B19675FCB71872854AF6B43BAE7E733C196FA307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587081, "uuid": "2334dd2d-fa7d-4408-a0f4-e0bef61a057b", "value": "bf75b6a7e9bbe496f6577b7caaf09471", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587081, "uuid": "156122f4-2cb6-4e68-9445-2110f5783b03", "value": "12288:tDepDarKnoq2VwAIWvL5OQooHZ78831DAc95KUGNtth3vjZn/iwQ52yK7Ksx:tOiqC/IwLgQblj31DA3UGN1Ld6X5TRsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587081, "uuid": "aad1557f-3d96-4bea-86f9-765885267e44", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587081, "uuid": "f029af22-2f5a-477a-a165-b919fb7775a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587081, "uuid": "179ba12e-bac9-40c8-bc03-68857ad111e6", "value": "0667417f5602a4ae8c288a2884d2ef9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c3b085-de75-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625588022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588022, "uuid": "be57e348-d451-42ef-8f1e-e4c01cb176fe", "comment": "Malware payload", "value": "f0f00e70e87422684c8201b5b7a43789", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588022, "uuid": "86837059-1c8e-4545-bf8a-aaec8509d240", "comment": "Malware payload", "value": "ea7d8e41a3e7717fec637ef6892a81b9214cef5c40cc68ce1e8f5607ef6c5dde", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588022, "uuid": "2268cb79-d4eb-4121-8c3e-3ec40f5ebac1", "comment": "Malware payload", "value": "97be8f72329d85c1f9fde70d394583bc4ce3aa1d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588022, "uuid": "edc4cdc9-6987-4608-995b-1750a198abc6", "comment": "Malware payload", "value": "9fd1c49dd98a83dba1cc70d295f1c3b1cc92607a463337d81eef29a571f22bdc8b3f8a024371b6360084150442c9e6cd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588022, "uuid": "a23acde2-d9b4-4d33-9981-bca8a31f614f", "value": "7DC1FA1B42456E79D550780F32CA1C9E63BDCC487B72CD8CBC998883F4553B85BD4876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588022, "uuid": "646e7ed9-caa1-4585-82e8-c127ba3d191f", "value": "96:L/TBjyQTEVsNDy+qU6w6U5rhxyKZwx2J7+HWYffs:jdyQNItUCsGWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588022, "uuid": "d4e2d56b-839e-40f0-9dfc-65b784cba51f", "value": 5946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588022, "uuid": "9e40c96a-3b03-492c-a81d-5549b98395b6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588022, "uuid": "197a46a0-cc40-4385-8b3a-dd9523169f3e", "value": "Archivo__RNVIAX4YHZKWXMH.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79711c17-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625549514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549514, "uuid": "def1002b-6ca4-491b-a398-5242171dd844", "comment": "Malware payload (Dridex)", "value": "7425d5f4f1967fd02b05dabd91c8fd2a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549514, "uuid": "796dd91a-28f3-4e10-8959-b4d11f8472c2", "comment": "Malware payload (Dridex)", "value": "eb038969c60d9ec7d12285601f108484afaf40d78c495d86d1c24292e99776d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549514, "uuid": "c11de6f8-14e6-4324-908e-08f70a2e34c8", "comment": "Malware payload (Dridex)", "value": "9da79c5cd6a88888ea6d486e35a9ae51385239fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549514, "uuid": "553a9959-39f9-4469-b5c5-790fd5b7e5f7", "comment": "Malware payload (Dridex)", "value": "0a278b67d5640934ba05d2c19d4f13dded3b541c799723fb87711443c24ce36620f9e5526e85bdbcf8fb4957043fe6f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549514, "uuid": "de3fa8aa-cc70-4f58-9761-3d8a7ead8840", "value": "63351228B727E4B7C15989F2CF1AE062F369DD1687311843FA4135EEE6FE5D4042A8C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549514, "uuid": "085182bc-a4ec-4305-856b-4c70da4cef66", "value": "b901ef1059d98768174c5d4a31e37dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549514, "uuid": "166eba43-e4e9-41ec-b19d-ba3ce11520e8", "value": "6144:4Lp9hRjTYUqVkdvSz9EEiZcEiP5rVxosqlO5kbaMzY2n5WbJEXVbpw+rrJqA:4L7h5TY9k0xEEi/iXVqI0Zn5WkFhqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549514, "uuid": "0072293f-d1bc-4d0a-bd8b-dc90bc6f88e8", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549514, "uuid": "b3a434d3-3177-4b89-9ba3-8cd456a0e7ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549514, "uuid": "3f45fae9-00a8-4224-864c-55117a308898", "value": "7425d5f4f1967fd02b05dabd91c8fd2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bb4eb7-de60-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625579138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579138, "uuid": "751b9e3e-5a7c-402b-bb4c-db7cad03bdeb", "comment": "Malware payload", "value": "ad8c9d7a6447022aaecde3d143f0a6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579138, "uuid": "74bb72d4-8a31-4a46-90e8-d95c1fda7e92", "comment": "Malware payload", "value": "eb155106c364e9ab6afcc98d84109909708cac447e081052f48f0b3f5a487130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579138, "uuid": "d6f84857-4f6c-4638-8c46-bb8bb6004b77", "comment": "Malware payload", "value": "cf56395c4564375b8c89fc35980ecca82b3522c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625579138, "uuid": "a626a0b8-2a1c-4236-bc95-502a332dd9c1", "comment": "Malware payload", "value": "e3d563fffda7934590eaf4413a52224705ce2c21fd3735068c6aa0e9c8a82a14aa7a13d13b25106fb32847c281f64725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579138, "uuid": "60de8415-8cd4-4202-8b07-d29f5ebfe143", "value": "8E248D2136C2C073E167017149E6C7B877B6BC53AF76928F6B903B0D6E701D69A347A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579138, "uuid": "27014d5b-986f-482a-81f6-5c26241ce0d1", "value": "476c2f37c8f9c416c2c214d15216e40a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579138, "uuid": "4b3fd280-f1c7-4439-8a1a-2ac942d2dae1", "value": "3072:a5mVSQoU1aG0VedDz2grufrSoH7XMBclT1CLevWGtVE0kFT2C:UmoQoU1anVCfoBrMMc7h0kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625579138, "uuid": "a55d7452-e333-4e9e-95b3-cc5bb8a4917a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625579138, "uuid": "c4f0bddb-440e-427c-ae96-8de1171252aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625579138, "uuid": "58174b0e-1c26-40c4-a5b5-7bdfdbbe00c5", "value": "My_Cursor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed33b7-de83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625594285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594285, "uuid": "e03d88a7-7637-47e0-9b70-af6e6824378b", "comment": "Malware payload (Mirai)", "value": "650081d08b01c8b18c9c715b04e9bca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594285, "uuid": "c0b138bc-246b-46cb-ab2b-2a6400cc3b17", "comment": "Malware payload (Mirai)", "value": "ec00875c3221814ffc67adfe3d4416d8f4a206eeb394fef11bedee56c6d11e0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594285, "uuid": "280fa3fa-d989-4ec0-ba8b-58104ec7e838", "comment": "Malware payload (Mirai)", "value": "2e7dba2cdb2de9950f0040fee80fc06126ed9740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625594285, "uuid": "1051fb34-c182-4683-833c-9b7eb4ae0f64", "comment": "Malware payload (Mirai)", "value": "87b66dd609361f9977a700cf411390a3ee8b7b18c69152d0d6fd670ba821d4ebcba39991d9fd4cd1989983b31ef81105", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594285, "uuid": "4d74421e-963d-49f8-ad3f-09181207b545", "value": "1613F796F8824D26C9D8137AB57E06CD376063E5E2EAB313CD105B643BC690B0D6BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594285, "uuid": "3c06dd20-8bdd-40ca-9e3d-309576e13ec1", "value": "768:LostHW3/aoyLiQZQbNBMs3fnnT1i39jPjxGO3H+lH5MUhj7j7QQd+QvN6vGcz+jK:LZSioyezfMsPT1iJMSeDhDVdPcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625594285, "uuid": "a0535c21-0465-4ce8-ae59-ee2539ef0775", "value": 44880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625594285, "uuid": "07d8642c-d28b-4e93-8203-1432955626f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625594285, "uuid": "330cd62b-de49-404e-8301-00ecc9c49a43", "value": "650081d08b01c8b18c9c715b04e9bca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a119b3d6-de29-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625555594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555594, "uuid": "b440d4b4-0be2-44a1-b4ca-2cc7f1377e3f", "comment": "Malware payload (DarkVNC)", "value": "62b86552c8a9538ac56d3f4290077a05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555594, "uuid": "7c87408b-1009-46cc-9ded-ccdd99fe1ef9", "comment": "Malware payload (DarkVNC)", "value": "ee783c78243f95e6128d37eaf546a5979213e85283814e8f8ca18e4a3c1a8fca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555594, "uuid": "dcfee532-7218-43f6-83da-df0c72bc8a54", "comment": "Malware payload (DarkVNC)", "value": "3aa2a69ce50be8089760e8bc5ac65a06c25dbb16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625555594, "uuid": "716754b1-a556-46f8-a432-e2eb27aa0f7b", "comment": "Malware payload (DarkVNC)", "value": "f35407a2418f4f6250aa07ba75a4770445cf72a4f2e2d48d56d004416763821818f10f7ee5ea2c12cd1b1f449e5827f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555594, "uuid": "69a34000-09a5-4dd5-9da4-3d8334aaa0f1", "value": "9C2522617D99C976C16A4C301474D7711373BC22693ADA0AFAA4372F7F3228099EE397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555594, "uuid": "2090707f-4791-44ed-afe2-132e0985221e", "value": "7775b42d117d8771820bbbd647e04dad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555594, "uuid": "2e7af6c5-d197-4656-af30-e2c751f01aaf", "value": "24576:yytx57MJIwHJAkM4AMPZQBp+oolVcwxGu3Sw2eAIAx:y6fMyGNAEQX+oaVcwu8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625555594, "uuid": "2ba140b0-6970-419c-9eea-294c23f07058", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625555594, "uuid": "6281445a-7dca-4200-aa57-a335c893f055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625555594, "uuid": "4b058cd8-8d66-492c-8186-7e2e2e6ddf7d", "value": "62b86552c8a9538ac56d3f4290077a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5732275-de21-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625552165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552165, "uuid": "1c2f8b2f-e229-4255-ba2e-cd4347f47c07", "comment": "Malware payload (SnakeKeylogger)", "value": "450f7da1feb7c0cbb599184e640af196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552165, "uuid": "e9422f31-5a27-45fc-983b-b08f10997944", "comment": "Malware payload (SnakeKeylogger)", "value": "eef8296b48413e2526b7d3c0f32fb61f74af87c42d3fb6d0a9cceff38d94b783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552165, "uuid": "c1206f63-959e-4703-b83e-3a299ed47e1e", "comment": "Malware payload (SnakeKeylogger)", "value": "bb9a5205293f5a8a7dc7bf11f3037c36becc4e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625552165, "uuid": "df02d7d8-c5a5-4e09-804e-20e78e985867", "comment": "Malware payload (SnakeKeylogger)", "value": "4eadb80d98ec58e64d2ba65ccd5806e380194c09eed3d0d3ca7eac23f0827c9cb1c8b4a8bd18c10fa1fb2240954cf6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552165, "uuid": "a4b71739-ade4-4762-802a-23a86e19d77f", "value": "7F558DB5A861465ADC6FCE34C3326D3C0FA77E79FD5FA6396840718B32A76830922513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552165, "uuid": "509db995-2489-44c6-b642-6dc65839e32d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552165, "uuid": "cecb3418-b4c8-4abe-9013-65408f6ffcf8", "value": "12288:Pm5JWW6NsBgOaDaDaK0b7wISr2QJIJfNtjjf5JuSwT6AqDKEa1aq:PKJ56NTOaDaDaKOyrnOfNtj/D1a1aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625552165, "uuid": "35271ac0-9135-4b97-adfe-c4d1bcd89327", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625552165, "uuid": "1ae6ebc1-4104-4a73-8ec2-d00dda31ac26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625552165, "uuid": "6f743fc8-4693-4f69-b1aa-87fe6fb7a8cd", "value": "ESDCO0098655.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca8049-de92-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625600528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600528, "uuid": "5f0f632f-78ca-47f8-a35e-ca42cde51143", "comment": "Malware payload", "value": "14c3183c610cad3bc1bb5bb8fc78c2d3", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600528, "uuid": "1f5dd89a-7a64-488b-813f-e247b408d7a5", "comment": "Malware payload", "value": "efb609d20da350260b06bde4f21813eb6d6fc7f71a675bb5b0609b6aebe44df7", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600528, "uuid": "68970784-bea6-407c-a967-1fe81a92a108", "comment": "Malware payload", "value": "73bbe31453df465a8adb05d22a40149de702f9a9", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600528, "uuid": "5cf9b6be-b7cd-45d8-a0e0-4ad322572576", "comment": "Malware payload", "value": "feab6297c62fdfb4e118d5a22ef7dd761ba4f5c1b5fb6b42bdb00ceba9f58194cb7aedcc8e235ba1d9154c7824f2b67d", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600528, "uuid": "1ef8d198-e0f1-43d4-8542-eec690d7d555", "value": "5F15D000B980EA71D5A352764F76E685033CBD214B64CECB339C374E5F3A5E26A357A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600528, "uuid": "df42d290-4f76-42a8-a2ce-653840dca6f5", "value": "24576:vEIZ4wA74D4SQKxZcy8gthDWc+pUmUI+:v+wJD4QZh/qVamUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625600528, "uuid": "e5d0bccf-2f64-4941-8233-b159eaf5b1e1", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625600528, "uuid": "24b52d3f-693b-4b3c-b832-0a3ff6227fa6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600528, "uuid": "dff6ccbe-aa91-4101-8501-71a740a5c79f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc076b7-de1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625549740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549740, "uuid": "fa026196-6976-4b93-a3d8-30fcd5cec25d", "comment": "Malware payload (Formbook)", "value": "99adce8a64a582e6e1fd98f2fa7eb404", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549740, "uuid": "4c6ac9b4-e183-48eb-9df1-418be0c4ecbe", "comment": "Malware payload (Formbook)", "value": "eff94544aa4d01176bc39e7ed1d06f4cb2da84458a0e5129d22e817ac2016b13", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549740, "uuid": "3959ccaf-3fe0-4b2e-bc67-d8b3349919b2", "comment": "Malware payload (Formbook)", "value": "4996234119a9cf70b98c492170d09a5a7565955f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625549740, "uuid": "52a2deb8-1572-4000-88bb-40f20afc9c59", "comment": "Malware payload (Formbook)", "value": "2f5689831d9d23d39303f0009f1b7f2a78855eb4a7ee41435eab6e5164ec0b7141c5bb116b2080be8cb99e6817f8fea9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549740, "uuid": "64bf7967-008d-4f37-a61f-e07d3d4fc002", "value": "C0D4D02B739266EAC0094D364556298C02F1C5176232F36F3CDE26E4CFA779E6B1B316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549740, "uuid": "fb8d75e2-6a22-4973-85f1-3fba7082fccd", "value": "12288:ZdGQ11eGhSVb0nzFgyO7PYvm54bsTwrE8hbOz:3GkcG6qzeLYmSt4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625549740, "uuid": "4bc79569-f0d1-44a5-b69f-1a049fb0acb5", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625549740, "uuid": "78cf742d-0c0d-4672-8d8d-a42db7653ffd", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625549740, "uuid": "a460d29b-2cbc-4335-8b11-ef56f1bb731d", "value": "MT103_20210701084_USD35,660.93.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec93110-de3b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625563267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563267, "uuid": "b62dac82-8c30-4e5e-a7c8-a432085bffd6", "comment": "Malware payload (NanoCore)", "value": "bb582e02ec9e76e40f281ab1f64d6091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563267, "uuid": "3f8474cd-16d5-400e-b676-de6759ecafe8", "comment": "Malware payload (NanoCore)", "value": "f0cc59c712e8c68237cd1d3a75f610bd3b1b7084c7c944b33d53d8d5b11e6ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563267, "uuid": "b72ed2f2-6778-41d1-b69e-ba0ad154078e", "comment": "Malware payload (NanoCore)", "value": "716c6532555ecc6e6764d81fc06a355920cc2d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625563267, "uuid": "a35baff1-d6b9-4e0f-ae2b-d6d1c425eb83", "comment": "Malware payload (NanoCore)", "value": "23ba6e005b5842ae0a48529680ddc934bfd53cc894368850733014c5a7aa15ad1a154a3e54ea70fe1abd738e7ae98d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563267, "uuid": "de944836-4a67-4fb2-910b-e4c8d007b897", "value": "60158D3037C49B78F17E8F779057A520A3FEE917A716DA0C7CE501CA1B62B82C6B151A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563267, "uuid": "05ef5f2d-1d9c-48da-ba87-e86eae0d545c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563267, "uuid": "707f0e40-fbdc-44b5-97fd-5c1013201958", "value": "12288:+cbLQgEA1EOGQy+yrOBwqmNwBjTSzKRHz+8sngD6IyVEbu9LyV:+KLQQB74wBjTBTEV4bu9LyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625563267, "uuid": "3582d206-aa3a-4c4c-a061-15ba31d8a273", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625563267, "uuid": "77cbaecd-6377-4c03-869e-a7310827249e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625563267, "uuid": "236372b4-c272-43f1-bfb4-77315607a53b", "value": "BB582E02EC9E76E40F281AB1F64D6091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371529de-de3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625562717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562717, "uuid": "5affac54-08d2-4541-aa6d-85e96641dae8", "comment": "Malware payload (Formbook)", "value": "3ecdafd3c19efbfc4f06d5d2aefd02b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562717, "uuid": "71036395-66a9-4b1b-b421-6678ce8c64c9", "comment": "Malware payload (Formbook)", "value": "f198ab80b865300fc6721e506292ddbe21d18004daec3f567c53fd9e2d86dc7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562717, "uuid": "34eb062b-f9a0-41df-88a6-241b9045fa8b", "comment": "Malware payload (Formbook)", "value": "808ab748f5fee7b4f5b802a89b1e3ac44e47fdd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625562717, "uuid": "a0c3214a-1c2d-45bd-b9a8-504076bf8e28", "comment": "Malware payload (Formbook)", "value": "9e21b73a1a889480fa8373c1114d0a63b03757c8b7f51af1b15d3e1ea56d9aa8624f53c06cc7f39647ce4fd6b3e5b7cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562717, "uuid": "f6b8f1fc-dc58-42a7-a27f-ee29ef8a3c03", "value": "74159E7A60368BA2ED6FCA380B35D57C0F5ABE75814BB13814C47D1B30F1B5507AA92B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562717, "uuid": "809aaf20-6a4c-46e6-8527-e8d959584bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562717, "uuid": "6f670686-ce3c-4827-a3c6-3a1d09f0121d", "value": "12288:+6NsBhnXmu/5XUCEUOZHA9pMwIZLNIwGNc7tjL8DP:+6Nc2u/5XAfcIZiwZFcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625562717, "uuid": "3224891b-d531-4aff-b727-f77d4ebff8e6", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625562717, "uuid": "4ac7608e-0165-493a-99d2-9345d36ac3b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625562717, "uuid": "caeb1d32-5991-4cb3-acf3-ffdb4cb11088", "value": "3ecdafd3c19efbfc4f06d5d2aefd02b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7a0735-de6f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625585406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585406, "uuid": "ee10193d-0c42-413f-a759-c4dc07f9df82", "comment": "Malware payload (Formbook)", "value": "a1cc8c2118aa8000900bbf4bcf272623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585406, "uuid": "6bb788a2-ff83-4fec-aba2-6de8c73db88c", "comment": "Malware payload (Formbook)", "value": "f365c491faaba01943e7ab894d34fccacbb9d2e8b9bcbe9f6eaf0e47aa420329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585406, "uuid": "e25d6be0-f568-47b5-8161-a1719158946e", "comment": "Malware payload (Formbook)", "value": "8597817896f8867b90f4743aab7146ea4bfece0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625585406, "uuid": "1c226d7d-fbbe-4e91-a49f-b6c68ad85dbb", "comment": "Malware payload (Formbook)", "value": "51077c054870432e682c0b31f2f276d80e4bc9cdf310fdeac02ee267991482d394468f92774d88d57b78139b251c33eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585406, "uuid": "3b93c688-44f3-4cc6-9b60-fbfa6fa90195", "value": "99159E7661768F92EEBFC7784335251C4FE9B376D34BF6B82C95608904C0F444AA2A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585406, "uuid": "9c649556-58cc-47c6-9b29-8d508e79d30e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585406, "uuid": "5804fb02-b740-4e29-9903-c1623e65b880", "value": "12288:Vd+PnPq6NsBDD/F08Sxye7K/Kfj6cQwHPFE8MZ6i7F2ooJY1SnPfi/d95A:Vdcni6NOYLdj8wvHYJoHal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625585406, "uuid": "efa0d192-a03d-4d74-8778-1ed5eec39ad4", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625585406, "uuid": "6c65e321-1c4e-40af-afea-391f4f691253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625585406, "uuid": "726784b8-4fb7-4af4-9bfe-26df5f5f6b85", "value": "RFQ-Order contract requirements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c434c5de-de72-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625587006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587006, "uuid": "0a896c2f-0d4c-46fd-8222-0e7c41845195", "comment": "Malware payload (Formbook)", "value": "59ca9c6abfc9e90eff96fd0e0d555883", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587006, "uuid": "7e415ab5-4311-491f-a683-729a798a0a52", "comment": "Malware payload (Formbook)", "value": "f4ef7494b1c168643b02aa759b424f239bb60f59e88b149ff7adabffe5a0720b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587006, "uuid": "90a3d93f-6235-41e9-ace0-2393091aa7f8", "comment": "Malware payload (Formbook)", "value": "767f7cac7e7836ee3cc88b39190b8dda0fd33a2c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587006, "uuid": "afd17c88-c6c6-4bf5-8134-3fe28fc3fd05", "comment": "Malware payload (Formbook)", "value": "de0372b581f7486c2c35b7a99f881f9764cacb379fd4580999dab02bec0ef6ba381cd37026b854960af001bbae7adf01", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587006, "uuid": "b88aa715-6dd4-4137-ab25-348c0c92d4e9", "value": "01855A76A072CE62DEBBD67B0320F53C0F5DAE758586B27424C8BC07FCB2A558A51523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587006, "uuid": "d4d3b293-c39d-4cc8-a82e-1cd7cbdea0ed", "value": "12288:U6NsBQnXmuniOK5bKR0jOYIdQ5pFypnjmwzRDJ97IJ2NWA9EoY:U6Nz2uif5rqCpgpjJdb1WA9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587006, "uuid": "15cb16b0-1e74-423b-9414-dc1b5d1d1a09", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587006, "uuid": "30ebace5-86f1-4376-8759-0add878f13b7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587006, "uuid": "90d1c381-6310-4c5e-868e-c1ac38a375ac", "value": "Purchase Order-734343433.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35944647-de76-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625588485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588485, "uuid": "074c8d80-adc1-429d-a942-d6a85fa6d08b", "comment": "Malware payload (Formbook)", "value": "c32025bcdb5f395414464705c115577d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588485, "uuid": "98b02bb9-fafc-4a24-8f06-766e09519b83", "comment": "Malware payload (Formbook)", "value": "f51577caa562fa4ddbe0882cdc469c1d701515af25662bc66797d79032d0d3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588485, "uuid": "69366957-a1c0-42ff-aee9-8507f6b6f90a", "comment": "Malware payload (Formbook)", "value": "1e31cb564e3d17f9111bd4f9820c4610d21bb5ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625588485, "uuid": "d2e7150b-feea-420e-9e11-11d89147d37e", "comment": "Malware payload (Formbook)", "value": "b15b86d14f34fd667cc3580a97a305fce36df8cb9b83acf4b40a3f24450f0d1f04a2f5ada2c13ecdc38631a81c2d7d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588485, "uuid": "087bb974-ce26-43ac-bee7-941fcfbbd4ce", "value": "CE659D3576729F91D87FC7384331E13C4FB8AE66E217E6B56CD8389B64B0B400A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588485, "uuid": "ebe78d54-10ee-4f3d-8a1b-288cf9340d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588485, "uuid": "0376873a-449a-4e41-8820-3ee47be7dbc4", "value": "24576:jiOOQh06aSbqt5s2345ReK1ahEaP7npb:jsw06fms9egW7np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625588485, "uuid": "9c3ba702-851e-4a1b-aa79-835e83011d91", "value": 1443840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625588485, "uuid": "7a38ebbd-0d47-4d69-99ac-971cb06bebd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625588485, "uuid": "9b2656f8-c8fe-487d-a449-fcfc61edb006", "value": "c32025bcdb5f395414464705c115577d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3db631-de71-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625586377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586377, "uuid": "0fd8111f-27ce-467d-89f5-0e38d0e42d17", "comment": "Malware payload (IcedID)", "value": "f45c798d44794fc75c16d6aac22b1e83", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586377, "uuid": "b13adc2f-0554-4b1c-a1a2-a748e347ea32", "comment": "Malware payload (IcedID)", "value": "f5472b197dc1ffb19095d59d99696cf47c41b334a8d25b32b431a80bbf1bbd00", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586377, "uuid": "0ae0aad0-6447-4f19-a82b-9b89318b1dd0", "comment": "Malware payload (IcedID)", "value": "6519f4988344c90ac3680dd910dc739f5ce7c442", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625586377, "uuid": "25a9061d-8ac1-4363-953d-cb7adafa0bf3", "comment": "Malware payload (IcedID)", "value": "acfa35c8a61777aedd0e6788a589e87602f2b1a084d58a5a54bee22e93d219a77026c01ffffb55ed48c6b1aff09becde", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586377, "uuid": "b47e46ef-d648-4a69-b41a-30d2b34e10eb", "value": "19040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586377, "uuid": "0bbb5c61-a7e3-44eb-a905-9b8214aadd43", "value": "3072:cDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:mRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625586377, "uuid": "bebf1598-5af7-47f2-a47d-c3bf9f493172", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625586377, "uuid": "25f8ccc9-0bcb-4177-bf86-95d514bdb423", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625586377, "uuid": "952e9c3e-fc98-4dd2-879f-92e193cf3beb", "value": "LL52387-01M4205301.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d95cdd-dea7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625609611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625609611, "uuid": "b361e667-5ee4-4039-846c-be1a19d43cfc", "comment": "Malware payload", "value": "d4be0a085db10789f786807e0694f1bb", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625609611, "uuid": "f5424c6a-532f-4dfc-b35a-846cb80401e3", "comment": "Malware payload", "value": "f611aa0d43e504d3542d9533fbdff4c29d552d4aa57b64b63f63ba869f449e3e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625609611, "uuid": "2ac5aa6c-5304-4ef7-bd5e-d2239bf34f7d", "comment": "Malware payload", "value": "dce0f13f8141409f4fa3919b1508df4aff69b445", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625609611, "uuid": "e83dae44-c8ee-465a-ae50-c01d48ee8183", "comment": "Malware payload", "value": "bac0e1fddc80db7d04b2d83db879ea91c0cc3aed1ad7f913da33b0ae7cd2f8392a3427a636c905e1b9e556e35c94fe17", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625609611, "uuid": "c3a7a03d-e4e7-4ef8-ba23-3c9230094c02", "value": "7E341237042EA491DDABB1FD112028F2BDC0C998C3A4F72AB4A8A6015ED701375A97F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625609611, "uuid": "bed4d33e-c390-4694-b3c0-17a7726634c4", "value": "6144:OS+zTqlduGGenTTT5ctGQXzg+SKt0VH5MGT6QqSc9RISe0:OS+zmlZnTTTutGQXMfLHOplSc9RISb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625609611, "uuid": "a88d3f20-405f-421c-b50e-b696a736e36f", "value": 242954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625609611, "uuid": "9c153de5-f45f-4b12-84de-2dac3b8edb2f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625609611, "uuid": "f210dc12-1d1c-4ac4-8d1b-f5bfbf361b77", "value": "licence_WR123456789.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf74f79-de74-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625587960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587960, "uuid": "b75922e8-bda9-4e5e-ab16-aa8d6d4e0b0a", "comment": "Malware payload (SnakeKeylogger)", "value": "e5cbe802fc9905046a3104457551c1a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587960, "uuid": "9d920896-f334-4105-80f6-af5f9842130c", "comment": "Malware payload (SnakeKeylogger)", "value": "f65f899fc6cc494d6c59311f4a0519fa6ba0c9859c8ce13a5adc30aa9fd1817b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587960, "uuid": "30f7d188-27c8-4874-9652-e242fb3198ea", "comment": "Malware payload (SnakeKeylogger)", "value": "4e65be97915b815f8e97fc152c49231aff66bb5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587960, "uuid": "555bff9a-d5a0-4272-afcf-f14ad8ec771e", "comment": "Malware payload (SnakeKeylogger)", "value": "4727e5ce868d7682c3342c3db2f26f4c2a3f4ee341dbf1e769b237ca7585b5eda2cf8ed8c30dedc5556359a24647d523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587960, "uuid": "88fa690f-7067-4c5f-bb82-c1c4bbb22a34", "value": "48B54C3D49BE2137C1BDD3B98FC8882BF840D66B71517E7998D607A5470AA8376C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587960, "uuid": "ee83e097-b077-49bd-87f9-df34d4a03f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587960, "uuid": "d79691bf-089b-4f86-8906-8fb2e4a10219", "value": "3072:AFPdFWS6jieLOmbmjisiGOrogUR18Exbs6Xi28nigNoKUt+ZpjkeCq4GQmeq/5CZ:oFWS6jieLOmbmjisiGOrogUga+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587960, "uuid": "5d550d51-762f-4613-8745-6ea2ca93dd79", "value": 2354176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587960, "uuid": "ae45dbb6-6f22-4785-9925-e3448cdc69fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587960, "uuid": "9f39ccc8-1716-4b82-b8cd-4bae555946fc", "value": "DOC09000900324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a1675a-de55-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625574316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574316, "uuid": "da5c9d0b-0ebc-41fc-95af-8c16937f1278", "comment": "Malware payload (Gozi)", "value": "984c1a4745ef37da4bfde6a72ba53dd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574316, "uuid": "e415460a-24b0-40f3-9303-042cf1e82910", "comment": "Malware payload (Gozi)", "value": "f7359f95b9333d20c9bdd980dc4afde3bba2e9705e9ea703f369055e8dd4d895", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574316, "uuid": "26404fea-fa85-4602-b372-9169b0be0b56", "comment": "Malware payload (Gozi)", "value": "88e24fd60376a5c3cb9d9b725e1aff39e3c5f056", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625574316, "uuid": "2b00e0cb-bbf5-4992-9f4c-fc3c06f569b4", "comment": "Malware payload (Gozi)", "value": "60d97dca09bdb25146ee4ded438760b5d3922143b5e291449f0600ae0572ef007910504cf4168d5dc00a65b38bf22527", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574316, "uuid": "1b3e5958-6af5-4901-a424-c31bdfe2fa28", "value": "7B13F1F65F131C62EB8F79BD0138A56A977D0A9187148C46A264F3E03ADA544781F732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574316, "uuid": "14cf52ca-ff14-4a7c-939e-b3ec31326bd0", "value": "6e9163c62b29a1ccabed40ce8621a95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574316, "uuid": "e404b717-1313-4915-abfc-1dafa392245c", "value": "768:ZmN5LNvGd4RoFgmPsnwx+yXqv4kC9/VWH64A1xbDOhtMhDbPm+K5StOQM80Epp:ZmNtUOKywnavdM/V+6OzsrJK9Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625574316, "uuid": "f3638f7c-5a3c-45dd-86d8-80fdc11ceddc", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625574316, "uuid": "f3dbee48-8097-41b8-91e2-b8e700dfe7f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625574316, "uuid": "e645aa3b-54bd-4b51-9a6f-05749845b5ea", "value": "27a0000.da.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec9cbe8-de73-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625587292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587292, "uuid": "1ccaa90a-8752-405f-8dcf-e9f575aa96c3", "comment": "Malware payload (RemcosRAT)", "value": "44cac023d2240b6bb2130ebb9203cbdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587292, "uuid": "90ff1cdc-3b12-4f82-b01a-80cbe4ab48f8", "comment": "Malware payload (RemcosRAT)", "value": "f78b8f13eb0533a8ad4048ec71de54b8dd7d6f02add47d775fd96c3a557face6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587292, "uuid": "956e7330-253a-4976-917a-ce6ef5fb4064", "comment": "Malware payload (RemcosRAT)", "value": "53ce8684a6d77d6bde689ad6ebf7296e4d68f2b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625587292, "uuid": "290c25a5-ba75-4a0b-a2e7-3f12d46c2966", "comment": "Malware payload (RemcosRAT)", "value": "946834b5f168b1b626075383d63f93d36b69ce736dbcc490cd83288bb9f8ec556b55cd2b6691a22204c2a6666620c010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587292, "uuid": "364a7e8b-9e44-47d9-83e3-9ac474fe0a27", "value": "7BD48C595CF4DD22FCBCFEF4EE4193461D6E6D3244A57B487AB3BEA926B10B6200D060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587292, "uuid": "db967b82-d6e5-4a04-85cd-25b393f1c0e9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587292, "uuid": "17a58eec-7c30-4510-b584-ac91389efec8", "value": "12288:8yvi2mu5Vc7A19hP0Xe6oWVdUTOTUYZ1T3SCvscjBJ9hWbG9:Hvi5uB1bP0UW7TdBVLeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625587292, "uuid": "f7dd98ae-1062-446a-acd4-52db46844f8b", "value": 603430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625587292, "uuid": "7d224f26-dff6-4c42-aaa6-6d5bb01624a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625587292, "uuid": "6a616f10-d517-40a1-9bab-bcd500b666c1", "value": "44cac023d2240b6bb2130ebb9203cbdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ac2174-de5c-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625577372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577372, "uuid": "6b1f5ec0-67b7-4451-8ed0-890fe231f689", "comment": "Malware payload (IcedID)", "value": "2f26b7de4c1dcf7c296eb0c9770648fc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577372, "uuid": "d70084f9-5a51-4a9e-ab85-773995bdfdf0", "comment": "Malware payload (IcedID)", "value": "f7d6120e9efa0d813fb8916b1651a39b6301f3b6cc4734a531f4d98b35df38a9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577372, "uuid": "2df77b4e-1c42-4770-8159-f14d1fb253c7", "comment": "Malware payload (IcedID)", "value": "02e0f149bdb25fbff91f37f49db1bf97962a9247", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625577372, "uuid": "ab8aaa9d-b6cc-4cf8-a32c-8111834a9b58", "comment": "Malware payload (IcedID)", "value": "75f5740f56e2f71c8684d34f1ecb3891ec464d3d7f482e30c2221727abf6be5b0183c05db598efeefb5a059d1d4d7e1f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577372, "uuid": "62e977fa-15a9-4191-8bb5-b6c74004c75d", "value": "A8040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577372, "uuid": "9e913129-886d-48ad-9dfa-1fc5426cfb6f", "value": "3072:2DusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:0RcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625577372, "uuid": "150ddb5e-e877-474a-b8f1-8da9178a6bd9", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625577372, "uuid": "dca7c33a-d88e-4471-9c8a-ea6d138ba873", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625577372, "uuid": "636f48ce-6eea-4e02-a0e5-a54d7041e510", "value": "Outfordelivery799862.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52edc3ac-de24-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625553315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553315, "uuid": "c0788c74-ac5f-495c-8502-9ee5d582bfe4", "comment": "Malware payload (RedLineStealer)", "value": "1ccb196962b925007bec289536b06a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553315, "uuid": "6758187c-a722-4f69-8395-e6bebe02ded5", "comment": "Malware payload (RedLineStealer)", "value": "fa828910a57f28e7f5c5d98f5bceb8c082dec0f2b71d225a06ee231d326e713e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553315, "uuid": "3360a47f-811e-400c-b4b9-444c72cfa22d", "comment": "Malware payload (RedLineStealer)", "value": "5de8b4b13f1160b82aa93075af2f00e8066490bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625553315, "uuid": "626d0a7c-393b-4df9-afff-909fb3bf9a50", "comment": "Malware payload (RedLineStealer)", "value": "5820c4a9ac02e425f93eb30bbdee735521ca43abb33f55b5c1dc5b170fd12c45543f1da73ed0b27ae3f899e4542c30be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553315, "uuid": "31c950ce-c614-48be-9c93-378dec072d5d", "value": "95453321182C3B28CAAF5D7879509627D7D16E394DF70760FD07765A0BB828ECFA421B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553315, "uuid": "300a4547-4fe3-4fbb-9b7c-7697a1749856", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553315, "uuid": "316f403c-6069-449b-ac53-332bff5db64c", "value": "24576:Ov1aiFUKzz6gq7/KTlUMwBITuFfxFXa1DYtOeJRQgtWlG85o9i:s1a2DzzXa/wdwfW1Sfc5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625553315, "uuid": "82908fee-6f59-41b1-83ed-db2ee61561fd", "value": 1235624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625553315, "uuid": "2f5691fc-0740-43db-abc5-a8995bdf309f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625553315, "uuid": "c8018cf0-60b6-4687-a486-ccf2f79cec2a", "value": "1ccb196962b925007bec289536b06a55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666c3072-de92-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625600592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600592, "uuid": "aa0b0e59-991c-4755-8253-6a2894791b1c", "comment": "Malware payload", "value": "9b59d4744ff1de8b338eeb2b85748cf2", "object_relation": "md5", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600592, "uuid": "9cd36147-0f96-4632-8263-3f463971d8f6", "comment": "Malware payload", "value": "fc1f9739dc9d6e9c61222beb9e3552bbc9a5a94699eb48aafeb6491a404e8ad4", "object_relation": "sha256", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600592, "uuid": "de7bdb47-5397-4a1e-b110-753f44cc31a5", "comment": "Malware payload", "value": "f3306e866bc9992c2268f204f55e88f89833a25d", "object_relation": "sha1", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625600592, "uuid": "c1a3e11a-070b-4cb9-9fc8-99020b4e42e6", "comment": "Malware payload", "value": "ea46338c6ae9aeda0980bcccdeef4b1e946d214a6c36b384eb7f580d1555f58b4e689c49c2573dbf46e740642691006a", "object_relation": "sha3-384", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600592, "uuid": "06296b0e-a8f9-4a07-8906-be5069586d24", "value": "2A745A007940E971E5E312764F69E686533CBD110B618ACB33DC3B9E5F3B1E26A36762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600592, "uuid": "d2341448-8f72-425d-88f1-b34bfb47eb57", "value": "66ea5ae56a1ad0183ee81e788900c71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600592, "uuid": "f90b07c3-79f7-423b-b6ac-abcc08169b2e", "value": "6144:FzU8/N+o/63hL1NcmZglxvDf7U9RG7yH+pJ:mM+pUmWlhWQi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625600592, "uuid": "47e32c37-5677-483e-bf62-d1c49178f60b", "value": 337807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625600592, "uuid": "f85ea531-c18c-4374-8104-730771c28f9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625600592, "uuid": "f645327c-8667-43cc-ba8a-ccb1cd94c277", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5d501c-de7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625591907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591907, "uuid": "949e7edd-4913-4a8a-b98b-da78445419a9", "comment": "Malware payload (Formbook)", "value": "6daec53f24ac5b5fcfd4bd2e06139ee2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591907, "uuid": "f458c4b6-6f5a-447a-8b47-ae0e0c1bce11", "comment": "Malware payload (Formbook)", "value": "fd01045f31ef0fecadcff000ef64a9cae53dc8ca6caa6d109c233c6f2d8c2b14", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591907, "uuid": "75441cdd-e7e7-4759-9074-2d99f5105895", "comment": "Malware payload (Formbook)", "value": "90a19ab37e385ecaf6e6600032e465d95c45b2d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625591907, "uuid": "90873675-c08c-4089-9a83-f13ea9640210", "comment": "Malware payload (Formbook)", "value": "8cfbff73ec2929aaf319ef9f1a3725149139f20a9e9e5bd1f08465a5031d2077583394a86cc0f2c32e2d7939158e1655", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625591907, "uuid": "aa718554-d077-4072-8499-f2a167646078", "value": "418596DB786291C2C38BDAF49D6AB2CC922EF4E50CC856450815C3F92C5A6DBC70FD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625591907, "uuid": "c2dc4e6a-4ded-4112-adbb-16dc9c911746", "value": "1536:1aigzise/////////rV//R/KQaeOYK6DJ/KbraiYtrKQaeOYK6DJ///+/P///KbU:KP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625591907, "uuid": "0bc6639a-6dfa-4005-9e08-736ef57072c1", "value": 1860077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625591907, "uuid": "0e9e90a5-02b3-467b-b60e-2e4fe6c58f60", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625591907, "uuid": "9c25ffbf-fd94-4719-9ad4-95f8ba5880e9", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.19988.6236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8445b4-ddf3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625532232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532232, "uuid": "b9096b2b-b2da-4e26-b6a4-02fe236bbc8b", "comment": "Malware payload", "value": "d146dba321e29ccabae96ca1c557ba60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532232, "uuid": "33d110f6-1762-4849-818d-065bbdd5dcad", "comment": "Malware payload", "value": "fd5e5844a7fa354f427096c541c2952ccd96222302b5feceeca5f298658db71e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532232, "uuid": "79ead137-eb54-4f6c-bd73-84effee63212", "comment": "Malware payload", "value": "0f9131ce641dffb85c9248e17a0f4e30598e4240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625532232, "uuid": "5396b71a-ee8b-4910-8923-10d9728542e1", "comment": "Malware payload", "value": "2d06b07670148534d56daec9023f00f7572ad854d2ebacb46102331a31e34ebe026040113bb3c1dd6202edf4c0879b99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532232, "uuid": "a12d151d-32bd-4376-9687-558aad80d62a", "value": "8D35E011F7914878D076C434CA638613DAB2B89A0FA4EADF2394926D1F777E45B3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532232, "uuid": "931885fc-6e93-4f2d-9c3b-7889d8df8a40", "value": "9ad22365520b11a0847833f100aa3244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532232, "uuid": "0e202e27-bfec-4068-8b9b-6ee0c9f23516", "value": "24576:3zJla39cGH0dg7sOlQCig1abH9RKP3QUxq8m1:dlq9n7h2/waL9RKP3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625532232, "uuid": "70ff13c0-8195-4d05-91fa-ee8612bbd589", "value": 1089488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625532232, "uuid": "3dded060-cb35-417b-bad2-72957789f145", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625532232, "uuid": "e7b404d1-07aa-4a58-bd7f-5e5b114ca728", "value": "d146dba321e29ccabae96ca1c557ba60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96807cd-de59-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625576331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576331, "uuid": "a03fc919-bfea-4723-a40d-151fec21bbcc", "comment": "Malware payload (RedLineStealer)", "value": "1da63c9904ccd13401507d9726da8c00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576331, "uuid": "8b35cd65-5529-46ad-bb6b-b252782d3312", "comment": "Malware payload (RedLineStealer)", "value": "fdccd5539f179d7b405ebbc63749ce662af29a3bbe0b66816cce09029e785aaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576331, "uuid": "52cf177b-0fd3-4736-aed3-9fbb22f67dea", "comment": "Malware payload (RedLineStealer)", "value": "7000a62c7f82f27fe324fcc92653804213faaa06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625576331, "uuid": "58f78bc7-3439-4ae1-91b3-19bf4f9ef0f0", "comment": "Malware payload (RedLineStealer)", "value": "f0352099b6afd62e34ad281f002eea30cbabb603c6663cc54b85c0985cd22d81dbefe26cdae3e4707893ae9d212c196a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576331, "uuid": "604210d7-8bbb-4a4a-b47a-e501016c2b7f", "value": "8EF3902623A7C436C4D42230A4A1CB3B3728CD1717B5B347B5C5AE67BDAB24C59BC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576331, "uuid": "d8b92675-38ef-42f9-9286-c214171a546a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576331, "uuid": "9359906c-379f-4803-b08d-0ebe9c6a1150", "value": "1536:pVHnSPN/Rfa7Td9vHr7nvQtw/hpoO47UXpxs6FGRQ:SVRa7jP3/hpoO40A6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625576331, "uuid": "b1c21879-10c4-497a-8e2a-5f96fe31d039", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625576331, "uuid": "692f0383-7cc0-43db-83a3-4e71ffb6d4ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625576331, "uuid": "6b735d9d-6de4-4498-ac6f-6361ecd51501", "value": "1da63c9904ccd13401507d9726da8c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bed4457-de3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625564980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564980, "uuid": "310e9252-9988-4f2e-848b-21f03faab6d4", "comment": "Malware payload", "value": "37be18494cd03ea70a1fdd6270cef6e3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564980, "uuid": "13f97c7a-6aa3-4b3e-923b-960ea5e3425e", "comment": "Malware payload", "value": "fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564980, "uuid": "7cb3642c-bc3c-4538-bbdc-d2846fe02c59", "comment": "Malware payload", "value": "4714aaa5195da29c6e74aeee9e9f19678af5c15b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625564980, "uuid": "39245a27-aa53-48f7-bf20-5e81c4709e13", "comment": "Malware payload", "value": "98f5e24350c882d22a8c99a8c1e14c1bf2bf2aad7aefcd2df7a10eb7c4dfbb6982bfaacedd3456cd3334409f6132e33d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564980, "uuid": "0bebaf96-2c9b-43fc-8f5b-c4a8cd5ce136", "value": "09162315BEEED426D40FD13890A2D9CB8C280DBD5524F97F5622516C2EBAC84DB43EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564980, "uuid": "1261732d-9785-4ac0-95cc-84b13042e130", "value": "98304:ObOoMyx7cvw6sscAANEowsE/6spqR9HTUzFRUkLqQU1K2b:HHyx8BAeowsEyNR2zFRUYab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625564980, "uuid": "c00f9682-7fd0-4ef9-b4b6-1a4abc2c5cd0", "value": 4382628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625564980, "uuid": "8c0aac6b-a905-49b6-83ec-cc2c04431e33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625564980, "uuid": "6eb24aea-11fe-46d0-8a6e-b663a7320241", "value": "Voicemail.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }